If your team signs in to email with just a password, one phished or reused password can hand someone your inbox, your files and your clients’ details. Multi-factor sign-in (also called MFA or two-step verification) adds a second check, so a password on its own isn’t enough. It’s one of the simplest and most effective security settings a small office can turn on.
What multi-factor sign-in is
After typing a password, the person confirms it’s really them with something else: a tap on an authenticator app on their phone, a code, or a security key. Someone who has stolen the password but not the phone is stopped at that step.
Why it matters for email
- Email is the key to everything else. Password resets for banking, payroll and software go to email.
- Stolen mailboxes are used for fraud. Fake invoices and “new bank details” requests often come from a real, broken-into mailbox. See how the fake invoice scam works.
- Insurers ask about it. Cyber insurance applications commonly ask whether MFA is on for email and remote access.
How to roll it out without drama
- Start with the admins and owners. Accounts that can change settings or approve payments come first.
- Pick the method. An authenticator app is the best everyday choice. Keep text-message codes as a backup method only.
- Give people a heads-up. A short email explaining what will change and when, plus five minutes with anyone who needs help installing the app.
- Turn it on for everyone. In Microsoft 365 or Google Workspace, require it for all users, including shared mailboxes that people sign in to directly.
- Close the side doors. Turn off older sign-in methods that skip the second step, and add MFA to remote access, your tax or practice software, and your banking portals where they support it.
- Check it stays on. Review the list of users without MFA after new hires and once a quarter.
Watch out for “approve” fatigue
If someone gets a sign-in prompt they didn’t start, they should deny it and tell you, because it means someone has their password. Turning on number matching, where the person types a number shown on the screen, makes accidental approvals much less likely.
Common questions
Is a text-message code good enough?
It is much better than a password alone. An authenticator app is stronger, because text messages can be intercepted or redirected to another phone. Use the app where you can and keep text codes as a fallback.
What if someone loses their phone?
An administrator can reset that person’s sign-in methods so they can set up a new phone. That’s one reason to have more than one admin, and to set up a backup method for each person.
Will we have to approve every single sign-in?
No. Microsoft 365 and Google Workspace can remember trusted devices, so people mostly see the second step on a new computer or phone, or when something looks unusual.
Next step
Not sure whether MFA is on for everyone in your office? We’re happy to check during a free IT assessment, and we can set it up for Microsoft 365 or Google Workspace without locking anyone out.