Authentication
How to roll out MFA without locking everyone out
Everyone agrees multi-factor authentication is the single most valuable security control a small business can turn on. Rather fewer people have turned it on, and the reason is almost always the same fear: that Monday morning arrives and nobody can log in.
That fear is reasonable. Badly sequenced MFA rollouts genuinely do lock people out, and the recovery is worse than the original risk. But the failure modes are well known and avoidable, and the whole thing is a week of low-effort work rather than a project.
First: create the account that cannot be locked out
Before you enable anything, create a break-glass account. This is a separate administrator account whose only job is to exist when everything else has failed.
- A cloud-only admin account, not tied to any individual person
- A long random password, stored somewhere physical — a sealed envelope in a safe, not a note in the system you might be locked out of
- Excluded from the MFA policy you are about to create, or given its own hardware key kept with the password
- Never used for daily work, and alerted on so you know if it is ever used
Set an alert if the break-glass account signs in. An account that should never be used is the perfect thing to monitor, because any use at all is worth a phone call.
Second: pick a method your team can actually use
The options are not equal, and the differences matter more than the convenience trade-off suggests.
| Method | Resists phishing? | Practical for a small team |
|---|---|---|
| SMS codes | No | Universal, but the weakest option — vulnerable to SIM swapping |
| Authenticator app codes | No | Good default. Free, works offline, no hardware to buy |
| Push approval | Partly | Easy, but people approve prompts without reading them |
| Passkeys | Yes | Built into phones and laptops, no extra hardware |
| Hardware security key | Yes | Strongest. Around the cost of a decent lunch per person |
The honest recommendation: passkeys or hardware keys for anyone with administrator rights or access to money, an authenticator app for everyone else. SMS only where a person genuinely cannot use anything else — it is still far better than no MFA at all.
Why push approval disappoints
Attackers send repeated prompts at inconvenient hours until somebody taps approve to make it stop. It has a name — MFA fatigue — and it has worked against large, well-resourced companies. If you use push, turn on number matching so approving requires reading a code rather than tapping a button.
Third: enrol before you enforce
This is the step that prevents the Monday morning problem, and it is simply a matter of ordering.
- Week one: turn MFA on as available but not required. Ask people to enrol.
- Mid-week: check the enrolment report. Chase the stragglers individually — there will be three or four, and they are usually the busiest people.
- Week two: once enrolment is above roughly ninety per cent, enforce for everyone.
- Anyone still not enrolled enrols at their next sign-in, which is a two-minute interruption rather than a lockout.
Announce the enforcement date once, in plain language, and say what will happen. "On Tuesday you will be asked to approve a sign-in on your phone. Set it up before then and you will not notice." Nobody reads a policy document; everybody reads two sentences.
Fourth: cover the accounts outside your directory
Turning on MFA in Microsoft 365 or Google Workspace secures a large part of the estate and leaves a long tail untouched. These are the accounts that actually get taken over, because nobody thinks of them as part of the system:
- The domain registrar. The most damaging account you own. Whoever controls the domain controls email.
- Your website host and DNS.
- Banking and payment processors — usually already enforced, worth confirming.
- Your accounting software.
- Social media accounts, especially any with advertising billing attached.
- The personal email address used as the recovery contact for the above. It is a skeleton key and it is normally the weakest link.
The failure modes, and what to do about them
Someone loses their phone
Have a documented reset process before it happens: who can reset, how they verify the person is who they claim, and how the new device is enrolled. Verification matters — "my phone broke, please reset my MFA" is a standard attack, delivered by someone who sounds stressed and plausible.
Shared accounts
A shared login with one authenticator app on one person's phone breaks the moment that person is on holiday. Where you cannot avoid a shared account, put its MFA seed in the team password manager so more than one person can generate codes.
Devices and apps that cannot do MFA
Old mail clients, scanners that email documents, some accounting integrations. Each needs an app password or a narrow exclusion — and each is a hole. Write them down, review them twice a year, and close them as the equipment is replaced.
What good looks like when you are done
Every account that touches email, money, customer data or your domain requires a second factor. Administrators use phishing-resistant methods. One break-glass account exists, is monitored, and is not in daily use. Exceptions are written down rather than remembered.
That is a realistic week of work, and it removes the most common way small businesses are compromised.