How to Set Up MFA for a Small Business (Microsoft 365 and Google Workspace)

Multi-factor authentication (MFA) is the single most useful security setting a small business can switch on. It means a stolen password on its own isn't enough to get into someone's email.

That matters more than it sounds. The Australian Signals Directorate says 42% of incidents reported to it in 2024–25 by industry, government and critical infrastructure involved compromised accounts or credentials. And your email is the key to everything else: the password reset link for your accounting software, domain, bank portal and socials almost always lands in your inbox.

This guide covers how to roll MFA out across a team of 5 to 50 on Microsoft 365 or Google Workspace without locking anyone out, and which kind of MFA to pick.

Which kind of MFA should you use?

Not all MFA is equal. From strongest to weakest:

Phishing-resistant matters because modern phishing kits sit between the user and the real login page, so they can pass a typed code straight through. A passkey is bound to the real website's address, so a fake site simply can't use it.

For most small teams, a realistic target is: authenticator app for everyone now, passkeys for admins straight away and for everyone else over time, SMS only as a temporary fallback.

Before you switch anything on

Ten minutes of prep saves a morning of "I can't get into my email".

1. List every account and who uses it. Include shared mailboxes, the "reception@" login three people share, and service accounts used by scanners or software.
2. Find old apps and devices. Old printers or scanners that email using a username and password, and old mail apps using IMAP or POP, often can't do MFA. Note them so you can replace or reconfigure them first.
3. Set up two emergency admin accounts. Microsoft recommends two cloud-only emergency access accounts with Global Administrator rights that aren't tied to one person, and that are only used if normal admin sign-in breaks. Store their credentials somewhere safe and offline, and protect them with a security key.
4. Tell the team when it's happening and what to expect. A one-paragraph email with the date, "install Microsoft Authenticator or Google Authenticator on your phone", and who to ask for help.
5. Pick a quiet day. Not end of month, not the day before someone goes on leave.

Microsoft 365: step by step

Microsoft gives you two ways to require MFA for everyone. Which one you use depends on your licences.

Option 1: Security defaults (every plan, free)

Security defaults are Microsoft's free baseline, available on every Microsoft 365 plan. According to Microsoft's documentation, they:

• require every user to register for MFA, using the Microsoft Authenticator app
• require MFA on every sign-in for admin roles such as Global Administrator
• prompt regular users for MFA when Microsoft judges the sign-in risky or unusual
• block legacy authentication, including old IMAP, POP3 and SMTP sign-ins that can't do MFA

Note that the old 14-day "register later" grace period was removed in July 2024, so users are asked to set up MFA at their next sign-in.

To turn it on (Microsoft's steps):

1. Sign in to the Microsoft Entra admin center at entra.microsoft.com as a Global Administrator.
2. Go to Identity > Overview > Properties.
3. Scroll to Security defaults and select Manage security defaults.
4. Set it to Enabled and Save.

Security defaults can't be enabled while any Conditional Access policy exists, and Microsoft also says to turn off the old per-user MFA settings first. Tenants created since late 2019 may have security defaults on already, so it's worth checking before assuming you have nothing.

Option 2: Conditional Access (Business Premium, E3, E5)

If you have Microsoft 365 Business Premium or another plan that includes Entra ID P1, Conditional Access gives you finer control. Common small-business policies:

• Require MFA for all users, on all cloud apps
• Require phishing-resistant MFA (passkeys or security keys) for admin roles
• Block legacy authentication
• Exclude your two emergency access accounts from all of the above, so you can always get back in

Microsoft provides templates for these. Start them in Report-only mode for a few days, check the sign-in logs to see who would have been blocked, then switch them on.

Admins have to use MFA regardless

Microsoft now requires MFA to sign in to its admin portals, including the Microsoft 365 admin center (rolled out from February 2025) and the Entra and Intune admin centers. If your admins are still on passwords only, they'll be stopped at the door anyway.

Google Workspace: step by step

Google calls MFA "2-Step Verification" (2SV). The process is: let people enrol, give them time, then enforce. These steps follow Google's deployment guide.

1. Sign in to the Google Admin console (admin.google.com) as a super administrator.
2. Go to Security > Authentication > 2-step verification.
3. Tick Allow users to turn on 2-Step Verification, leave Enforcement off, and save.
4. Ask everyone to turn on 2SV from their Google Account's security page, ideally with Google Authenticator, the Google prompt on their phone, or a passkey.
5. Check enrolment in the Admin console's user reports. Report data can lag up to 48 hours.
6. Once almost everyone is enrolled, come back and set Enforcement to On, or Turn on enforcement from date.
7. Set a New user enrollment period (anything from one day to six months) so new starters can sign in once and set up 2SV. A week is usually plenty.
8. Choose Methods. "Any" is the gentlest start. "Any except verification codes via text, phone call" removes SMS, so move SMS users onto an app before you pick it. "Only security key" now also accepts passkeys and is a good choice for admins.

Google also suggests leaving Allow user to trust the device unticked unless staff regularly switch devices, so a stolen laptop doesn't skip the second step.

The bits people forget

• Shared logins. A shared inbox should be a shared or group mailbox that people open with their own MFA-protected account, not one password passed around the office.
• Lost phones. Decide now who can reset someone's MFA and how they confirm it's really them (a video call, not just an email that could come from an attacker). Have each person register a second method, such as a security key or a second device.
• Other apps. Accounting software, your domain registrar, website admin, social accounts and banking each have their own MFA setting. Where they support "Sign in with Microsoft" or "Sign in with Google", use it so your MFA policy covers them too.
• Leavers. When someone leaves, remove their MFA methods as well as their password. Our offboarding checklist covers the full list.
• Sign-in alerts. Make sure an admin actually reads the "unusual sign-in" alerts from Microsoft or Google. MFA prompts someone didn't ask for are a sign their password is already out there.

A simple rollout plan

For most teams under 20 people, the hands-on work is a few hours. The time goes into chasing the last two people who haven't enrolled.

Want it done for you?

MFA set-up, hardened accounts and device health checks are part of our Managed IT Complete plan at $89 per user per month, and onboarding and offboarding are included from $49 per user per month on Essentials, with no lock-in contract. If you're on the Central Coast or in the Hunter, see our local IT support page.

Not sure whether MFA is actually on for everyone in your business? Send us a quick note and we'll help you check.