How to Set Up Multifactor Authentication for Your Small Business

Make Stolen Passwords Less Useful

A stolen password should not be enough to unlock your business. Multifactor authentication, or MFA, adds another requirement when someone signs in, such as a security key, an authenticator app, or a device-based verification step.

MFA is one of the most useful improvements a small business can make, but simply enabling it is not a complete rollout. You also need to choose appropriate methods, cover the right accounts, prepare employees, and establish safe recovery procedures.

This guide walks you through those decisions. You can lead the project as a business owner while your IT administrator or managed IT provider handles settings that require technical access.

Step 1: List Your Business Accounts

Start with a spreadsheet of the systems employees use. Check invoices, browser bookmarks, password managers, and department software lists. Ask employees which tools they actually use—not just which ones management approved.

Include:

• Email and shared document platforms.
• Payroll, accounting, banking, and payment systems.
• Customer relationship management software.
• Remote access tools and VPNs.
• Website hosting and domain registration accounts.
• Social media and online storefront accounts.
• IT administration and security dashboards.

For each system, record its owner, users, administrator accounts, available MFA methods, and current enforcement status.

Distinguish between MFA available, MFA registered, and MFA required. An employee may have enrolled an authenticator without the system actually requiring it at sign-in.

Prioritize systems that control money, sensitive information, or access to other accounts. Email deserves early attention because it often receives password-reset messages.

Step 2: Choose the Strongest Practical Sign-In Method

MFA methods are not equally resistant to attack.

Prefer phishing-resistant options

Where supported, use FIDO2 security keys or passkeys. These methods are designed to verify the website or service being accessed, helping prevent employees from handing usable credentials to a fake login page.

A security key is a physical device employees use during sign-in. A passkey can be stored on a device, security key, or supported credential manager. Implementation matters: confirm that your platform’s configuration meets your organization’s MFA requirements.

For privileged accounts, consider issuing a primary security key and a securely stored spare.

Use authenticator apps when needed

If a service does not support phishing-resistant authentication, an authenticator app is usually a practical alternative. Options include rotating codes and approval prompts.

Where push approvals are used, enable number matching if available. It reduces the risk of someone approving an unexpected prompt, although it does not make the method phishing-resistant.

Use text messages or voice calls only when stronger supported options are unavailable. They provide protection beyond a password alone but introduce risks such as phone-number takeover.

Step 3: Decide Who Must Use MFA

Make the default straightforward: every person accessing a supported business system must use MFA.

Include owners, executives, part-time employees, contractors, and IT administrators. Seniority should not create an exemption.

Address these special cases before enforcement:

• Administrator accounts: Require strong authentication and separate daily work from privileged administration where supported.
• Shared accounts: Replace shared human logins with individual access wherever possible.
• Service accounts: Identify automated integrations that cannot complete interactive MFA. Have IT use supported workload identities or other appropriate controls.
• Emergency access accounts: Establish a documented recovery design that follows the platform’s guidance. Protect and monitor these accounts separately, and test them periodically.

Do not apply a blanket MFA rule to every account without checking integrations. An unattended accounting connection or website process may need a different authentication design—not an undocumented permanent exemption.

Step 4: Prepare Recovery Before Changing Settings

People lose phones. Security keys break. Employees replace devices without transferring their authenticator.

Decide how those situations will be handled before the first lockout.

Your recovery procedure should specify:

• Who can authorize an authentication reset.
• How the requester’s identity will be verified.
• How backup methods or recovery codes will be protected.
• How temporary access will expire.
• How resets will be recorded and reviewed.

Do not reset MFA based only on an email request or a call from a familiar-looking number. Both can be impersonated. Use a documented verification process, such as an in-person check or a callback through a trusted directory combined with another verification step.

Keep recovery codes out of the account they unlock. If an employee cannot access email, recovery information stored only in that inbox will not help.

Step 5: Run a Small Pilot

Test the rollout with a few employees before enabling enforcement company-wide. Include different working patterns: an office employee, a remote employee, a manager, and someone who uses specialized software.

Test:

• Browser, desktop, and mobile sign-ins.
• Remote access from outside the office.
• New-device enrollment.
• Lost-device recovery.
• Access to shared resources.
• Applications and integrations that may use older authentication methods.

Ask participants to follow your written instructions without coaching. Their questions will reveal missing steps.

Check licensing and platform limitations during this pilot. Some enforcement controls require particular subscriptions. Confirm what your existing setup supports rather than assuming every security setting is available.

Step 6: Explain the Change in Plain English

Send a short notice that explains why MFA is being introduced, what employees need to do, and when enforcement begins.

Include the official enrollment route, approved methods, support contact, and what to do if someone lacks a suitable device. Provide a company-approved alternative rather than assuming everyone will use a personal phone.

Teach three simple habits:

• Never approve a sign-in request you did not initiate.
• Never share a verification code with someone claiming to be support.
• Report unexpected prompts immediately.

Repeated approval requests can indicate that an attacker already knows the password. Employees should report them, not keep dismissing them silently.

Tell staff how to find enrollment instructions through a known internal location so the rollout does not train them to trust unexpected login links.

Step 7: Enforce MFA in Controlled Waves

After the pilot succeeds, roll out enforcement by department or application. Schedule support coverage during each wave.

For every group:

• Confirm enrollment is complete.
• Enable the required authentication policy.
• Test that unregistered users cannot bypass it.
• Review failures and unexpected exceptions.
• Record the change and its owner.

Have IT identify and disable legacy authentication methods that cannot satisfy MFA, after checking dependencies. Older protocols can otherwise leave a route around the protection you just added.

Avoid broad exclusions for office networks or particular employees unless there is a documented, reviewed reason. Being inside the office does not automatically make a sign-in trustworthy.

Step 8: Verify Coverage and Maintain It

Use administrative reports and sign-in logs to confirm enforcement. Do not rely only on employee confirmations.

Review privileged accounts first, then check for unenrolled users, weak fallback methods, unused accounts, and temporary exceptions that never expired.

Add MFA to employee onboarding and access removal procedures. When someone leaves, disable their access and revoke active sessions as supported by each platform.

MFA also has limits. It does not prevent every attack, including theft of an already authenticated session. Keep endpoint protection, patching, and sign-in monitoring in place.

If suspicious activity occurs, have IT investigate, revoke affected sessions, review registered authentication methods, and reset credentials as appropriate. Changing the password alone may not end unauthorized access.

Request a Free IT Assessment

Not sure which accounts are protected—or where exceptions leave gaps? Request a free IT assessment from Tech Architech. Headquartered in Hillsboro, Oregon, and serving small and medium businesses across the USA, Tech Architech can help you identify practical priorities for stronger cybersecurity and manageable day-to-day IT.