Multi-factor authentication (MFA) is the single most effective protection a small business can add to its Microsoft 365 accounts. Microsoft has long reported that it blocks more than 99.9 percent of automated attacks on accounts. The technology is not the hard part. The hard part is switching it on without a week of frustrated staff and a queue of lockouts.
Here is how to do it smoothly.
Choose the right method
Not all second factors are equal:
- Authenticator app with number matching. The sign-in screen shows a number and the user types it into the app. This is the sensible default for most staff, and number matching defeats “push fatigue” attacks, where criminals spam approval requests hoping someone taps yes.
- Passkeys and security keys. Phishing-resistant, because they only work on the genuine sign-in page. Ideal for administrators and anyone who handles payments.
- Windows Hello for Business. Face or fingerprint on a company laptop, which counts as a strong second factor and removes most prompts from the working day.
- Text messages and phone calls. Better than nothing, but the weakest option, because phone numbers can be hijacked. Use them only as a stopgap.
Explain why before you switch anything on
People resist changes they do not understand. A short message from the owner or manager, not from IT, goes a long way. Explain what MFA is, why the business is doing it (a stolen password alone should no longer be enough to get in), what staff will see, and when. Mention that the Authenticator app on a personal phone gives the company no access to the phone itself. That is the most common worry, and it is worth answering before anyone asks.
Start with leadership
Enable MFA for the owners and managers first. It shows the change is not just for junior staff, and it protects the accounts attackers target most. It also surfaces any snags while the group is small.
Give everyone a registration window
Rather than forcing it overnight, give staff a week or two to register their method, with a clear deadline. Offer a short drop-in session, or a few minutes at a team meeting, to set up the app together. Once the window closes, MFA becomes required at sign-in.
Reduce the prompts people see
Much of the resentment towards MFA comes from being asked too often. With Microsoft 365 Business Premium, Conditional Access can trust company-managed, compliant devices, so staff are prompted far less on their own laptop while any attempt from an unknown device is still challenged. Without Business Premium, security defaults still enforce MFA, just with less fine-tuning.
Plan for the exceptions
Every rollout has a few special cases. Decide on them in advance:
- Staff without a smartphone, or who will not use a personal one: a hardware security key solves this neatly
- Shared mailboxes, such as info@, which should be accessed through people’s own accounts rather than signed into directly
- Scanners and apps that send email, which need a supported sending method rather than a shared password
- One emergency admin account, stored securely and monitored, so a lockout never locks you out of your own tenant
- Older mail apps that cannot handle modern sign-in, which need replacing
Be ready for day one
Expect a handful of “my new phone” and “I deleted the app” calls in the first weeks. Decide who can verify a user’s identity and reset their MFA method, and write it down. Attackers call help desks too, so the check has to be more than a name and a job title.
A quick rollout checklist
- Choose methods: Authenticator app with number matching for most staff, passkeys or security keys for admins
- Send the explanation from leadership, including the personal phone question
- Enable for leadership first, then open a registration window for everyone
- Set up Conditional Access if you have Business Premium, or security defaults if not
- Handle the exceptions: shared mailboxes, scanners, an emergency account, older apps
- Document how MFA resets are verified and who does them
Our Entra ID and Intune service includes planning and running an MFA rollout, including Conditional Access and the exceptions above.