Multi-factor authentication (MFA) asks for a second proof of identity in addition to your password. It is one of the most effective and cheapest ways to stop criminals taking over business accounts, because a stolen password alone is no longer enough.
Types of MFA, from strongest to weakest
| Method | How it works | Notes |
|---|---|---|
| Passkeys and security keys | A device or hardware key proves it is you | Strongest and resistant to phishing |
| Authenticator app | A time-based code from an app on your phone | Strong and widely supported |
| Push approval | You approve a prompt on your phone | Good, but watch for approval-fatigue attacks |
| SMS or email codes | A code sent to your phone or inbox | Better than nothing, easier to intercept |
Which accounts to protect first
- Business email, because it can reset almost every other password.
- Banking and payment accounts.
- Microsoft 365 or Google Workspace admin accounts.
- Accounting software.
- Domain registrar and website hosting.
- Cloud storage and password manager.
How to roll it out
- Turn it on for administrators first. Microsoft 365 and Google Workspace both let admins require MFA for everyone.
- Choose an authenticator app or security keys as your standard method.
- Save recovery codes in your password manager or a secure place, so a lost phone does not lock you out.
- Train the team. Show people how to approve prompts, and tell them to report unexpected prompts.
- Review regularly. Remove leavers and re-check admin accounts.
A password manager pairs well with MFA, and many can store your authenticator codes too.
Frequently asked questions
Is MFA annoying for staff?
A few seconds at sign-in, and most services let trusted devices stay signed in for a period.
What if someone loses their phone?
Use recovery codes or an admin reset, then re-enrol their new device.
Is SMS MFA enough?
It is better than no MFA, but move to an authenticator app or passkeys where you can.
We can roll MFA out across your team, see our IT setup services.
Disclosure: some links on this site are affiliate links. If you buy through them we may earn a commission at no extra cost to you. This does not change what we recommend. Read our affiliate disclosure.
