Why MFA matters for a small business

Most business email break-ins start with a password that was guessed, reused from another website, or typed into a fake login page. Once someone is in your mailbox, they can read invoices, send convincing payment requests to your customers, and reset passwords for other services.

Multi-factor authentication (MFA) means signing in needs two things: the password, and something only the real person has, usually their phone. A stolen password on its own is no longer enough. It is one of the most effective security steps a small business can take, and it is included in every Microsoft 365 business plan at no extra cost.

Choose your method

  • Microsoft Authenticator app (recommended): a notification on the phone asks the person to type the number shown on screen. Quick, and resistant to most phishing tricks.
  • Text message codes: better than nothing, but weaker, because phone numbers can be hijacked. Use them as a backup rather than the main method.
  • Security keys or passkeys: the strongest option, useful for administrators and anyone handling payments.

Option 1: Security defaults (most small businesses)

Security defaults is a free, one-switch setting that requires everyone to register for MFA, asks for it when a sign-in looks risky, always asks administrators, and blocks old sign-in methods that cannot do MFA. Newer Microsoft 365 accounts have it switched on already. To check:

  1. Sign in to the Microsoft Entra admin centre at entra.microsoft.com with an administrator account.
  2. Go to Identity (or Entra ID), then Overview, then Properties.
  3. Click Manage security defaults.
  4. Make sure it is set to Enabled, then save.

Once it is on, each person has 14 days to register the next time they sign in. After that, they cannot sign in until they do.

Option 2: Conditional Access (Business Premium)

If you have Microsoft 365 Business Premium, you can use Conditional Access instead. It gives finer control, such as requiring MFA everywhere except from the office, blocking sign-ins from other countries, or only allowing company devices. Security defaults has to be switched off to use Conditional Access, so build and test the policies first, then switch over.

Keep one emergency access account with a long, unique password stored safely, excluded from your policies, so a mistake cannot lock every administrator out.

Rolling it out to your team

The technical switch takes minutes. Getting everyone through it smoothly is the real work.

  1. Tell people first. Explain why, what they will see, and when. A short email the week before saves a lot of confused phone calls.
  2. Install the app. Ask everyone to install Microsoft Authenticator from their phone's app store before the day.
  3. Register. Each person signs in to aka.ms/mfasetup with their work account and follows the steps to add the Authenticator app. Add a phone number as a backup method.
  4. Test. Ask each person to sign out and back in to Outlook on the web to confirm it works.
  5. Switch on enforcement, if it is not already on.
  6. Check the stragglers. In the Microsoft 365 or Entra admin centre, look for anyone who has not registered and help them directly.

Shared logins break MFA, because the code goes to one person's phone. Replace shared accounts such as info@ with shared mailboxes first, so everyone uses their own account.

What your team will see

It helps to tell people exactly what to expect, so a prompt does not look like a scam:

  • At their next sign-in, a screen saying More information required, followed by steps to install Microsoft Authenticator and scan a QR code.
  • After that, when they sign in on a new device or in a new browser, a two-digit number on screen that they type into the app on their phone.
  • On a computer they use every day, prompts are occasional rather than constant.

Make one rule clear: never approve a sign-in request you did not start. An unexpected prompt means someone else has the password. Deny it, then tell whoever looks after your IT so the password can be changed.

Lost or replaced phones

This will happen, so plan for it:

  • If someone has a new phone and still has the old one, they can add the Authenticator app on the new phone through aka.ms/mfasetup and then remove the old one.
  • If the phone is lost, an administrator opens the user in the Entra admin centre, goes to Authentication methods and chooses Require re-register multifactor authentication. Next time the person signs in, they set it up again.
  • Switch on cloud backup in the Authenticator app so other accounts in it can be recovered on a new phone.

Beyond MFA

MFA is the biggest single improvement, but it works best alongside a few other basics: a business password manager so people stop reusing passwords, up-to-date devices, and staff who know what a fake login page looks like. Microsoft also now requires MFA for anyone signing in to its admin portals, so administrators need it regardless.

RoamTech sets up MFA and the related security basics for small businesses across the UK, remotely, and on site in East Sussex. It can be a one-off job at the pay as you go rate or part of a Business IT Support plan. See backup and security for the other pieces.