Summary:
- MFA stops most account takeovers and is now required or strongly recommended by major authorities.
- Start with email, admin accounts, remote access, finance apps, and vendor portals.
- Prefer phishing-resistant methods like security keys or passkeys; avoid SMS where possible.
Introduction:
This guide explains why multi-factor authentication (MFA) matters for small businesses and how to turn it on across your most important systems this week.
Why it matters for small firms
Stolen or guessed passwords are a leading cause of breaches. The 2024 Verizon Data Breach Investigations Report found the use of stolen credentials was the top initial action in breaches at 24 percent. Microsoft’s data shows MFA can block more than 99.2 percent of account compromise attacks. Regulators are also raising the bar. The FTC Safeguards Rule requires MFA for anyone accessing customer information at covered financial institutions. The IRS directs tax professionals to use MFA to protect taxpayer data. CISA, the U.S. cybersecurity agency, urges businesses to adopt phishing-resistant MFA such as FIDO2 security keys or passkeys. These are practical, high-impact steps you can take now. (Verizon)
What attackers do and why it works
Attackers steal or buy credentials, then log in like a normal user. They phish passwords, reuse leaked passwords, or target legacy sign-in methods that do not support MFA. Some bypass weaker MFA by spamming push prompts until a user taps Approve. Others intercept SMS codes through SIM-swap and signaling attacks. Phishing-resistant MFA stops these tricks because the login requires a cryptographic challenge bound to a device, not a code the attacker can steal. CISA and NIST describe these stronger methods and why they resist phishing and replay. (CISA)
How to fix it this week
- Turn on MFA for business email and admin portals. In Microsoft 365 and Entra ID, enable Security Defaults or Conditional Access policies to require MFA and block legacy authentication that bypasses MFA. Basic authentication is disabled in Exchange Online, but verify modern authentication is on. (Microsoft Learn)
- Enroll all staff and contractors. Require enrollment in an authenticator app or hardware security key before granting access to company email, file sharing, finance, and remote access. Microsoft provides basic MFA features at no extra cost for Entra ID and Microsoft 365 users and admins. (Microsoft Learn)
- Prefer phishing-resistant methods. Use FIDO2 security keys or platform passkeys where supported. If you must use push notifications, require number matching to reduce MFA fatigue. Avoid SMS when stronger options are available. (CISA)
- Cover high-risk apps first. Prioritize email, accounting and payroll, remote desktop or VPN, CRM, cloud admin consoles, and any app with customer data. The FTC Safeguards Rule requires MFA for access to customer information for covered entities. (Federal Trade Commission)
- Secure privileged access. Require MFA for all administrators and for any action in Azure, Microsoft 365, and Intune admin portals. Microsoft is enforcing mandatory MFA phases for these portals from 2024 to 2026, so prepare now. (Microsoft Learn)
- Create two emergency access accounts. Set up break-glass accounts with secure methods like passkeys or certificate-based authentication and monitor them closely. Test emergency procedures quarterly. (Microsoft Learn)
- Set sensible policies. Block legacy protocols that do not support MFA. Require MFA from new locations or risky sign-ins. Review sign-in logs weekly to confirm coverage and spot gaps. (Microsoft Learn)
- Train staff. Show how to use the authenticator, how to report suspicious prompts, and why never to approve unexpected MFA requests. Use IRS and CISA materials to reinforce the message. (IRS)
Consider using a Managed Service Provider
A managed service provider (MSP) can roll out MFA quickly across many apps, not just email. MSPs map your systems, choose the right methods per role, and integrate single sign-on to reduce friction. They set Conditional Access policies, block legacy protocols, and configure phishing-resistant options where supported. They also onboard and offboard users, manage break-glass accounts, watch sign-in logs, and test policies so business tools keep working. This sustained attention and tooling is hard for a single IT generalist to match. Microsoft’s enforcement timelines and the FTC Safeguards Rule expectations make expert configuration and monitoring even more important. (Microsoft Learn)
Costs, effort, and common pitfalls
Effort. Most small firms can enable app-based MFA for core cloud services in a day, then phase in security keys and Conditional Access over one to two weeks. Basic MFA capabilities are included with Microsoft 365 and Entra ID. (Microsoft Learn)
Common pitfalls to avoid:
- Leaving VIPs or service accounts out of scope. Attackers look for those exceptions. Enforce MFA everywhere and migrate user-based service accounts to proper workload identities. (Microsoft Learn)
- Relying on SMS. Use authenticator apps, passkeys, or security keys. If using push, require number matching to defeat MFA fatigue. (CISA)
- Forgetting legacy protocols. Confirm modern authentication is on and legacy methods are blocked. (Microsoft Learn)
- No emergency path. Maintain two monitored break-glass accounts with strong authenticators. (Microsoft Learn)
Compliance notes (if relevant)
- FTC Safeguards Rule. Requires MFA for anyone accessing customer information for covered non-bank financial institutions. Also adds a breach notification requirement within 30 days for incidents affecting 500 or more consumers. (Federal Trade Commission)
- IRS for tax practices. IRS Publication 4557 tells tax professionals to use MFA for tax software, email, and storage accounts. (IRS)
- NIST Digital Identity guidance. NIST SP 800-63B defines authentication assurance levels and supports phishing-resistant methods such as FIDO2 and PIV. Use these definitions to inform your policy. (NIST Pages)
FAQs
Q1: Is MFA disruptive for staff?
Most users complete MFA in under a minute during first setup. Using single sign-on reduces prompts. Microsoft and CISA provide clear setup guides and training materials. (Microsoft Learn)
Q2: Which method should we pick first?
Start with an authenticator app. Add FIDO2 security keys or passkeys for admins and high-risk roles because they are phishing-resistant. Avoid SMS unless no other option is available. (CISA)
Q3: What if a vendor or tool does not support MFA?
Require MFA on the identity provider and block legacy protocols. If a third-party app cannot support modern authentication, limit access, isolate data, and seek an alternative vendor. Microsoft documents how to block legacy authentication and enforce MFA with Conditional Access. (Microsoft Learn)
Call to action
Enable MFA across your business this week. If you want help choosing methods, setting policies, and migrating safely, schedule a security assessment. An expert rollout will reduce risk fast and keep your team productive.
Sources
- Verizon. 2024 Data Breach Investigations Report. May 2024. (Verizon)
- Microsoft Learn. Planning for mandatory multifactor authentication for Azure and other admin portals. Updated 2025. Includes 99.2 percent mitigation stat and enforcement dates. (Microsoft Learn)
- Microsoft Learn. Configure Security Defaults for Microsoft Entra ID. Updated 2025. (Microsoft Learn)
- Microsoft Learn. Deprecation of Basic authentication in Exchange Online. Updated 2024. (Microsoft Learn)
- Microsoft Learn. Microsoft Entra multifactor authentication versions and licensing. March 2025. (Microsoft Learn)
- FTC. FTC Safeguards Rule: What Your Business Needs to Know. Updated 2024. (Federal Trade Commission)
- FTC Business Blog. Safeguards Rule notification requirement now in effect. May 2024. (Federal Trade Commission)
- IRS. Publication 4557 Safeguarding Taxpayer Data (Rev. 6-2024). June 2024. (IRS)
- CISA. Multifactor Authentication. 2024. (CISA)
- CISA. Implementing Phishing-Resistant MFA Fact Sheet. 2023. (CISA)
- CISA. Phishing Guidance: Stopping the Attack Cycle at Phase One. 2023. (CISA)