Multi-Factor Authentication: A Business Rollout Guide

A Streatham accountancy practice we know had a near miss last winter. A staff member received an email that looked exactly like the usual Microsoft 365 sign-in page, typed in their password without thinking, and moved on. Within hours, someone in another country was reading the company mailbox, watching for an invoice to hijack. What stopped it going further wasn’t the password — that was already gone. It was the second step: a prompt on the real owner’s phone asking to approve a login nobody had started. They tapped “deny”, changed the password, and that was the end of it.

That second step is multi-factor authentication, and it’s the closest thing to a free lunch in business security. This guide explains why it matters, then walks through rolling it out across a team without the usual grumbling and lockouts.

Why a password on its own isn’t enough

Passwords leak. They get reused across sites, guessed, phished on fake login pages, or bought in bulk after some unrelated company gets breached. Once an attacker has a working password, nothing else stops them — they simply log in and look like your member of staff.

Multi-factor authentication breaks that chain. It asks for something you know (the password) plus something you have (a code or an approval on your phone). Stealing the password no longer opens the door, because the attacker doesn’t have the second factor. Microsoft’s own figures have long put the number of account-takeover attacks blocked by MFA at well over 99%. No other single change comes close for the effort involved, which is why it sits at the centre of any sensible cyber security plan.

The three main methods, ranked

Not all MFA is equal. In rough order of strength:

• Physical security keys (a small USB or tap device). The strongest option, and effectively immune to phishing, because the key checks it’s talking to the real site. Best for admins, directors and finance staff.
• Authenticator apps (Microsoft Authenticator, Google Authenticator, and similar). A code or a tap-to-approve prompt on the phone. Strong, free, and the right default for most people.
• Text-message codes. Better than nothing, but the weakest — codes can be intercepted or diverted through SIM-swap fraud, and they fail with no signal. Fine as a stopgap; not where you want your important accounts.

For most small businesses, authenticator apps for everyone and security keys for the highest-risk accounts is the sweet spot.

Where to turn it on first

You don’t have to do everything at once. Protect the accounts that would hurt most if they were taken over:

1. Email and Microsoft 365 or Google Workspace. Your mailbox is the master key — it resets every other password. Start here. If you’re still setting things up, our Microsoft 365 setup work turns MFA on as standard.
2. Anything with money in it. Banking, payroll, your accounting software.
3. Admin accounts. The logins that can change settings or add users. These deserve security keys.
4. Remote access and VPNs. Any door into your systems from outside the office.

Work down from there to everyday apps as you go.

A practical rollout checklist

Turning MFA on across a team is mostly about communication and a soft landing. Here’s the order that works:

• Tell people first, and say why. A short note explaining the accountancy-style near miss above earns far more goodwill than a surprise prompt on Monday morning.
• Pilot with a small group. Try it with two or three willing people, iron out the wrinkles, then roll wider.
• Register a backup method for everyone. A second option and printed recovery codes, sorted before go-live, prevent the lockouts that give MFA a bad name.
• Keep one admin account with a spare method. So a single lost phone can never lock the whole business out of its own systems.
• Set trusted-device rules sensibly. Prompt on new devices and new locations, not on every login, so daily work isn’t interrupted.
• Write down the recovery process. Who to contact, and how they’ll verify it’s really you before re-enrolling a lost device.
• Set a date to enforce it. Optional MFA quietly stays off. Pick a switch-on date, support people through it, then make it required.

Don’t forget the human side

The technology is the easy part. The failures we see are almost always people-shaped: the director who’s “too busy” and stays exempt, the shared login nobody can attach a phone to, the leaver whose access was never removed. MFA works best alongside tidy account housekeeping — unique logins per person, prompt off-boarding, and a quick word with staff about approving prompts only when they started the login themselves. Attackers now spam approval requests hoping someone taps “yes” out of habit.

Getting it done properly

MFA is one of those jobs that’s simple in principle and fiddly in practice, especially across a mix of apps, phones and staff who’d rather not think about it. If you’d like it rolled out cleanly — the right method per account, backups in place, and nobody locked out — that’s exactly the kind of tidy-up our team handles as part of managed IT support. We’ll start with the accounts that matter most and make the whole thing painless. Get in touch and we’ll map out a plan for your team.