If someone gets hold of a staff member’s password, multi-factor authentication (MFA) is often the only thing standing between them and your email, files and bank details. MFA asks for a second proof of identity, usually a code or a tap on an app, as well as the password. That means a stolen password on its own is far less useful.
The short answer for most small businesses: turn on MFA for email and Microsoft 365 or Google Workspace first, then remote access, banking and finance systems, then everything else. Use an authenticator app rather than SMS where you can, and plan the rollout so nobody gets locked out on a busy Monday morning.
Here’s how to do it step by step.
Why MFA matters more than a "strong" password
Passwords get stolen in ways that have nothing to do with how clever they are. A convincing fake login page, a data breach at another website where a staff member reused the same password, or malware on a home computer can all hand a criminal a perfectly good password.
MFA adds a second lock. Even with the right password, an attacker also needs the user’s phone, app or security key. The Australian Cyber Security Centre lists MFA among its recommended core protections for organisations of all sizes, and it’s one of the most cost-effective security steps a small business can take.
Step 1: List the accounts that need protecting
Before you switch anything on, write down where your business logs in. Most offices are surprised by how long the list gets. Start with:
- Email and productivity – Microsoft 365, Google Workspace
- Remote access – VPNs, remote desktop, remote support tools
- Money – online banking, accounting software, payroll, payment platforms
- Admin accounts – domain registrar, website hosting, firewall and IT admin portals
- Line-of-business apps – CRM, practice management, booking systems
- Social media – business pages that could be hijacked to damage your reputation
Rank them by how much damage a break-in would cause. Email usually comes first, because a compromised mailbox can be used to reset other passwords and send fake invoices to your customers.
Step 2: Choose the right type of MFA
Not all second factors are equal. From strongest to weakest, roughly:
Security keys and passkeys
Physical keys (small USB or NFC devices) and passkeys are highly resistant to phishing because they only work with the genuine website. They’re a great choice for admin accounts and people who handle money.
Authenticator apps
Apps such as Microsoft Authenticator or Google Authenticator generate codes or send a push prompt to the user’s phone. They’re free, easy to use and a solid default for most staff. Where available, use number matching, where the user types a number shown on screen into the app, rather than a simple “Approve” button.
SMS codes
Text message codes are better than nothing, but they can be intercepted or redirected through SIM-swap scams. Treat SMS as a fallback, not your main method.
Step 3: Plan the rollout (don't just flip the switch)
Turning MFA on for everyone at 9am without warning is a reliable way to create a queue of unhappy people at reception. A little planning avoids that.
- Start with yourself and the admins. Admin accounts are the biggest prize for attackers and the people who’ll help everyone else.
- Tell staff what’s coming and why. A short email explaining that MFA protects them as well as the business goes a long way.
- Set a date and a window. Give people a few days to register their app, and have someone available to help.
- Do a small pilot group. Two or three staff first will flush out issues such as old devices or shared logins.
- Enforce it. Once everyone’s registered, make MFA mandatory. Optional MFA tends to stay optional forever.
If you’d rather not run this yourself, our business IT support team can plan and manage the rollout, including the awkward edge cases.
Step 4: Sort out the tricky bits
Shared accounts
Shared logins like reception@ or accounts@ are common in small offices and don’t suit MFA well. Where possible, give each person their own account and use shared mailboxes or delegated access instead. If a shared login must stay, store it in a business password manager that supports shared MFA codes.
Staff without a work phone
Some people won’t want a work app on their personal phone. Hardware security keys are a tidy answer, and they’re inexpensive compared with the cost of a breach.
Older systems
Some legacy apps and old email setups don’t support MFA. These can become the back door attackers use to dodge it, so they should be updated, replaced or blocked.
Step 5: Plan for lost phones and lockouts
Phones get dropped in the harbour, left in Ubers and upgraded. Decide in advance:
- Who can reset someone’s MFA, and how they’ll confirm it’s really that person (a quick video call works better than an email request)
- Where backup codes are stored, ideally in a password manager, not a sticky note
- That at least two people hold admin access, so one lost phone can’t lock the whole business out
Watch out for MFA fatigue
Attackers who already have a password sometimes spam a user with approval prompts, hoping they’ll tap “Approve” just to make it stop. Teach staff a simple rule: if you didn’t just try to log in, never approve a prompt, and tell someone straight away. An unexpected prompt means the password is probably compromised and should be changed.
MFA works best with good password habits
MFA isn’t a licence to use “Summer2024!” everywhere. Pair it with a business password manager so each account has a long, unique password. Together they cover each other’s weak spots: the password manager stops reuse, and MFA protects you when a password leaks anyway.
A quick MFA checklist
- MFA enforced on email and cloud productivity accounts
- MFA on remote access, banking and finance systems
- Admin accounts using the strongest method available
- Authenticator apps or keys preferred over SMS
- Legacy logins that bypass MFA blocked
- A documented process for lost phones and resets
- Staff know never to approve a prompt they didn’t trigger
Small offices without dedicated IT staff can tick these off with help from our small business computer support service.
Need a hand locking the doors?
MFA is one of the quickest wins in cyber security, but getting it right across every account, device and staff member takes some care. If you’d like Monster IT to review your accounts and roll out MFA without the headaches, get in touch with our team or call us on +61 405 808 707. We’ll keep the monsters on the right side of the door.
Frequently asked questions
Is SMS good enough for multi-factor authentication?
SMS codes are better than having no MFA, but they can be intercepted through SIM-swap scams. An authenticator app or a hardware security key is a stronger choice, with SMS kept as a fallback.
Which accounts should a small business protect with MFA first?
Start with email and Microsoft 365 or Google Workspace, then remote access, online banking, accounting and payroll systems, and any admin accounts for your website, domain or IT systems.
What happens if a staff member loses their phone?
An administrator can reset their MFA after confirming their identity, ideally by a video call or in person. Having backup codes stored securely and at least two admins avoids lockouts.
Do staff have to put an app on their personal phone?
Not necessarily. If someone prefers not to use their personal phone, a hardware security key is a simple, secure alternative that works with most major business platforms.