Turn on MFA everywhere: a 20-minute checklist for small businesses

Passwords get guessed, reused and stolen. Multi-factor authentication (MFA) — the National Cyber Security Centre (NCSC) calls it 2-step verification, or 2SV — adds a second check, so a stolen password on its own isn't enough to get into an account. The NCSC describes turning it on as one of the most effective ways to protect online accounts while passwords are still in use.

The good news is that, for most small businesses, the work is less daunting than it sounds. This checklist is designed to be worked through in one sitting, account by account. Some accounts will take two minutes; a business-wide rollout in Microsoft 365 or Google Workspace takes a little longer because staff need time to enrol.

Step 1: List the accounts that matter most

Before touching any settings, write down the accounts your business could not function without. Start with the ones that would cause the most damage if someone else got in:

1. Email. Your business email is the master key. Password reset links for almost every other service land there, so whoever controls your inbox can usually take over everything else.
2. Admin accounts. The Microsoft 365 or Google Workspace administrator, your website hosting control panel, and any device-management or remote-access tool.
3. Money. Online banking, payment providers, payroll and your accounting software.
4. Your domain name. The registrar and DNS provider that control your web and email addresses. If someone changes your DNS, they can redirect your website and email.
5. Customer data. CRM, booking systems and cloud storage such as OneDrive, Google Drive, Dropbox or iCloud.
6. Social media. Business pages on LinkedIn, Facebook, Instagram, TikTok and X are common targets and painful to recover.
7. Your password manager, if you use one. It protects everything else, so it needs the strongest protection.

The NCSC's small organisations guide links directly to the official instructions for turning on 2SV for many common services, which is a useful shortcut for this step.

Step 2: Choose the strongest method each account offers

Not all second steps are equal. In rough order of preference:

• Passkeys. Where a service offers passkeys, they replace the password with a cryptographic key stored on your phone, computer or a hardware security key. The NCSC guide recommends them where they are supported. They are also resistant to fake login pages, because a passkey only works on the genuine site.
• Authenticator apps. Apps such as Microsoft Authenticator or Google Authenticator generate a six-digit code that changes every 30 seconds, or show a prompt you approve. They don't depend on your mobile signal or phone number.
• Hardware security keys. Small USB or NFC keys are an excellent option for admin accounts and anyone who handles payments.
• Text message (SMS) codes. Better than nothing, and the NCSC is clear that any type of 2SV beats none. But SMS depends on your phone number staying in your control, so move to an app or passkey where you can.

A practical rule: use the best option the service supports, and don't let "we can't do passkeys yet" stop you turning on an app or SMS today.

Step 3: Turn it on, one account at a time

Work down your list. The setting is usually under Security, Sign-in & security or Login in each service's account settings. When you enable it:

• Save the backup codes. Most services give you a set of one-time recovery codes. Store them in your password manager or print them and keep them somewhere secure — not in the same inbox the codes protect.
• Add a second method if the service allows it, such as an authenticator app and a security key, so a lost phone doesn't lock you out.
• Check the recovery details. Make sure the recovery email address and phone number are current and belong to the business, not to someone who left two years ago.
• Sign out and back in to confirm it actually asks for the second step.

Step 4: Enforce it for everyone, not just you

MFA only protects the accounts it is switched on for. If you run Microsoft 365 or Google Workspace, you can require it for all staff centrally rather than relying on everyone to opt in.

Microsoft 365 (Microsoft Entra ID)

For small organisations without more advanced licensing, Microsoft's security defaults are the simplest route. They require every user to register for MFA and require it for administrators. Microsoft's documentation describes the steps:

1. Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator.
2. Browse to Entra ID > Overview > Properties.
3. Select Manage security defaults.
4. Set Security defaults to Enabled, then select Save.

Microsoft notes that security defaults are already enabled on many newer tenants, so check whether yours is on before assuming it isn't. If your organisation uses Conditional Access policies instead, security defaults can't be used at the same time, and the MFA requirement should be built into those policies.

Google Workspace

In the Google Admin console, go to Security > Authentication > 2-step verification. First allow users to turn on 2-Step Verification and give them time to enrol, then set Enforcement to on, or choose a future date so staff get warning. Google's deployment guide recommends communicating the change to users before you enforce it.

Step 5: Tell staff what to expect

A short message before you enforce MFA saves a lot of confused calls. Explain:

• why you're doing it — to stop stolen passwords being enough to get in;
• which app to install and when enforcement starts;
• that they should never approve a sign-in prompt they didn't start, and should tell you straight away if one appears. An unexpected prompt usually means someone else has the password.

Step 6: Keep it working

MFA isn't a one-off job. Put a few checks into your routine:

• When someone joins, set up their MFA on day one, before they get access to anything sensitive.
• When someone leaves, remove their accounts and their registered MFA devices, and change any shared passwords they knew.
• When a phone is lost or replaced, move authenticator apps to the new device before wiping the old one if you can, and remove the old device from each account.
• Every few months, review admin accounts and confirm they all still require a second step.

Where People's Digital fits

Security and MFA checks are part of our Business Care plan at £90/month, alongside monthly checkups, backup and update monitoring, priority support and a plain-English monthly report. If you'd rather have help with the rollout itself — enrolling staff, enabling security defaults or tidying up old admin accounts — get in touch and we'll talk it through.