A password on its own is a single point of failure. Passwords get reused, guessed, and stolen in data breaches and phishing emails, and once someone has yours, they can sign in as you from anywhere.
Multi-factor authentication (MFA) adds a second check, usually a code or a prompt on your phone, so a stolen password alone isn't enough to get in.
Start with the accounts that matter most
- Email. Your inbox is where password resets go. Whoever controls it can take over most of your other accounts.
- Banking and payroll. Anything that moves money.
- Remote access. VPNs, remote desktop tools, and cloud admin portals.
- Everything else that supports it: accounting, file sharing, and your domain registrar.
Microsoft 365 and Google Workspace both let an administrator require MFA for everyone in the organization, rather than leaving it to each person to opt in. Requiring it is the only way to be sure it's on.
Which method to use
- An authenticator app, such as Microsoft Authenticator or Google Authenticator, is a good default for most people.
- A hardware security key is the strongest option, and worth it for administrators and anyone who handles payments.
- Text-message codes are better than nothing, but they're the weakest option, because a phone number can be hijacked through SIM swapping.
Watch out for surprise prompts
Attackers who already have a password sometimes send sign-in prompt after sign-in prompt, hoping you'll tap Approve just to make them stop. If you get an MFA prompt you didn't start, deny it and change your password: someone has it.
Number matching, where you type a number shown on the sign-in screen into your phone, makes this trick much harder. Microsoft Authenticator uses it by default.
Keep a way back in
Before you turn MFA on, set up a backup method: a second device, backup codes stored somewhere safe, or a second security key. Losing your only phone shouldn't lock you out of the business.