Insights · Security

MFA for small business: what to turn on, and what to turn off

Modern Business Solutions · October 2026

Most account takeovers start with a stolen password. Multi-factor authentication stops most of them, if it's set up the right way.

A stolen or reused password is still one of the most common ways attackers get into a business. Multi-factor authentication (MFA) adds a second check, so a password alone isn't enough. Cyber insurance applications now routinely ask whether you have it.

Turning it on is the easy part. Here is how to set it up so it actually protects you.

Use an authenticator app, not text messages

Codes sent by text are better than nothing, but phone numbers can be hijacked. An app like Microsoft Authenticator, with number matching turned on, is much harder to trick.

Cover every account, including the boss's

Exceptions are where attackers get in. Owners, admins and shared mailboxes need MFA just as much as everyone else, and admin accounts need it most.

Turn off old sign-in methods

Older email protocols can skip MFA entirely. In Microsoft 365, blocking legacy authentication closes that back door. Security defaults or Conditional Access policies handle this.

Watch for "MFA fatigue"

Some attackers send approval prompt after prompt, hoping someone taps "approve" to make it stop. Train your team: if you didn't just sign in, deny it and tell IT.

Have a plan for new phones

People lose and replace phones. Decide ahead of time how someone gets their MFA reset, and make sure it requires confirming who they are.

Not sure where you stand?

We can review your Microsoft 365 sign-in settings and show you which accounts are exposed, usually in a single visit.