Rolling out MFA without the revolt

Multi-factor authentication is the improvement most small businesses know they should make and keep deferring. Multi-factor authentication, usually shortened to MFA, is a second proof at sign-in, such as an app approval or a security key, on top of the password. The reasoning for deferring it is rarely about security. It is that staff are busy, a member of staff will be locked out at an inconvenient moment, and some staff will object.

Those concerns are legitimate and a rollout can be planned around them. The security case is unusually strong. A password protects an account until it is stolen through phishing, reuse, or a breach elsewhere, at which point it protects nothing. In Verizon's 2026 Data Breach Investigations Report (DBIR), credentials were among the data compromised in 31 percent of breaches at small and medium-sized businesses. Credential abuse was the first route in for 13 percent. NIST's small business guidance calls enabling MFA one of the fastest and least costly protections available (NIST SP 1300).

The objective is simple to state. A stolen password should no longer be enough on its own to open anything that matters.

The accounts to protect first

Do not attempt to cover everything at once. Start with email, money, and administrative rights.

Email comes first, not because the messages themselves are valuable but because email is the recovery route for nearly every other account you own. An intruder holding the business mailbox can reset passwords across the business. A compromised mailbox is also a common starting point for business email compromise. Business email compromise is a scam in which a fraudster uses a compromised or impersonated account to redirect a payment. The FBI received 24,768 such complaints in 2025, with more than $3 billion in reported losses (FBI, 2025 IC3 Annual Report).

Money comes second: banking, payroll, accounting, and merchant accounts. Payroll deserves particular attention, since a stolen payroll login lets a thief redirect salary payments without alerting the business. Administrative rights come third, since the administrator accounts for your Microsoft 365 or Google Workspace, your remote access, and your backup console can undo every other control you have.

NIST's small business guide offers a similar starting checklist: banking, accounting and tax, merchant accounts, your Google, Microsoft, or Apple ID accounts, email, password managers, and website accounts. It notes that a business's own list will be longer (NIST SP 1300).

Choosing the method

Text message codes are the most familiar and the weakest. A code sent by text message can be diverted to an attacker's phone. In a SIM swap, the attacker persuades the phone company to move the number to a new SIM card. In a number port, the attacker moves the number to another phone company. Any typed code, from a text message or an app, can also be captured by a fake sign-in page and relayed in real time. NIST's digital identity guidelines treat this as a special case, stating that "there is one restricted authenticator: the use of the PSTN for out-of-band authentication" (NIST SP 800-63B-4). The PSTN is the public telephone network, so the restriction covers codes sent by text message or voice call. A restricted authenticator is one that NIST permits only after the organization using it has assessed and accepted the added risk.

Authenticator apps generate or approve sign-ins on the user's phone without depending on the phone network. This is the practical default for most small businesses. It is free, quick to enroll, and a substantial improvement on passwords alone, and it gives protection against SIM swapping and number porting that text messages lack.

Hardware security keys are physical devices the user taps or plugs in, and they resist phishing by design. NIST is precise about why the alternatives do not: "Phishing resistance requires single- or multi-factor cryptographic authentication. Authenticators that involve the manual entry of an authenticator output (e.g., out-of-band and OTP authenticators) SHALL NOT be considered phishing-resistant" (NIST SP 800-63B-4). An OTP is a one-time password, a code that works once, such as the code an authenticator app displays. A typed code can be relayed by an attacker in real time. A security key cannot.

Passkeys use the same phishing-resistant technology as security keys. A passkey is stored on a phone or computer rather than on a separate key. NIST's guidelines recognize passkeys that sync between devices, and treat a properly configured one as phishing-resistant (NIST SP 800-63B-4). Where a platform supports them, passkeys can give staff phishing resistance without buying hardware.

A sensible position for most businesses: authenticator apps for everyone, security keys for the few staff who hold administrative rights or can move money, and text messages only where a system supports nothing else. Text-message MFA remains better than none. The federal Cybersecurity and Infrastructure Security Agency puts it directly: "any MFA is better than no MFA" (CISA). Do not let the strongest option delay the available one.

The rollout order

Enroll yourself first. You will find the awkward step in your own environment and can answer questions from experience. Then the administrators and the staff who approve or send payments: a small group, the highest value, and the staff most likely to understand why.

Then the rest of the staff, one system at a time. Email across the whole business, the next system a week later. This looks slower in the plan but finishes sooner, because support questions arrive steadily rather than all at once.

Enforce centrally rather than asking staff to opt in. In Microsoft 365 that means a Conditional Access policy in Entra ID, or security defaults on plans without Conditional Access. In Google Workspace it means enforcing 2-Step Verification for all users. Voluntary MFA produces partial coverage and a false sense of completion.

Record a backup sign-in method for each member of staff, whether a second enrolled device or recovery codes held securely. This step prevents many of the lockouts staff fear, and its absence is a common reason a rollout is abandoned.

Then check coverage twice a year, because new accounts and applications can be added without MFA. If an outside IT provider manages your systems, ask the provider to confirm coverage on every account, including the provider's own administrative logins. Ask for evidence rather than an assurance. Watch for systems that keep their own list of accounts, so a central policy never reaches them. A virtual private network (VPN) appliance is one example, and a device with its own web login is another. A VPN is the connection staff use to reach business systems from outside the office.

Handling the resistance

Staff usually raise three objections. The first is that MFA will slow work down. Many configurations prompt only on a new device, in an unusual location, or after a set period. The second is that staff do not want work software on a personal phone. An authenticator app generates codes and does not manage the phone, and a security key is an alternative for staff who remain uncomfortable. The third is that the business is too small to interest an attacker, which the evidence does not support. Verizon's 2026 DBIR found that small organizations are "disproportionally impacted by Ransomware."

Two points of framing help more than argument. Describe what the change protects rather than what it prevents, and announce it as a business decision with a date rather than as a request. NIST treats announcing and enforcing a rule like this as governance. Its small business guide lists communicating and enforcing policies among the Govern actions to consider (NIST SP 1300).

Staff should also know about prompt bombing. Prompt bombing is a flood of sign-in approval requests, sent until the user accepts one. It appeared in 14 percent of social engineering incidents in Verizon's 2025 DBIR Small- and Medium-Sized Business Snapshot. A member of staff who receives an approval request they did not trigger should report it, not dismiss it.

What it costs

For most small businesses, almost nothing. MFA is included in Microsoft 365 and Google Workspace and in nearly every banking, accounting, and payroll platform in common use, and authenticator apps are free. The only likely expenditure is security keys for administrators, a small one-time cost for a handful of people. The main cost is attention: a few hours of planning and the discipline to check coverage twice a year.

Where to start

If multi-factor authentication is not yet enforced on email and banking, spend one afternoon on those two. That afternoon closes one of the most common gaps in a small business. It also moves the business toward a yes on the multi-factor authentication question insurers ask, which usually covers remote access and administrator accounts as well. Our guide to answering a cyber insurance questionnaire covers what else insurers ask.

If you are unsure what else belongs on the list, a structured assessment will place this control alongside everything else and give you the order to work in. The small business guide to cybersecurity assessments explains how one works, and you can see a free preview of your results before deciding to unlock a report.