Article · Security & Passwords
MFA for small businesses: the single best security step
What multi-factor authentication is, why stolen passwords make it essential, which types are strongest, and how to roll it out smoothly.
If you only do one thing to protect your business this year, turn on multi-factor authentication (MFA) for every account. It’s inexpensive, it takes little time, and it stops most of the account takeovers small businesses run into.
What MFA is
MFA means signing in takes two things: something you know (your password) and something you have (usually your phone). Even if a criminal steals your password, they can’t sign in without your phone.
Why passwords aren’t enough anymore
Passwords get stolen all the time: through phishing emails, data breaches at other websites, and people reusing the same password everywhere. Once a criminal has a working email password, they can read your mail, send invoices with their own bank details to your customers, and reset passwords for other accounts. MFA stops a stolen password from being enough.
Not all MFA is equal
From strongest to weakest:
| Method | How it works | Notes |
|---|---|---|
| Passkeys and security keys | Your phone or a small USB key proves it’s you | Very hard to phish. The strongest option. |
| Authenticator app with number matching | Approve a sign-in by typing a number shown on screen | Strong, free, and what most Microsoft 365 businesses use |
| Six-digit app codes | Type a code from an app | Good, but a convincing fake page can still trick someone into typing it |
| Text message codes | A code sent by text | Better than nothing, but texts can be intercepted or redirected |
For Microsoft 365, Microsoft Authenticator is the usual choice. It’s free and uses number matching by default. See Your first day with Microsoft 365 for what setting it up looks like for an employee.
Where to turn it on
Start with the accounts that matter most:
- Email and Microsoft 365, for every user, including the owner
- Admin accounts, for Microsoft 365, your domain, your firewall and other systems
- Banking and payroll
- Remote access, like VPN or remote desktop
- Your accounting, CRM and other business apps
Rolling it out without the frustration
- Tell people why first. A short note explaining that it protects them and the company goes a long way.
- Set a date and help people through it. Most people finish setup in under ten minutes.
- Remember trusted devices so people aren’t asked constantly on their own computer.
- Have a plan for lost phones. Make sure IT can get someone back in quickly and safely. See How to move Microsoft Authenticator to a new phone.
- No exceptions. The one account without MFA, often a shared mailbox login or the owner’s, is the one attackers find.
One warning for your team
The most common attack against MFA today is simply asking. Criminals send repeated approval requests hoping someone taps “Approve,” or call pretending to be IT and ask for the code. Teach everyone: only approve sign-ins you started, and never share a code.
Need help turning on MFA across your business? Learn more about our cybersecurity services.