Turn on multi-factor authentication (MFA) first for the accounts that can change who has access: your identity administrator accounts, then the email accounts of the owner and finance staff, then banking and remote access. Write down how a lost phone is handled before you enforce anything, because recovery is the part attackers and locked-out employees both test.
Quick Overview
- Best for: an owner or office manager with a Microsoft 365 or Google Workspace account and no written MFA plan.
- Do first: administrator accounts, two emergency administrators, then finance and executive email.
- Method rule: the strongest method each account supports; text-message codes only where nothing else exists.
- Before enforcing: a named recovery owner, a way to verify the person asking for a reset, and spare credentials for administrators.
Last updated: November 9, 2026
Key takeaway
The order matters more than the product. A security key on one administrator account protects more than an authenticator app on a hundred low-risk logins, and none of it helps if the reset process accepts a convincing phone call.
Which accounts get MFA first?
The accounts that control access or move money come first. CISA's small-business guidance says to start with administrator accounts and the employees who handle sensitive data, and to confirm that remote access and privileged access require MFA. Email ranks high because most other accounts can reset their password by sending a link to it.
| Priority | Account | Why it ranks here | Owner | Done when |
|---|---|---|---|---|
| 1 | Microsoft 365 or Google Workspace administrator accounts | They can create users, reset passwords and read everything | Owner or IT provider | Each admin signs in with a prompt; two emergency admins tested |
| 2 | Email for the owner, finance staff and anyone who approves payments | A takeover can send payment changes and trigger resets elsewhere | Finance lead | Enrollment report shows every named mailbox |
| 3 | Bank, payroll and accounting logins | Direct financial loss | Finance lead | Strongest method the provider offers is enabled; recovery contact is a business address |
| 4 | Remote access, domain registrar, DNS and hosting | One change can redirect mail or open the network | IT provider | Provider confirms MFA in writing or a screenshot |
| 5 | File storage and line-of-business apps with customer or employee data | The data most worth stealing | App owner | MFA required by policy, exceptions listed |
| 6 | Everyone else | Phished staff accounts are a way in to the rest | Identity admin | Enforcement on for all users after the pilot |
Google recommends enforcing 2-Step Verification for administrators and for users who work with financial records or employee information. CISA's phishing-resistance fact sheet also names system administrators and HR staff, who hold personnel records, among the high-value targets. Your list may differ: add the account whose loss would stop work for a day.
Which MFA method fits which account?
Use the strongest method the account supports, and treat text-message codes as a last resort. CISA ranks the options from most to least secure: a physical security key, an authenticator app with number matching, an authenticator app with a one-time code, biometrics (best combined with another method) and, weakest, a text or email code.
The reason is phishing. NIST's authenticator guidance says codes a person types in are not phishing-resistant, because a fake sign-in page can relay them, while WebAuthn (the standard behind security keys and passkeys) ties the sign-in to the real site's domain. CISA's fact sheet adds that text and voice codes are exposed to SIM swapping, and that authenticator codes or push prompts with number matching are the best choice for smaller businesses that cannot move to phishing-resistant MFA at once.
| Tier | Accounts | Method | Fallback |
|---|---|---|---|
| A | Administrators, emergency admins | Security key or passkey, two enrolled per person | Business-held backup codes |
| B | Finance and executive email, banking, remote access | Security key or passkey where supported; otherwise authenticator app with number matching | Second enrolled method |
| C | All other staff | Authenticator app | Backup codes issued by an admin |
| D | A service that offers only text codes | Text code, listed as an exception | Review when the vendor adds an app option |
What does your existing platform already enforce?
Check your current plan before buying anything. Microsoft's security defaults need no extra license and require all users to register for MFA, require administrators to use it and block legacy authentication, which cannot do MFA and would otherwise let an attacker around it. Conditional Access, which allows custom rules, needs at least Microsoft Entra ID P1. Under security defaults, users register with the Microsoft Authenticator notification or an authenticator that supports one-time codes (OATH TOTP), and Microsoft warns not to disable authentication methods because that can lock you out.
Google says it is enforcing 2-Step Verification for administrator accounts, and the admin console lets you require it for other users. Google supports security keys, phone prompts, authenticator codes, backup codes, text messages and passkeys. Your edition and settings determine what you can enforce, so ask whoever manages the tenant to show the setting rather than describe it.
If staff use several applications with their own logins, an identity layer such as Duo can put them behind one policy. Our Cisco Duo review covers cost and fit. Decide that after the platform check, not before it.
What happens when someone loses a phone?
Make one named person responsible, and have them follow the same steps each time. The procedure is short, but each step closes a different gap.
- Report through another channel. Staff tell the recovery owner by a method that does not need the lost phone: another phone, in person or a pre-agreed number.
- Secure the account first. If the phone may be in someone else's hands, reset the password and revoke active sessions. In Microsoft Entra an Authentication Administrator can reset the password, revoke sessions or require re-registration, which removes the user's phone numbers, Authenticator apps and software tokens.
- Verify the person. Call a number you already hold, speak to them in person or ask their manager. Do not rely on caller ID or a message sent from the account in question.
- Issue a temporary way in. In Google Workspace, an admin with the User management privilege can generate a backup verification code for the user. In Microsoft, the user re-registers at their next sign-in.
- Enroll the new device and remove the old one. Confirm the lost device's authenticator no longer works.
- Record it and review sign-ins. Note who requested, who approved and when, then look at sign-in activity since the loss.
A reset process is a way in. A help desk that resets MFA for anyone who sounds stressed is the weak point, so require a second approver for administrator and finance resets and keep a written record.
How do you protect the people who can reset MFA?
Give administrators more than one way in, and keep emergency access outside anyone's personal phone. Microsoft recommends two or more emergency access accounts: cloud-only, using a passkey (FIDO2) or certificate, a different method from your normal admin accounts, excluded from Conditional Access policies that would block them, with credentials stored securely in more than one place. It asks you to test them at least every 90 days and not to tie them to one employee's device.
Google's recovery guidance points the same direction: enroll more than one security key for each admin, have a super administrator generate and store backup codes for other admins, and add a second super administrator so one lost key does not lock the business out. Google also discourages recovering through a secondary username that is not protected by 2-Step Verification.
How do you roll it out without locking people out?
Start small, enforce in stages and keep a way to undo it. CISA suggests an initial group such as IT administrators, then expanding with what you learned.
- Week 1: administrators and emergency accounts, with spare keys and backup codes stored.
- Week 2: finance and executive email, banking and remote access.
- Weeks 3 to 4: everyone else, after an enrollment session with a person available to help.
On Microsoft 365, plan the enrollment session before you enable security defaults. Microsoft's page says the 14-day grace period for registering was removed in July 2024. Check for scanners, old mail clients and other devices that use legacy authentication, because security defaults block them. On Google, set a grace period if you enforce security keys only, so admins can issue codes during enrollment.
Keep an exceptions list: the account, the reason, the owner and a review date. Anything left on a text code goes there.
How do you check it worked this week?
Run four tests and keep the results.
- Coverage: export the MFA registration or 2-Step Verification report and compare it with your staff list. Every name should appear, and each exception should match your list.
- Administrators: sign in as each admin from a clean browser and confirm a prompt appears.
- Lost-phone drill: pick a test account, follow the six steps above and time it. If it took one person's memory or a call to an unverified number, fix that.
- Emergency access: sign in with an emergency account, then close it again and note who held the credentials. Repeat every 90 days.
Which setup suits a team of 5, 25 or 50?
Match the process to the people who must run it, not to the headcount alone.
- About 5 people: use your suite's built-in controls. Give the owner and any admin two security keys, enable enforcement for all and keep backup codes in a sealed record.
- About 25 people: add the written recovery procedure, a named recovery owner with a deputy, an exceptions list and the 90-day emergency access check. Consider an identity layer only if many apps have separate logins.
- About 50 people: add a second approver for finance and admin resets and review the enrollment report each month, since joiners and leavers will otherwise leave gaps.
Offboarding belongs in the same routine: remove the person's methods and sessions on the day they leave, and add the step to your leaver checklist.
Frequently asked questions
MFA for small business FAQs
Related Articles
Cisco Duo MFA review
Cost, editions and when an identity layer is worth adding to the platform you already have.
Password manager rollout guide
Vault ownership, recovery and offboarding for shared logins.
Business email security guide
Protect mailboxes, sender domains and payment changes.
See where your account controls stand
Use the free assessment to check MFA coverage alongside the rest of your security basics.
Start the free assessmentSources read November 9, 2026: CISA MFA guidance for small businesses, Microsoft security defaults and Google Workspace 2-Step Verification. This guide is based on documentation, not a tested deployment; see our methodology.