How to turn on two-factor authentication (2FA) in a small business: a 5-step plan
A stolen password doesn't have to mean a stolen business. Here is how to switch on 2FA in Microsoft 365, Google Workspace and your other services in one afternoon.
For many small businesses, a password is the only lock on the door. If someone gets your email password, they get your quotes, invoices, contacts and the ability to reset passwords for every other service. Two-factor authentication (2FA) adds a second lock: besides the password, signing in requires something you have with you, usually a phone or a security key. You can switch it on in an afternoon, and it is free in the tools most businesses already use.
What 2FA is and why a stolen password is no longer enough
With 2FA, signing in requires two proofs of different kinds: something you know (a password) and something you have (a phone with an authenticator app, a security key) or something you are (a fingerprint). Croatia's national CERT describes it exactly this way in its paper on multi-factor authentication (in Croatian): authentication is multi-factor when it requires several methods from different categories.
In practice, an attacker who got your password from a fake email or a data leak at another service still faces a locked door, because they don't have your phone.
Not all methods are equal: SMS is the weakest link
You will usually choose between these methods, from weakest to strongest:
- SMS or call with a code – better than nothing, but CERT warns it is vulnerable to SIM swap attacks, where a fraudster moves your number to their own SIM card. The code can also be phished through a fake page.
- Authenticator app (e.g. Microsoft Authenticator or Google Authenticator) – generates a code or sends a notification you approve on your phone. For most small businesses, this is a sensible standard.
- Security key or passkey – a physical device or a key stored on your phone. CERT notes that smart cards and similar devices are among the most secure options, because a good implementation resists phishing. We recommend them at least for admin accounts.
Rule of thumb: an app for every employee, a security key for whoever has admin rights.
Microsoft 365: turn on security defaults
If you use Microsoft 365, the fastest route is security defaults. According to Microsoft's documentation, they require no extra licence and switch on a set of basic protections at once:
- all users must register for multi-factor authentication,
- admins must use it every time they sign in,
- legacy authentication is blocked (older protocols that don't support 2FA, which attackers like to use to get around it).
You enable them in the Microsoft Entra admin center (entra.microsoft.com): Entra ID → Overview → Properties → Manage security defaults, then set it to Enabled and save. Users register with the Microsoft Authenticator app. If your tenant already uses Conditional Access policies, Microsoft says security defaults are probably not right for you – manage 2FA through those policies instead.
Warning: old scan-to-email printers or old mail programs may stop working once legacy authentication is blocked. List those devices before you flip the switch.
Google Workspace and other services
In Google Workspace, the admin first allows users to turn on 2-Step Verification in the Admin console, then makes it mandatory after a transition period. The steps are in Google's admin help. Google has also announced it will gradually require 2-Step Verification for all admin accounts, and admins who don't turn it on after being notified lose access to apps. Better to sort it out now, on your own terms.
Don't forget services outside the office suite: online banking, company social media, your website and domain admin, your accounting software. Nearly all of them have 2FA in their security settings.
A 5-step rollout plan
- List your accounts. Email, cloud, bank, domain and hosting, social media, online shop. For each one, note who the admin is.
- Start with admins and email. Whoever controls email controls password resets for everything else.
- Tell your team in advance. A short message: what changes, on which day, which app to install. Set aside 15 minutes to register together.
- Save backup codes. Every service offers one-time codes in case a phone is lost. Print them and keep them somewhere safe – not in the same mailbox you are protecting.
- Plan for a lost phone. Decide who can reset 2FA for an employee, and make it at least two people so the business can't lock itself out.
Common mistakes to avoid
- One shared account for the whole office, with 2FA on just one person's phone.
- Approving a sign-in notification you didn't start. If a request arrives and you weren't signing in, deny it and change your password straight away.
- 2FA on email, but not on the bank or the domain.
- A former employee who still has the authenticator app linked to a company account.
If you'd rather not dig through the settings yourself, this is a typical job for IT support – one afternoon, with benefits that last for years.
IT Sektor helps small businesses and sole traders adopt AI and digital tools where they actually pay off — get in touch.