A Small Business Guide to Implementing Multi-Factor Authentication (MFA)
Most business email accounts that get hacked have one thing in common: the attacker only needed a password. Multi-factor authentication (MFA) stops most of these attacks, costs little or nothing, and takes an afternoon to roll out. Here is how to do it properly in a small business.
What is multi-factor authentication?
MFA asks for a second proof that it is really you, on top of your password. Usually that means approving a prompt in an app on your phone, or typing a code it shows you. A stolen password on its own is no longer enough to get in.
The Australian Signals Directorate includes MFA in its Essential Eight, the baseline it recommends for Australian organisations.
Which type of MFA should you use?
| Method | How strong | Notes |
|---|---|---|
| Passkeys and security keys | Strongest | Resist phishing because they only work on the real website. |
| Authenticator app with number matching | Strong | For example Microsoft Authenticator. The best everyday choice for most businesses. |
| Authenticator app codes | Good | Better than SMS, but codes can still be phished. |
| SMS text codes | Basic | Far better than nothing, but vulnerable to SIM swap scams. Use only if nothing else works. |
Where to turn MFA on first
- Email and Microsoft 365 or Google Workspace. Your email can reset every other password, so protect it first.
- Remote access: VPNs, remote desktop and any way into your network from outside.
- Admin accounts for your domain, website, firewall and cloud services.
- Banking and accounting: Xero, MYOB, payroll and your bank.
- Everything else that offers it, including social media accounts.
How to roll it out in a small business
1. Check what you have
List the systems your staff log into. Most business software now supports MFA, and Microsoft 365 and Google Workspace include it at no extra cost.
2. Tell your team why, then set a date
Explain it in one sentence: “If someone steals your password, this stops them getting in.” Give people a date and a short guide with screenshots.
3. Enforce it for everyone
Turn MFA on centrally so it is required, not optional. In Microsoft 365 that means security defaults or Conditional Access policies.
4. Plan for lost phones
Decide how someone gets back in if they lose their phone. Usually that means a second method registered, or an admin who can reset it after confirming who they are.
5. Teach people about MFA fatigue
Attackers sometimes send repeated approval prompts hoping someone taps “approve” to make them stop. Number matching helps, but staff should know to never approve a prompt they didn’t trigger, and to report it.
Common mistakes
- Leaving old protocols turned on that skip MFA, such as legacy email connections
- Exempting the boss or shared mailboxes “for convenience”
- Admins using the same account for email and administration
- Turning MFA on but never checking who hasn’t registered
MFA is one layer, not the whole answer
MFA works best alongside strong passwords, a password manager, email filtering, patching and tested backups. Together they make your business a much harder target than the business next door.
What about shared and service accounts?
Shared logins such as info@ or accounts@ are often left without MFA because several people use them. In Microsoft 365, the better approach is to set these up as proper shared mailboxes that staff open through their own accounts, which already have MFA. Direct sign-in to the shared mailbox can then be blocked completely. Service accounts used by scanners, printers or software should have long random passwords, be limited to the job they do, and where possible only be allowed to sign in from your office network.
Moving towards phishing-resistant MFA
Standard MFA stops most password attacks, but attackers have found ways around it, such as fake login pages that relay your MFA code in real time. That is why the higher maturity levels of the ASD Essential Eight call for phishing-resistant methods, such as passkeys, FIDO2 security keys and Windows Hello for Business. These only work on the genuine website, so a fake login page gets nothing useful. A sensible path is to start with administrators and finance staff, then extend to everyone else.
How to check MFA is actually working
Turning MFA on is not the end of the job. Every month or so, check:
- Which users have not registered an MFA method yet
- Whether any sign-ins are still using older protocols that skip MFA
- Whether any accounts have been excluded from your MFA policies, and why
- Sign-in logs for unusual locations or repeated failed attempts
In Microsoft 365 these reports are in the Entra admin centre. A managed IT provider can review them for you as part of regular security monitoring.
Common questions
Does MFA cost extra?
Basic MFA is included in Microsoft 365 and Google Workspace. More flexible controls, such as Conditional Access rules that only allow sign-ins from trusted devices, need Microsoft Entra ID P1, which is included in Microsoft 365 Business Premium.
What if staff don’t want work apps on their personal phones?
That is a fair concern. Alternatives include a hardware security key that plugs into a laptop or taps against a phone, or a business-supplied phone. The authenticator app itself does not give the business access to anything else on a personal phone.
Can MFA be bypassed?
Yes, in some cases. Attackers use fake login pages that steal the session after you approve MFA, and “MFA fatigue” attacks that send prompts until someone gives in. Number matching, phishing-resistant methods and alerts for risky sign-ins close most of these gaps. Our article on unexpected ways hackers get into accounts explains how these attacks work.
Want MFA rolled out for you? See our Microsoft 365 services and managed IT security.
Want MFA set up properly across your business?
We roll out and enforce MFA on Microsoft 365 and your other key systems, and check nothing has been missed.
Or call 1300 133 770.
