Multi-Factor Authentication (MFA) Guide for Small Businesses

If you do one security project this year, make it multi-factor authentication. Most break-ins at small offices don't involve clever hacking. They involve a password that was phished, guessed or reused from another website, typed into your email or remote-access system by someone who isn't you. MFA makes that stolen password useless on its own.

Microsoft's research, cited throughout its documentation, shows MFA "can block more than 99.2% of account compromise attacks." Insurers ask about it on every application. The FTC Safeguards Rule requires it for financial businesses, including CPA and tax firms. HHS lists it as an essential cybersecurity goal for healthcare. And when one of the largest health data breaches in U.S. history happened in 2024, the company's CEO told the Senate that the remote-access portal the attackers used "did not have multi-factor authentication."

But "turn on MFA" hides a lot of real-world questions. Which method should you use? Is text messaging good enough? What do you do about the shared front-desk computer, or the employee who won't put a work app on their personal phone? This guide answers those questions in plain English and finishes with a week-by-week rollout plan for a 20-person office.

What is multi-factor authentication?

Multi-factor authentication (MFA) means proving who you are with two or more different kinds of evidence when you sign in. (Our glossary has a one-paragraph definition of MFA.) The three kinds, or "factors," are:

1. Something you know: a password or PIN.
2. Something you have: your phone with an authenticator app, a security key, a smart card.
3. Something you are: a fingerprint or face scan.

A password plus a code from your phone is two factors: know plus have. Two passwords is still one factor, which is why security questions don't count.

You'll also hear two-factor authentication (2FA) and two-step verification. For practical purposes they mean the same thing for a small business: a password isn't enough by itself.

A newer twist is passwordless sign-in, where you don't type a password at all. A passkey or Windows Hello combines "something you have" (the device holding a cryptographic key) with "something you are" or "something you know" (your fingerprint, face or device PIN). It's still multi-factor, just without a password to steal.

Why does MFA matter so much?

Because stolen passwords are the easiest way in, and MFA stops most stolen-password attacks cold. Without MFA, a criminal who gets your password from a phishing page, a data breach at another website or a lucky guess can sign in to your email from anywhere in the world, and nothing alerts you.

The evidence is consistent across every source we trust:

• Microsoft states that MFA blocks over 99.2% of account compromise attacks, and removed the old 14-day grace period for users to register for MFA under security defaults "to help reduce the risk of account compromise during the 14-day window."
• Microsoft now requires MFA for its own admin portals. Since October 2024, MFA has been enforced for the Azure portal, Microsoft Entra admin center and Intune admin center, and since February 2025 for the Microsoft 365 admin center. There is "no way to opt out."
• The FBI, in its 2025 IC3 report's ransomware recommendations, says to "enable multi-factor authentication (MFA) for all services to the extent possible, particularly for webmail, virtual private networks, and accounts that access critical systems."
• CISA has "consistently urged organizations to implement MFA for all users and for all services, including email, file sharing, and financial account access."
• HHS includes MFA among the "essential" goals in its Healthcare and Public Health Cybersecurity Performance Goals, and its proposed HIPAA Security Rule update would make MFA an explicit requirement. That rule wasn't final as of October 2026.
• The FTC Safeguards Rule already requires MFA "for anyone accessing customer information on your system" at covered financial institutions, a group that includes tax preparers and many accounting firms.
• Cyber insurers treat MFA as a baseline. See our cyber insurance requirements checklist.

Which MFA methods are best? The methods ranked

Phishing-resistant methods (passkeys, FIDO2 security keys, Windows Hello for Business) are best; authenticator apps with number matching are a solid baseline; text messages and phone calls are a last resort. That ranking comes straight from CISA's "strongest to weakest" table and Microsoft's own recommendations.

A few points behind the ranking:

Why phishing-resistant methods win. Passkeys and FIDO2 keys use a cryptographic exchange tied to the website's real address. If a criminal builds a perfect copy of the Microsoft sign-in page at a different address, the key simply won't respond. There's no code for anyone to steal. Microsoft lists Windows Hello for Business, platform credentials for macOS, synced passkeys, FIDO2 security keys, passkeys in Microsoft Authenticator and certificate-based authentication as its phishing-resistant options.

Why authenticator apps are still a good baseline. CISA's fact sheet says app-based codes or push with number matching "are the best options for small- and medium-size business that cannot immediately implement phishing-resistant MFA." They stop password spraying, credential stuffing and MFA fatigue attacks, and they're free.

Why SMS is last. CISA warns that SMS and voice codes are vulnerable to "exploitation of Signaling System 7 (SS7) protocol vulnerabilities" in phone networks and to SIM swapping, where a criminal convinces your carrier to move your number to their SIM card. CISA says SMS MFA "should only be used as a last resort," and its December 2024 mobile communications guidance (written for highly targeted individuals after major telecom breaches) was blunter: "Do not use SMS as a second factor for authentication." NIST's updated digital identity guidelines (SP 800-63B-4, finalized July 2025) classify phone-network delivery of codes as a "restricted" authenticator and require that systems at the common AAL2 assurance level "SHALL offer at least one phishing-resistant authentication option."

That said, SMS is still dramatically better than nothing. If a banking or vendor portal only offers SMS, turn it on.

What are passkeys, and should we use them?

A passkey is a sign-in credential that replaces a password with a cryptographic key stored on your device and unlocked with your face, fingerprint or PIN. (See passkey.) For most people it feels like unlocking their phone. Behind the scenes, it's the same phishing-resistant FIDO2 standard used by hardware security keys.

There are two flavors:

• Device-bound passkeys live on one device or security key and can't be copied. Examples: a YubiKey-style USB/NFC key, or a passkey in the Microsoft Authenticator app.
• Synced passkeys are backed up and synced across your devices by a provider such as Apple, Google or a password manager. They're more convenient (lose your phone, sign in on your new one) but depend on the security of that sync account.

Microsoft Entra ID supports both, and administrators can choose which types staff may register. For a small office, a practical approach is:

• Admins, owners and anyone who approves payments: device-bound passkeys or hardware FIDO2 keys, with two keys each (one kept somewhere safe as a backup).
• Staff with company-managed computers: Windows Hello for Business on their PC, plus passkeys in Authenticator on their phone.
• Everyone else: Microsoft Authenticator with number matching now, moving to passkeys as you're ready.

What is an MFA fatigue attack, and how do you stop it?

An MFA fatigue attack (also called "push bombing") is when someone who already has your password triggers sign-in requests over and over, sending notification after notification to your phone, until you tap Approve by accident or just to make it stop. CISA describes attackers generating "hundreds of prompts on the user's device over a short period of time."

It works on plain approve/deny push notifications. It fails against number matching, where the sign-in screen shows a number that you must type into your authenticator app. If you're not the one signing in, you're not looking at the sign-in screen and can't know the number. Microsoft now enables number matching for all Microsoft Authenticator push notifications, and users can't opt out.

MFA fatigue is only one of several ways attackers try to get around MFA. Here's how the main ones compare:

Two of these deserve a closer look:

• AiTM phishing kits are mainstream. Microsoft described Tycoon2FA, a phishing-as-a-service kit that let "even less skilled threat actors" bypass MFA and reached "over 500,000 organizations each month" before Microsoft and Europol disrupted it in March 2026. Microsoft's recommended fix is phishing-resistant MFA plus Conditional Access "authentication strength." Our phishing and business email compromise guide explains how these attacks lead to invoice fraud.
• The help desk is a target. The National Association of Insurance Commissioners' 2025 cyber insurance market report noted that "help desk social engineering also surged." If a caller can convince your IT provider to reset someone's MFA, MFA doesn't matter. Ask your provider exactly how they verify identity before a reset.

Microsoft Entra security defaults vs. Conditional Access: which do you need?

If you're on a Microsoft 365 plan without Entra ID P1 (Business Basic or Standard), turn on security defaults. If you have Microsoft 365 Business Premium or Entra ID P1, use Conditional Access instead, because it lets you handle the exceptions every real office has.

What security defaults do

Microsoft Entra ID (formerly Azure Active Directory) is the sign-in system behind Microsoft 365. (See Entra ID.) Its security defaults are a free, one-switch set of protections. According to Microsoft Learn, they:

• Require all users to register for MFA
• Require administrators to use MFA every time they sign in
• Require users to do MFA "when necessary" (Microsoft decides based on risk signals)
• Block legacy authentication protocols that can't do MFA
• Block device code flow
• Protect privileged activities like the Azure portal

Security defaults use the Microsoft Authenticator app (with number matching) or other authenticator-app codes. Microsoft says security defaults are for organizations that "want to increase their security posture, but don't know how or where to start" and those "using the free tier of Microsoft Entra ID licensing." Tenants created since October 22, 2019 may already have them on.

What Conditional Access adds

Conditional Access is Microsoft Entra's rules engine: "if this user, on this device, from this location, is accessing this app, then require these things." It needs Microsoft Entra ID P1, which is included in Microsoft 365 Business Premium. Microsoft says plainly: "If you're an organization with Microsoft Entra ID P1 or P2 licenses, security defaults are probably not right for you."

You can't run both at once. When you move to Conditional Access, Microsoft says to turn security defaults off and "immediately enable Conditional Access policies." Microsoft-managed Conditional Access policies are available to recreate the same baseline.

Not sure which Microsoft 365 plan you have, or whether Business Premium is worth it for you? See our Business Basic vs. Standard vs. Premium comparison or try the Microsoft 365 plan picker.

A Conditional Access baseline for a small office

With Business Premium, this is the set of policies we typically start from. Always roll new policies out in report-only mode first, and exclude your emergency access accounts.

1. Require MFA for all users on all cloud apps.
2. Block legacy authentication for everyone.
3. Require phishing-resistant MFA for admin roles using an authentication strength policy.
4. Block device code flow except for specific devices that genuinely need it (some conference room systems).
5. Require a compliant, Intune-managed device for access to email, files and line-of-business apps from computers, so a stolen password can't be used from a criminal's laptop. (Learn more in our Intune guide.)
6. Restrict MFA registration (adding new methods) to trusted locations or managed devices, so an attacker with a password can't register their own phone.
7. Set sign-in frequency for shared workstations so sessions don't stay open all day.
8. Optionally block sign-ins from countries where you have no staff, with a documented exception process for travel.

Don't lock yourself out: emergency access accounts

Microsoft recommends two cloud-only emergency access ("break glass") accounts with Global Administrator rights, not assigned to any one person, for when normal admin accounts are locked out. Microsoft's mandatory-MFA enforcement applies to these accounts too, so protect them with FIDO2 security keys stored securely (for example, one in the office safe and one off-site with the owner), and monitor any sign-in to them.

How do you roll out MFA in a 20-person office?

Plan for three to four weeks: one week to prepare, one to pilot, one to enroll everyone, and a final week to enforce and clean up. Rushing it causes lockouts on a busy Monday; dragging it out leaves you exposed. Here's the plan we use.

Week 1: Prepare

1. Inventory every sign-in. Microsoft 365, but also the EHR or practice-management system, payroll, banking, the domain registrar, the firewall, VPN, backup console and any vendor portals. Note which support MFA.
2. Decide your methods. Authenticator with number matching for most staff; security keys for admins, the owner and the bookkeeper; a plan for anyone without a smartphone or who won't use a personal phone.
3. Order hardware if needed: security keys (typically about $25–$100 each depending on model, two per admin), and any company phones.
4. Create emergency access accounts and test them.
5. Find legacy dependencies: the copier that scans to email, an old accounting add-in, a shared mailbox someone signs into directly. Fix or replace them before you block legacy authentication.
6. Write a one-page staff guide with screenshots and a "what to do if you get a prompt you didn't expect" section.

Week 2: Pilot

1. Enroll the owner, office manager, IT contact and one person from each role (front desk, clinical or billing).
2. Test everything they use: Outlook on desktop and phone, Teams, OneDrive, the EHR, remote access from home.
3. Note every surprise and update the staff guide.

Week 3: Enroll everyone

1. Announce it at a staff meeting. Explain why in one minute: "This stops someone who steals your password from getting into our email and patient data."
2. Hold a 30-minute registration session with IT present, rather than emailing instructions. People enroll at their desks with help on hand.
3. Use a Temporary Access Pass (a time-limited code issued by an admin) for anyone who needs help getting started or is setting up a new phone.
4. Register at least two methods per person (for example, Authenticator plus a security key or hardware token) so a lost phone isn't a lockout.

Week 4: Enforce and clean up

1. Turn on enforcement: switch Conditional Access policies from report-only to on, or turn on security defaults.
2. Block legacy authentication.
3. Check sign-in logs for anyone still failing or using old apps.
4. Write down the lost phone / new phone procedure and how the help desk verifies identity before resetting MFA.
5. Turn on MFA for the non-Microsoft systems on your inventory, highest risk first.

Rollout timeline at a glance

What about shared accounts and the front desk?

Shared logins are the biggest practical obstacle to MFA in medical, dental and retail offices, and the answer is almost always "stop sharing, then make individual sign-in fast." Here are the common situations and what works.

The shared front-desk login

Many practices have one "frontdesk@" account that three people use on two computers. It can't have meaningful MFA (whose phone gets the prompt?), and you can't tell who did what, which matters for HIPAA audit trails.

What works:

• Give each person their own Microsoft 365 account.
• Convert "frontdesk@" into a shared mailbox, which has no password of its own and is opened through each person's account. Microsoft 365 shared mailboxes don't need a separate license in most cases.
• Use FIDO2 security keys on a lanyard or key ring. At a shared PC, staff plug in or tap the key and touch it, which takes seconds and needs no phone.
• Use sign-in frequency and automatic screen lock so a walk-away doesn't leave a session open.

Staff who won't use a personal phone

This is common and reasonable. Some people don't want work apps on their own phone, some have older phones, and some practices don't allow phones in clinical areas.

Options, roughly in order of preference:

1. FIDO2 security keys: phishing-resistant, no phone needed, and inexpensive.
2. Windows Hello for Business on an assigned computer, plus a security key for other devices.
3. Hardware OATH tokens: small key-fob devices that display a six-digit code.
4. Company-owned phones for roles that need mobile access anyway.
5. A small stipend for using a personal phone, if your policies allow.

Write the policy down before rollout. "We'll provide a security key to anyone who prefers not to use their personal phone" defuses most objections in advance.

Shared logins to vendor and insurance portals

Payer portals, supply vendor sites and lab portals often have one login for the whole office, sometimes with codes sent to one person's phone. Better approaches:

• Ask the vendor for individual user accounts. Many offer them on request.
• Where sharing is unavoidable, store the credential in a business password manager with a shared vault, and store the authenticator (TOTP) code there too, so access is logged and doesn't depend on one person's phone.
• Remove access promptly when someone leaves.

Clinical workstations and speed

Clinicians move between exam rooms and won't tolerate slow sign-ins. Windows Hello (face or fingerprint) on each workstation, or a tap-and-go security key, keeps sign-in to a few seconds. Talk to your EHR vendor too: many support single sign-on with Microsoft Entra ID, so one strong sign-in covers both.

What MFA is required for e-prescribing controlled substances (EPCS)?

Electronic prescribing of controlled substances has its own federal two-factor requirement from the DEA, separate from anything in Microsoft 365. Under 21 CFR 1311.115, the prescriber must authenticate with two of these three factors to sign a controlled-substance prescription:

1. Something only the practitioner knows (a password or challenge response)
2. Something the practitioner is (a biometric, which must meet the requirements of § 1311.116)
3. Something the practitioner has: a device ("hard token") separate from the computer being used, meeting at least FIPS 140-2 Security Level 1

In practice, your EHR or e-prescribing vendor supplies a compliant method, often a certified authenticator app, a fingerprint reader, or a hardware token, plus the required identity proofing for each prescriber. What you need to do:

• Confirm with your vendor which EPCS methods they support and which are certified.
• Make sure every prescriber has a backup method so a lost phone doesn't stop prescribing.
• Keep EPCS tokens and Microsoft 365 MFA straight in your onboarding and offboarding checklists.
• Coordinate with IT so Windows updates or device changes don't break fingerprint readers or token software.

How do you handle lost phones and MFA resets safely?

Have a written procedure before the first phone goes through the wash, because the MFA reset process is where many organizations quietly undo their own security. An attacker who can't beat your MFA will often try to get your help desk to reset it for them.

A safe procedure for a small office:

1. The user contacts IT by phone or in person, not by email from an account that might be compromised.
2. IT verifies identity using something an impersonator wouldn't have: a call back to the number in the HR file, confirmation from the person's manager in person, or a video call where IT can see the person and their ID. "They knew their employee ID and date of birth" isn't enough; that information is often stolen.
3. IT removes the lost device's methods and checks the sign-in log for anything suspicious since the phone went missing.
4. IT issues a Temporary Access Pass, a time-limited, one-use code, so the person can sign in and register their new phone or a security key.
5. The person registers two methods again before the pass expires.
6. IT records the reset (who requested it, how identity was verified, who approved), which also helps with HIPAA audit trails.

If your IT provider handles resets, ask to see their verification procedure in writing. If it's "we recognize the voice," that's a gap.

Lost security keys are less urgent than lost phones (a key alone, without your password or PIN, isn't enough to sign in), but they should still be removed from the account promptly and replaced.

Does MFA mean we can relax password rules?

Somewhat, and in a good way. NIST's updated guidance (SP 800-63B-4, July 2025) moved away from the rules most people hate. For passwords used together with another factor, it sets a minimum of eight characters; for passwords used alone, 15. It says systems "SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types)" and "SHALL NOT require subscribers to change passwords periodically." Change them when there's evidence of compromise instead.

What still matters:

• Every password unique. Reused passwords are how one breached website becomes a breach of your email.
• Long passphrases are easier to remember and harder to crack than short complex ones. Our password generator creates them.
• A business password manager so staff don't keep passwords in notebooks or browser files.
• Blocking known-breached and common passwords. Microsoft Entra ID has built-in banned-password protection.

MFA doesn't make passwords irrelevant; it makes a stolen password insufficient. Passkeys go one step further and remove the password from daily use altogether.

What does MFA cost?

For most small offices, the MFA itself is free; the costs are hardware for people who need it and the time to roll it out properly.

Compare that with the cost of a single compromised mailbox: an investigation, possible breach notification, and the risk of a misdirected payment. Our managed IT services cost guide explains how this work is usually bundled into a monthly plan.

Questions to ask your IT provider about MFA

1. Is MFA enforced for every user on Microsoft 365, or only "enabled" for some?
2. Is legacy authentication blocked? Can you show me in the sign-in logs?
3. Which accounts have admin rights, and do they use phishing-resistant MFA?
4. Do your own technicians use MFA to access our systems, including your remote-management tools?
5. Do we have emergency access accounts, and how are they protected?
6. How do you verify someone's identity before resetting their MFA?
7. Which of our other systems (bank, EHR, backup, firewall, domain) have MFA turned on?
8. What's our plan for moving admins and payment approvers to passkeys or security keys?

Which systems need MFA besides Microsoft 365?

Every system that holds sensitive data, moves money or controls other systems needs MFA. Microsoft 365 is usually the first and biggest, but attackers will use whichever door is unlocked.

What a good MFA setup looks like in different offices

These are illustrative setups for common office types, not specific clients.

Dental office (9 staff)

A typical starting point: one shared front-desk login, an imaging vendor with always-on remote access, and a doctor who checks email from home. A good end state: individual accounts with a shared mailbox for the front desk, security keys at the front desk, Authenticator for clinical staff, and the vendor's remote access restricted to on-request sessions with MFA. Our real dental practice case study describes a practice where multi-factor sign-in and conditional access were enforced alongside device management.

Medical office (20 staff)

A family practice on Microsoft 365 Business Premium with a cloud EHR would typically use Conditional Access to require MFA everywhere, phishing-resistant keys for the admins and the practice manager, and Intune-compliant devices for email and files. Physicians use the EHR's certified authenticator for EPCS, with a hardware token as backup. Exam-room PCs use Windows Hello with a short sign-in frequency.

CPA firm (12 staff)

The FTC Safeguards Rule requires MFA for anyone accessing customer information, so a firm should enable it on Microsoft 365, the tax software, the client portal and remote access. Seasonal staff can get security keys instead of using personal phones, collected at season's end. Our real accounting firm case study shows multi-factor sign-in for everyone combined with conditional access and role-based access to client data. See also IT security for CPA firms.

Small retail shop (6 staff)

If nobody needs Microsoft 365 on their phone, Business Standard with security defaults can be enough: Authenticator for the owner and manager, hardware tokens for part-timers. Just as important is turning on MFA for the bank, payroll, the point-of-sale dashboard and the domain registrar, the four places where a stolen password would cost the most.

How do you know MFA is actually working?

"MFA is turned on" and "MFA is protecting every sign-in" aren't the same thing. Check these once a quarter, or ask your IT provider for a short report:

• Registration coverage: every active user has at least two methods registered, and no one is still on SMS only.
• Sign-in logs: no successful sign-ins using legacy authentication, and no single-factor sign-ins to Microsoft 365 apps outside your documented exceptions.
• Conditional Access results: policies are "on," not stuck in report-only mode from the rollout.
• Admin roles: every account with an admin role uses a phishing-resistant method, and the list of admins is as short as possible.
• Unexpected methods: no authenticator registrations or phone numbers you don't recognize, especially on accounts that handle payments.
• Denied and failed MFA prompts: a run of them on one account means someone has that person's password. Reset it.

That last point is easy to overlook. Every blocked attempt is MFA doing its job, but it's also a warning that a password is out there. Treat it as a reason to act, not a reason to relax.

Mistakes we see

• MFA on email but not on remote access or the backup console. Attackers use the gap.
• Legacy authentication left on, so MFA can be bypassed entirely with older email protocols.
• Only one method registered per person, turning every lost phone into an emergency.
• No emergency access account, or one with no MFA and a password on a sticky note.
• Help desk resets MFA for anyone who calls and sounds convincing.
• SMS left as the default when Authenticator is available.
• Shared accounts kept "because it's easier," losing both MFA and audit trails.
• Answering "yes, MFA everywhere" on an insurance application when it's only on email. Insurers check after a claim.
• Never reviewing who has which methods registered. Attackers who get in once often add their own phone.

MFA checklist

Microsoft 365 / Entra ID

• Security defaults on, or Conditional Access requiring MFA for all users
• Legacy authentication blocked
• Device code flow blocked unless needed
• Admins use phishing-resistant MFA (security keys or passkeys)
• Two emergency access accounts, protected with FIDO2 keys and monitored
• MFA registration restricted to trusted devices or locations
• Every user has at least two registered methods
• No shared user accounts; shared mailboxes used instead
• Sign-in frequency set for shared workstations

Beyond Microsoft 365

• MFA on VPN and remote desktop gateways
• MFA on banking, payroll and payment portals
• MFA on EHR, practice-management or tax software
• MFA on backup console, domain registrar, DNS and firewall management
• EPCS two-factor method in place for every prescriber, with a backup

Process

• Written lost-phone / new-phone procedure
• Help desk verifies identity before any MFA reset
• Staff told to deny and report unexpected prompts
• Offboarding removes MFA methods and collects security keys
• Quarterly review of registered methods and sign-in logs

The bottom line

MFA is the cheapest, fastest, most effective security upgrade most small offices can make. Turn it on everywhere, starting with email, admin accounts and remote access. Use Microsoft Authenticator with number matching as your baseline, move admins and payment approvers to passkeys or security keys, avoid SMS where you have a choice, and plan ahead for shared workstations and staff without company phones.

MFA is also the foundation for everything else: it's the first control in our ransomware protection guide, it's on every cyber insurance application, and it's central to the HIPAA Security Rule checklist we use with practices.

If you'd like help planning a rollout that doesn't disrupt your front desk, see our managed IT and security services or book a free 20-minute call.