How to Set Up Multi-Factor Authentication for a Small Business

A stolen password can put business emails, customer records and financial accounts at risk. Multi-factor authentication (MFA) adds another way to verify your identity, making it harder for someone to access an account with a password alone.

For small business multi-factor authentication, start with your most important accounts, choose the strongest supported sign-in method, help staff register and prepare a recovery process. Australian Government guidance recommends enabling MFA wherever it is available, beginning with high-risk services such as email, banking and cloud storage.[1]

Which accounts need MFA first

Begin with accounts that could cause the most disruption if someone took control of them. A practical starting order is:

This is a starting point, not a reason to leave other accounts unprotected. Adjust the order to reflect how your business operates. Australian cyber security guidance also highlights the importance of MFA for privileged users and access to sensitive data.[2]

Make an account register showing the service, account owner, administrator, available authentication methods and recovery contact. Include accounts used by contractors and external providers.

Where a service supports it, give each person their own login with appropriate permissions. Ask your IT provider how to handle shared mailboxes and integrations before changing access settings.

Authenticator apps versus SMS codes

An authenticator app commonly generates a short-lived code on your phone. SMS authentication sends a code to your mobile number. Both add a verification step, but they provide different levels of protection.

Australian Government guidance rates SMS and email codes as the least secure options in its small business handbook. Its technical guidance recommends phishing-resistant MFA.[1][3]

However, authenticator codes can still be stolen through phishing. Enter them only into the genuine service you intended to access. Never share a code or approve an unexpected sign-in request.[4]

Passkeys can satisfy MFA requirements when access to the key requires an additional factor, such as a PIN or fingerprint. The implementation matters, so ask your provider which options meet your business’s requirements.[2]

If staff cannot use a personal phone for work authentication, arrange a suitable alternative, such as a compatible business-issued security key.

Rolling out MFA without disrupting staff

Treat MFA as a small operational change with an owner, instructions and support. Microsoft’s deployment guidance recommends testing with a pilot group before expanding in manageable waves.[5]

Start with a small pilot

Choose a few people who use different parts of the business, including an administrator and someone who works remotely. Test everyday tasks such as signing into email, accessing documents and using accounting software.

Check older applications and connected services with your IT provider. Some may need changes before MFA can be enforced safely.

Help each person register

The exact screens vary by service, but a typical setup process is:

1. Open the service directly through its official website or app.
2. Find the account’s security or sign-in settings.
3. Select MFA, two-factor authentication or two-step verification.
4. Register the approved authentication method using the provider’s instructions.
5. Set up an approved recovery option.
6. Test a fresh sign-in before ending the setup session.

Give staff a short guide explaining what will change, when it will happen and who can help. Include instructions for reporting unexpected authentication prompts.

Confirm MFA is enforced

Registering an authentication method does not necessarily mean every relevant account is required to use it. Ask the administrator to check enforcement settings, registration reports and successful sign-ins.

Expand the rollout once the pilot works reliably. Keep a record of outstanding accounts and address each one rather than assuming the whole business is covered.[5]

Recovery codes and lost devices

Prepare recovery before anyone loses a phone. Where supported, register an approved backup authentication method and generate recovery codes.

Treat recovery codes as sensitive credentials. Store them somewhere secure that remains accessible if the primary device is unavailable, such as an appropriately protected password manager or locked physical storage. Avoid keeping the only copy on the phone used for authentication.

Provider rules differ. Google, for example, makes each backup code single-use and invalidates the previous set when a new set is generated.[6]

Before replacing a phone, follow the provider’s transfer instructions and test authentication on the new device before resetting the old one. Keep recovery email addresses and other sign-in details current.[4]

If a device is lost or stolen:

• Report it promptly to the person responsible for business accounts.
• Use the approved recovery method to regain access.
• Have the administrator remove the lost device’s authentication method and revoke affected sessions where supported.
• Register a replacement method and review recent sign-in activity.

Require identity checks before resetting a staff member’s MFA. For Microsoft Entra accounts, administrator-assisted recovery may include a Temporary Access Pass or updating registered methods.[5]

Make authentication setup and removal part of your joining and leaving procedures. MFA works best when the business knows who has access, how that access is protected and how to recover it safely.

Sources

1. Australian Government: Securing accounts and identities
2. Australian Government: Guidelines for system access
3. Australian Government: Implementing multi-factor authentication
4. Australian Cyber Security Centre: Protect yourself, multi-factor authentication
5. Microsoft: Plan a Microsoft Entra multifactor authentication deployment
6. Google: Sign in with backup codes