Multi-factor authentication (MFA) means a password on its own is not enough to get into an account. After the password, the person also has to enter a code or approve the sign-in on their phone. If a criminal steals or guesses a password, MFA stops them at the door.
It is the single biggest step most small businesses can take, it costs nothing in Microsoft 365 or Google Workspace, and Cyber Essentials expects it on every cloud service that offers it.
How to check your own setup
Open a private or incognito window in your web browser and sign in to your business email. If you are asked for a code or a phone approval after your password, MFA is on for your account. Ask one or two colleagues to try the same thing.
Opening Outlook on a laptop you use every day does not count. It remembers you, so you rarely see the prompt.
How to switch it on
- Microsoft 365. the simplest route is Security defaults in the Microsoft Entra admin centre. It turns on MFA for everyone at no extra cost. Businesses on Microsoft 365 Business Premium can use Conditional Access instead, which gives more control.
- Google Workspace. in the Admin console go to Security, then Authentication, then 2-step verification. Allow it, give staff a date, then enforce it.
- Ask everyone to install an authenticator app on their phone. It is quicker and safer than codes by text message.
- Turn on MFA for every other online service you use, such as accounting, banking, payroll, website hosting and domain registration.
The mistakes people make
- Leaving admin accounts until last. They are the accounts attackers want most, so do them first.
- Forgetting shared mailboxes and generic logins such as accounts@ or office@ that several people sign in to.
- Assuming it is on because nobody has been asked for a code lately.
Got a question about this?
Ask me about your own setup and I'll give you a plain English answer, usually within one working day.