Where to start with multi-factor authentication
Multi-factor authentication, known as MFA or 2FA, means that a password alone is not enough to get into an account: something else is needed, usually a code or a confirmation from your phone. It is the single change that reduces the most risk for the least effort.
The reason is simple: passwords are stolen constantly — through phishing, through reuse on other sites, or through data breaches. MFA makes a stolen password insufficient.
Where to start, in order
You don't need to roll it out everywhere at once. This order covers most of the risk with the least effort.
- Email It is the most important account you have, because every other account is recovered through it. Whoever controls the email controls everything.
- Administrator accounts Administrators of Microsoft 365, Google Workspace, your servers and your hosting panel. These are the accounts that open every door.
- Access from outside VPN, remote desktop, anything reachable from the internet. These are scanned continuously by bots.
- Banking and payments Usually mandatory already, but check your invoicing and payroll systems too.
- Your domain and social accounts Losing control of your domain is among the hardest damage to repair.
- Then all users With a plan and a short explanation, not as a surprise on a Monday morning.
Which verification method to choose
Not all methods are equally strong. The list below runs from the most secure to the weakest.
If a system constantly sends “approve this sign-in” notifications, users learn to tap them without thinking. Attackers exploit this by sending dozens of requests until someone accepts out of exhaustion. Number matching solves this problem.
The part people forget: getting back in when you lose your phone
Most problems with MFA do not come from attacks, but from phones that are lost, replaced or wiped. Plan for it in advance:
- Recovery codes are generated during setup. Print them or store them in your password manager, not on the same phone.
- Two methods per user — for example the app plus a physical key, or the app on two devices.
- A second administrator who can reset MFA for others. If only one person can and they are away, the business is stuck.
- A written procedure for when an employee leaves or loses a device.
- Day 1 — Enable MFA on your own administrator account and generate the recovery codes.
- Day 2 — List your accounts and mark which ones support MFA.
- Day 3 — Enable it on all administrator accounts and on access from outside.
- Day 4 — Tell your staff, with a short explanation of what will change.
- Day 5 — Enable it for everyone, helping those who struggle in person.
- After a week — Check who hasn't finished and close the gaps.
Three mistakes that cause trouble
- MFA on some accounts only. One unprotected account with privileges is enough to bypass everything else.
- No recovery codes. A lost phone turns into days without access.
- No explanation for staff. When people don't understand why, they look for ways around it.
In conclusion
MFA does not solve every security problem, but it makes the attackers' most used tool — the stolen password — insufficient. If you only have time for one change today, this is the one, and it starts with email.
Would you like help rolling it out?
We can plan it together, from administrator accounts through to staff, with the recovery procedures documented.
Request a free consultation