MFA for a Five-Person Business — One Afternoon

If one thing keeps a small business's email out of the wrong hands, it's multi-factor authentication (MFA): a second check, usually a prompt on your phone, after the password. Microsoft has said MFA blocks more than 99% of automated attacks on accounts.

For a five-person team, turning it on takes one afternoon. Here's the order.

Before you start (15 minutes)

• List every account that matters: email (Microsoft 365 or Google Workspace), banking, payroll, accounting, your domain registrar, and any admin account.
• Make sure everyone will have their phone with them that afternoon.
• Pick an authenticator app. Microsoft Authenticator and Google Authenticator are both free. Text-message codes are better than nothing, but an app is stronger, because texts can be stolen through SIM-swapping.

Step 1: Admin accounts first (30 minutes)

Start with whoever can change settings for everyone: the Microsoft 365 or Google Workspace admin. If an attacker gets that account, they get everything.

Turn on MFA there, sign out, and sign back in to test it. Save the backup codes somewhere safe, like a password manager or a printed copy in a locked drawer. Never store them in the same email account they protect.

While you're at it, do your domain registrar and your bank. Losing either one is as bad as losing email.

Step 2: Turn it on for everyone (1 hour)

In Microsoft 365, the simplest option for a small team is security defaults, which requires MFA for every user. In Google Workspace, turn on 2-Step Verification in the admin console and set an enforcement date, so people have a window to enroll.

Then get everyone together for 20 minutes. Each person installs the app, scans the code, and signs in once to confirm it works. Doing it together beats sending an email and hoping. The one person who skips it is the one locked out on Monday morning.

Step 3: The accounts people forget (1 hour)

Email is the big one, but work through the rest of your list:

• Payroll and accounting (QuickBooks, Gusto, ADP)
• Banking and payment processors
• Shared logins. If three people use one account, give each person their own login where you can.
• The business's social media accounts

Step 4: Plan for the lost phone (15 minutes)

Someone will get a new phone. Decide now:

• Who can reset MFA for a user (the admin)
• Where the backup codes live
• That resets only happen after confirming the person by phone or in person, never from an email. "I got a new phone, can you reset my MFA?" is a common way attackers get in.

What to expect

People will grumble for about a week. After that, a sign-in prompt on the phone becomes as routine as unlocking the office door. And the next phishing email that tricks someone into typing a password won't get the attacker into the account.

Want help turning this on, or checking what's already covered? We do a free systems review for Connecticut small businesses. Request one here.