Multi-factor authentication: the one security step every office should take
Most account break-ins are stopped by a single setting. Here is how to roll it out without upsetting your team.
One setting, most of the risk
Stolen and reused passwords are behind the majority of business email compromises. Multi-factor authentication (MFA) — a code or prompt on your phone alongside the password — blocks almost all of them, and it is included in Microsoft 365 and Google Workspace at no extra cost.
The reason many offices still have it switched off is not cost but fear of friction. Rolled out badly, MFA generates a week of complaints. Rolled out well, staff notice it once per device and then forget about it.
The method matters: start with the accounts that matter most, use the authenticator app rather than SMS, and give people a simple guide before you switch it on.
A rollout that works:
- Enable it first for admins and finance, then everyone else.
- Use an authenticator app; avoid SMS codes where possible.
- Send a one-page guide with screenshots the day before.
- Have someone available to help on switch-on day.
- Add conditional access so trusted office devices prompt less often.
Then keep going
MFA is the first step in a baseline that also includes endpoint protection, tested backups and a properly configured firewall — each one cheap compared with a single incident.
Frequently asked questions
Yes. Multi-factor authentication is included in every Microsoft 365 and Google Workspace business plan. Conditional access rules that reduce prompts on trusted devices require Microsoft Entra ID P1, included in Business Premium.
An authenticator app (Microsoft Authenticator, Google Authenticator) or a hardware key is significantly more secure than SMS codes, which can be intercepted through SIM-swap attacks. Use SMS only as a fallback.
An administrator can reset the user's MFA methods from the admin centre after verifying identity, and the user re-registers on the new device. Keep at least two global admin accounts with separate MFA so no one is locked out.
Published Jul 30, 2026 · Last reviewed September 8, 2026
