The idea behind it
A password is something you know. The trouble is that anything you know can be stolen: guessed, phished, leaked in a breach or watched over your shoulder. Multi-factor authentication adds something you have, such as your phone or a security key, or something you are, such as your fingerprint or face. An attacker who steals your password still can't sign in without that second factor. You'll already use this with online banking, where the bank sends a code or asks you to approve a login in its app. MFA brings the same protection to work email, Microsoft 365, Google Workspace, accounting software and other business systems.
Why it stops so many attacks
Most attacks on small businesses aren't sophisticated hacks. They're automated attempts to sign in with passwords stolen from other breaches, or phishing emails that capture a password on a fake page. Without MFA, a correct password is all it takes. With MFA, the attacker hits a wall and usually moves on to an easier target.
Microsoft and other major providers have long reported that MFA blocks the overwhelming majority of automated account attacks. It isn't perfect, and determined attackers have ways around weaker forms of it, but it's the single most effective security step most small businesses can take for the effort and cost involved.
The different types of second factor
Text message codes are the most familiar but the weakest option, because texts can be intercepted or redirected through SIM swap scams. Authenticator apps, such as Microsoft Authenticator or Google Authenticator, generate codes or send a sign-in prompt to your phone and are a strong step up. Number matching, where you type a number shown on screen into the app, stops people approving prompts by accident. The strongest options are passkeys and hardware security keys, small devices that plug into a USB port or tap against a phone. They only work on the genuine website, so phishing pages can't capture them. They suit admins, finance staff and anyone handling large payments.
Where your business should turn it on
Start with email and Microsoft 365 or Google Workspace, because your email is the key to resetting almost every other account. Then cover banking, accounting and payroll software, your domain registrar, your website admin, remote access, cloud storage and any system holding client personal information. Admin accounts should be first in line, not last. Don't forget accounts people think of as unimportant: the social media page, the courier account, the domain name login. Attackers use these to impersonate the business or redirect your website and email. If a service offers MFA, turn it on.
Turning it on without upsetting staff
Plan a short rollout. Tell staff what's coming and why, show them how to install the authenticator app, and set a date. Help anyone who struggles, especially people less comfortable with technology. In Microsoft 365 you can let people register their method over a week or two before it becomes mandatory. Most people find that after the first few days MFA barely interrupts their work, because trusted devices are remembered for a period. Settings like conditional access can reduce prompts further on managed office computers while still challenging unusual sign-ins.
Common questions from staff
Some staff don't want a work app on their personal phone. That's a fair concern. Explain that an authenticator app doesn't give the business access to their phone, or offer a hardware security key as an alternative. Others worry about losing their phone; make sure there's a backup method registered and a clear process with IT for recovery.
Shared accounts and older systems can be awkward. Some legacy email setups don't support MFA, which is a sign they need updating rather than a reason to skip MFA. Your IT provider can help find the gaps. Contractors and temporary staff need MFA too. It's tempting to give a short-term worker a simple shared login to save time, but temporary access is often forgotten when the job ends. Give them their own account with MFA and an end date, and remove it as soon as their work is finished.
MFA is a start, not the finish
MFA dramatically reduces risk, but attackers have adapted. They bombard people with approval prompts hoping one gets accepted, or use relay phishing pages that capture the session after sign-in. Teaching staff never to approve a prompt they didn't start, and moving important accounts to phishing-resistant methods over time, keeps you ahead. Combine MFA with sign-in alerts, blocking of older sign-in protocols that skip it, and good password habits. Together they make account takeover much harder and much easier to spot when it's attempted.
In short
- MFA adds a second proof beyond your password.
- It blocks most automated and phishing-based account attacks.
- Authenticator apps beat text codes; passkeys and security keys are strongest.
- Start with email and admin accounts, then banking, accounting and everything else.
- Never approve a sign-in prompt you didn't start.