Multi-Factor Authentication for Small Business: Setup Guide
By Nemanja Vukmirović, Lizzard Solutions. Last updated 9 November 2026.
A supplier emails your bookkeeper asking for an urgent payment to a “new” bank account. The email really comes from your company mailbox, because someone guessed or phished the password a week ago and has been reading your mail ever since. A second sign-in step would have stopped that person at the door.
This guide shows how to roll out multi-factor authentication for small business accounts in a few days: which accounts to protect first, which methods to choose, how to switch it on in Microsoft 365 and Google Workspace, and how to avoid locking yourself out.
TL;DR
- Multi-factor authentication (MFA) asks for a second proof, such as a phone prompt or a security key, after the password, so a stolen password alone is not enough.
- Start with email admin accounts, then all mailboxes, banking, domain and hosting, accounting and your password manager.
- Prefer passkeys or security keys for admins, an authenticator app for everyone else, and use SMS codes only as a last resort.
What Is Multi-Factor Authentication for Small Business?
Multi-factor authentication for small business is a sign-in rule that requires every user to prove their identity with two or more different factors: something they know (a password), something they have (a phone or security key) or something they are (a fingerprint or face). If one factor is stolen, the attacker still cannot sign in.
You will also see it called two-factor authentication (2FA) or 2-Step Verification (Google’s name). For a small team the idea is the same. CISA’s MFA guidance calls MFA “a powerful way to protect yourself and your organization”, and Microsoft’s security defaults documentation states that, based on Microsoft’s own data, more than 99.9% of common identity attacks are stopped by MFA together with blocking legacy sign-in.
Key takeaway
MFA is not a product you buy. It is a setting that is already included in Microsoft 365, Google Workspace, most banks, registrars and hosting panels. The work is in switching it on everywhere and making sure people can recover access.
Action for today: sign in to your own email account and check whether a second step is already required. If it is not, you know where to start.
Which Accounts Need MFA First?
Do not try to cover every login on day one. Protect the accounts that would hurt most if someone took them over. A practical order for a team of 5 to 50 people:
| Priority | Account | Why it matters |
|---|---|---|
| 1 | Email admin (Microsoft 365 / Google Workspace) | Can reset every other user’s password and read all mail |
| 2 | All employee mailboxes | Email is the reset channel for almost every other service |
| 3 | Online banking and payment gateways | Direct access to money |
| 4 | Domain registrar, DNS and hosting | Whoever controls the domain controls your website and email delivery |
| 5 | Password manager | Holds the keys to everything else |
| 6 | Accounting, CRM, cloud storage, social media | Customer data, invoices and your public reputation |
If you are not sure what accounts your business even has, our small business cybersecurity guide includes a simple way to list your systems and owners.
Action for today: write down the six account types above and, next to each, who the admin is and whether MFA is on.
MFA Methods Compared: SMS, Authenticator App, Passkey or Security Key
Not all second factors are equally strong. The CISA fact sheet on phishing-resistant MFA ranks them from strongest to weakest. Phishing-resistant methods (FIDO/WebAuthn, such as passkeys and security keys) sit at the top. App-based codes and push prompts with number matching come next, and SMS or voice codes are the weakest because of SIM swap and phone network attacks.
| Method | How it works | Strength | Best for |
|---|---|---|---|
| Passkey / security key | Phone, laptop or USB/NFC key confirms the sign-in cryptographically | Highest, resists fake login pages | Admins, owners, finance |
| Authenticator app push with number matching | User types the number shown on screen into the app | Good | Most staff |
| Authenticator app code (TOTP) | Six-digit code that changes every 30 seconds | Good, but can be phished | Services without push or passkeys |
| SMS or voice code | Code sent to a phone number | Weakest | Only when nothing else is offered |
Passkeys deserve a closer look. The FIDO Alliance overview of passkeys explains that a passkey replaces the password with a key pair stored on your device, so there is nothing to type into a fake page. Google Workspace and Microsoft accounts already support them.
A worked example: a 12-person accounting office
The owner and the office manager get two hardware security keys each (one daily, one in the safe). The other ten staff use an authenticator app with number matching. SMS stays enabled only for the bank, which offers nothing else. The whole rollout takes one afternoon of setup plus a 15-minute walkthrough for staff.
Action for today: decide which method each group in your team will use and order security keys for admins if you choose them.
How to Turn On MFA in Microsoft 365 and Google Workspace
Microsoft 365 (Microsoft Entra ID)
For small tenants without premium licences, Microsoft recommends security defaults. According to Microsoft’s security defaults documentation, they require all users to register for MFA, require MFA for administrators, and block legacy authentication (old mail protocols that can bypass MFA). To enable them:
- Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator.
- Go to Entra ID, then Overview, then Properties.
- Select Manage security defaults, set it to Enabled and save.
- Ask everyone to register at myprofile.microsoft.com under Security info.
Before you switch, check that nothing still signs in with old protocols such as IMAP or SMTP basic authentication, for example a scanner that emails PDFs. Those devices will stop working once legacy sign-in is blocked.
Google Workspace
The Google Workspace 2-Step Verification guide recommends enforcing 2-Step Verification for administrators and for users who handle sensitive data, and calls security keys the strongest method. Google also discourages text messages because they rely on carrier networks and can be intercepted. In the Admin console you first allow users to turn on 2SV, give them an enrollment period, and then enforce it.
Watch out
Always keep a second admin account or emergency access account with its own MFA method, stored safely. Microsoft recommends two such “break glass” accounts. Losing the only admin phone is the most common way small businesses lock themselves out.
Action for today: create a second admin account, protect it with a security key or a separate app, and store its recovery codes offline.
Rollout Plan for a Small Team (One Week)
- Day 1: list accounts and admins, pick methods, order security keys.
- Day 2: enable MFA on admin, banking, domain, hosting and password manager accounts yourself.
- Day 3: send staff a short email: what is changing, why, and the date it becomes mandatory.
- Day 4: 15-minute session where everyone installs the app and registers. Save backup codes in the password manager.
- Day 5: enforce MFA for all users and check the admin console for anyone not yet registered.
- Day 6 to 7: turn on MFA in the remaining tools (CRM, accounting, social media) and document the recovery process.
Write the recovery steps into your incident response plan: who resets a lost phone, how identity is checked, and who to call if an account is taken over anyway.
Common MFA Mistakes and How to Avoid Them
- Approving prompts you did not start. Attackers send repeated push requests hoping someone taps “Approve”. Number matching and a simple rule (“never approve a sign-in you did not start, report it”) stop this.
- Shared accounts with one phone. Give each person their own login. Where a shared account is unavoidable, store its MFA in the password manager. Our password manager guide for small businesses shows how to set up shared vaults.
- Leaving MFA on a former employee's phone. When someone leaves, remove their MFA methods and move shared-account codes to company devices. Our employee offboarding IT checklist covers every account to close.
- Forgetting the domain registrar. A hijacked domain takes down your website and email. Check it along with the website security headers checklist.
- No backups for recovery. MFA protects access, not data. Pair it with a tested data backup plan.
- Turning it on once and never checking. Review the admin console monthly for users without MFA and for new apps that bypass it.
Quick check
Not sure how exposed your website and domain are? Our free website security check shows the basics in minutes.
FAQ
Is two-factor authentication the same as MFA?
Two-factor authentication is MFA with exactly two factors. In practice small businesses use the terms interchangeably.
Does MFA cost anything?
Usually not. It is included in Microsoft 365, Google Workspace and most online services. The only optional cost is hardware security keys for admins.
What if an employee loses their phone?
An admin removes the old method and the employee registers a new one after their identity is confirmed in person or by a video call. Backup codes saved in advance make this faster.
Are SMS codes good enough?
SMS is better than a password alone, but it is the weakest option. Use an authenticator app or passkey wherever the service supports one.
MFA is one part of a wider setup. See our IT and cybersecurity services for help with backups, device security and cloud configuration.
Want MFA set up without locking anyone out?
We plan the rollout, configure Microsoft 365 or Google Workspace, and train your team in one short session.
Talk to Lizzard Solutions