Turn on MFA everywhere it matters, with methods that resist phishing

The short answer

Multi-factor authentication (MFA) means signing in with something you know, such as a password, plus something you have or are, such as a phone app, passkey or security key. It is one of the most effective controls against stolen passwords. A Microsoft Research study of accounts showing suspicious activity estimated that MFA reduced the risk of compromise by 99.22 percent.

For a small business, roll it out in this order: email and Microsoft 365 or Google Workspace, remote access and VPN, admin accounts, finance and banking, then every other cloud app. Prefer phishing-resistant methods (passkeys and security keys, which CISA calls the gold standard) for admins and finance staff, and an authenticator app with number matching for everyone else. Avoid text-message codes where you can.

Which systems to protect first

1. Email and your main productivity suite. Microsoft 365 or Google Workspace is the front door to files, chat and password resets for everything else.
2. Remote access. VPN, remote desktop gateways and any zero-trust access tool. Cyber-insurance applications commonly ask about MFA on remote access.
3. Admin accounts. Global admins, firewall management, domain registrar, DNS and backup consoles. These need the strongest method.
4. Money. Online banking, payroll, accounting software and payment processors.
5. Line-of-business and customer data. CRM, practice management, e-commerce and website admin.
6. Everything else. Social media, marketing tools, vendor portals. Check whether each supports single sign-on so one strong login covers many apps.

MFA methods compared

Not all MFA is equal. Attackers now use fake sign-in pages that relay codes in real time, and “push bombing” that floods phones with approval requests until someone taps yes.

CISA’s fact sheets describe FIDO/WebAuthn as the most widely available phishing-resistant MFA, and recommend number matching for organizations using push-based apps that cannot move to phishing-resistant methods yet. Microsoft Entra ID and Google Workspace both support passkeys and security keys as of 2026.

Turning it on in Microsoft 365 and Google Workspace

• Microsoft 365. Small tenants can turn on security defaults, which require all users to register for MFA and block legacy authentication. Businesses with Business Premium or Entra ID P1 usually use Conditional Access instead, which allows finer rules such as requiring compliant devices or stronger methods for admins. Do not run both.
• Google Workspace. Admins can enforce 2-Step Verification for the organization or specific groups, set an enrollment period so people have time to register, and restrict allowed methods, for example security keys only for admins.
• Legacy protocols. Old mail protocols such as POP and IMAP with basic passwords can bypass MFA. Block them, and find out first which copiers, scanners or apps still use them.

Our guide to Microsoft 365 security settings covers the related tenant settings.

Not sure where MFA is missing in your business? Our free Technology Health Assessment takes about 30 minutes of data collection. The next day you get a plain-language report rating your IT operations, cybersecurity, business continuity and more as controlled, needs attention, significant exposure or unknown, with a short list of next steps in order. It is yours to keep, with no obligation. Book your assessment.

A rollout plan staff will accept

1. Inventory. List every system with a login and note whether it supports MFA, single sign-on or passkeys.
2. Pick methods. Passkeys or security keys for admins and finance; authenticator app with number matching for everyone else; text codes only as a fallback.
3. Pilot. Start with the owner, managers and IT. Leaders going first sets the tone.
4. Announce clearly. Tell staff what is changing, why, the date, and how long setup takes (usually about five minutes).
5. Help people enroll. Hold a short drop-in session or screen share. Have spare security keys ready for people who will not use a personal phone.
6. Enforce. After the enrollment window, require MFA and block legacy sign-ins.
7. Extend. Move through the priority list above, one system group at a time.
8. Review. Check monthly for users not registered, and look at sign-in logs for repeated MFA denials, which can signal an attack.

Edge cases to plan for

• Lost or replaced phones. Write a recovery process that verifies identity by video or in person before resetting MFA. Attackers call help desks pretending to be staff.
• Staff without company phones. Offer a security key instead of insisting on a personal phone app.
• Shared accounts. Replace them with named accounts or shared mailboxes. Shared logins and MFA do not mix well.
• Break-glass admin accounts. Keep one or two emergency admin accounts protected with security keys stored securely, excluded only from rules that could lock everyone out.
• Leavers. Remove MFA methods and sessions when someone leaves, as part of your offboarding checklist.

MFA is not the finish line

MFA blocks most password attacks, but attackers adapt. Some steal session cookies after sign-in, so they never face an MFA prompt. Others call the help desk pretending to be an employee who lost a phone. Add these protections over time:

• Require managed or compliant devices for access to sensitive apps, where your licensing allows
• Shorten session lifetimes for admins and finance users
• Alert on sign-ins from new countries and on new MFA methods being registered
• Keep endpoint protection on every device to catch tools that steal browser sessions
• Train the help desk and managers to verify identity before any MFA reset

Together with phishing-resistant methods for your most important accounts, these steps keep a stolen password from becoming a breach.

What MFA costs

For most small businesses, MFA itself costs little. Microsoft 365 and Google Workspace include it, most cloud apps include it, and authenticator apps are free. The real costs are elsewhere:

• Security keys for admins and for staff who will not use a personal phone, usually two per person so there is a spare
• Higher licensing tiers if you want Conditional Access or device requirements, such as Microsoft 365 Business Premium
• A single sign-on tool if you have many apps without their own strong MFA
• IT time for the inventory, enrollment help and ongoing resets

Compared with the cost of one compromised mailbox, these are small numbers.

How JLB USA helps

JLB USA’s cybersecurity services include rolling out multi-factor authentication, access reviews, same-day removal of leavers, endpoint protection, email security and help with cyber-insurance questionnaires. We administer Microsoft 365 and Google Workspace for businesses with roughly 25 to 100 employees and start a screen share within an hour when someone needs help enrolling.

Keep reading

• Cybersecurity for real estate agents: stopping wire fraud and account takeovers
• Remote work security best practices for small and midsize businesses
• Email security for small business: the layers you need and what to buy
• Microsoft 365 security settings every small business should check in 2026

Related services

• Cybersecurity services
• Free Technology Health Assessment
• Microsoft 365 security settings
• Cyber insurance requirements in 2026