Setting up MFA across your business

Why MFA is the first control to put in place

Passwords leak. They are reused across sites, guessed, phished and sold in bulk after breaches at companies you have never dealt with. Multi-factor authentication, or MFA, adds a second proof of identity, such as a code from an app or a tap on a phone, so a stolen password on its own is not enough to sign in. The Canadian Centre for Cyber Security lists MFA among the most effective steps any organization can take.

MFA does not make an account impossible to break into, but it raises the cost of an attack considerably. Most criminals targeting small and mid-sized businesses rely on volume and easy wins. When the easy win disappears, they usually move on to someone else. It also gives you a clearer picture of attempted break-ins, because blocked sign-ins show up in your logs.

Start with an inventory of accounts

Before you switch anything on, list the systems your business signs in to. Email and Microsoft 365 or Google Workspace come first, because a compromised mailbox is the starting point for most fraud. Then add banking, payroll, accounting software, remote access tools, your domain registrar, social media accounts and any line-of-business applications. Note who owns each account and whether it is shared.

Shared logins are a common problem. A single front-desk account used by four people is hard to protect with MFA and impossible to audit. Where you can, give each person their own account. Where a shared account must remain, store it in a password manager that supports shared one-time codes.

• Email and productivity suite
• Online banking and payment platforms
• Payroll, HR and accounting systems
• Remote access, VPN and firewall admin
• Domain registrar and DNS host
• Social media and website admin

Choose the right methods

Not all second factors are equal. Text message codes are better than nothing, but they can be intercepted through SIM swapping, where a criminal convinces a mobile carrier to move your number to their device. An authenticator app such as Microsoft Authenticator or Google Authenticator is stronger and costs nothing. Number matching, where the user types a number shown on the sign-in screen, helps stop people approving prompts they did not start.

For administrators, finance staff and executives, consider phishing-resistant methods such as hardware security keys or passkeys. These are tied to the real website, so a fake login page cannot capture them. Start with the people who hold the most access and expand from there. Security keys cost little compared with the cost of a single compromised finance mailbox, and most work with Microsoft 365, Google Workspace and major password managers.

Roll it out without disrupting work

Announce the change a week or two ahead and explain why it matters in plain language. Give people a short guide with screenshots, and set aside time when someone can help them enrol. A phased rollout works well: IT and leadership first, then finance, then everyone else. Leaders going first sends a useful signal that this is not optional.

Plan for lost and replaced phones. Decide how a person proves who they are when they need their MFA reset, and make sure the help desk never resets MFA based on a phone call or email alone. Attackers know that the reset process is often the weakest link and will pose as a stressed employee to exploit it.

Close the gaps afterwards

Once MFA is enabled, check that older sign-in methods cannot bypass it. In Microsoft 365, legacy authentication protocols such as basic authentication for POP and IMAP do not support MFA and should be blocked. Review which accounts are excluded from your policies, keep exclusions to a documented minimum, and look at sign-in logs for repeated MFA prompts that users did not expect.

Teach staff one simple rule: if you get an MFA prompt you did not trigger, deny it and report it. An unexpected prompt usually means someone already has the password, which makes it an early warning worth acting on. Add this rule to your onboarding material and repeat it during regular security reminders, so new and existing staff respond the same way.