How to Set Up Multifactor Authentication

Multifactor authentication asks for a second proof of identity after the password, usually a prompt or code on your phone. It stops the large majority of account takeovers, because a stolen password is no longer enough, and every cyber insurer now requires it. Setting it up is not hard; setting it up so that it protects everyone, survives a lost phone and does not cause a revolt takes a little planning. This guide covers the methods, the steps in Microsoft 365 and Google Workspace, and a rollout that works. If you keep receiving codes you did not ask for, see why you keep getting Microsoft Authenticator codes.

Choose the method first

• Authenticator app with number matching. The app shows a prompt and the sign-in screen shows a two-digit number the user must type into the app. This is the standard for most people: convenient, free, and resistant to prompt bombing because a blind tap does nothing.
• Passkeys and hardware keys. A passkey stored on the phone or computer, or a physical key such as a YubiKey, proves identity without any code that could be phished. Use these for administrators, owners and anyone who moves money.
• Text message codes. Better than nothing, worse than the rest; a phone number can be hijacked. Keep it as a backup method only.
• Email codes and security questions. Not really a second factor at all, since email is what you are protecting. Avoid.

Microsoft 365

For the administrator

1. In the Microsoft 365 admin centre, open Microsoft Entra ID (the identity service behind Microsoft 365). On any plan, turn on Security defaults to require MFA for everyone with the Authenticator app. This is the free, simple route.
2. On Microsoft 365 Business Premium, use Conditional Access instead. It lets you require MFA for everyone, demand phishing-resistant methods for administrators, block sign-ins from countries you never operate in, and skip repeated prompts on company-managed devices. The plan picker shows whether Premium fits your company.
3. Block legacy authentication, the old protocols that ignore MFA entirely. Security defaults do this for you; in Conditional Access it is one policy.
4. Create a break-glass administrator account with a long password and a hardware key, kept offline, so a misconfigured policy cannot lock everyone out.

For each person

1. Install Microsoft Authenticator on the phone.
2. Sign in at aka.ms/mfasetup on a computer and follow the prompts to add the app; a QR code links the phone to the account.
3. Add a backup method, such as a phone number, in case the app is unavailable.
4. Sign out and back in once to confirm the prompt and number matching work.

Google Workspace

In the Admin console, under Security, turn on 2-Step Verification and set it to enforced, with a short grace period for enrolment. Choose the allowed methods; Google prompts and passkeys are the sensible defaults, with text codes as backup. Each user then adds a method under their Google account security settings. As with Microsoft, keep at least one administrator with a hardware key.

Everything else

Banking and accounting portals, payroll, the phone system, remote access and the VPN, social media accounts and the password manager all deserve MFA, in roughly that order of how much damage a takeover does. Where an application supports single sign-on through Microsoft 365 or Google, use it: one identity with strong MFA is easier to manage than twenty separate ones.

A rollout that works

1. Announce it a week ahead, with the reason (the insurer requires it, and it stops the attacks that hit companies like ours) and a one-page guide.
2. Pilot with the office before the field staff, so the help desk learns the questions.
3. Enrol in small groups with someone on hand; ten minutes per person is typical.
4. Set the reset process first. Decide how a person proves identity when they lose a phone, and make sure nobody, including your IT provider, resets a factor on the strength of a phone call alone. Fake help-desk calls are how attackers defeat MFA now; see what social engineering is.
5. Enforce once enrolment is complete, and turn off the exceptions. An account without MFA is the account the attacker will find.
6. Watch the sign-ins. MFA reduces takeovers; it does not make them impossible. Huntress cloud security watches Microsoft 365 for the sign-ins and mailbox rules that mean someone got through.

Common mistakes

Turning MFA on only for administrators. Leaving shared mailboxes and service accounts with passwords and no second factor. Allowing text codes as the primary method. Announcing and enforcing on the same day. Letting a departed employee’s phone remain the second factor on a still-active account. Each of these shows up in the incidents we investigate, and each takes an hour to fix.

Common questions

Is text-message MFA good enough?

It is far better than nothing and far worse than an authenticator app. Text messages can be intercepted by moving your number to another SIM, and they cannot use number matching. Use them only as a backup method.

What happens when someone loses their phone?

They call the help desk, prove who they are through a channel the help desk trusts, and the second factor is reset. Set that process up before the rollout, and give every account a backup method, so a lost phone is a ten-minute call rather than a locked-out day.

Do we need Microsoft 365 Business Premium for MFA?

No. Security defaults give every Microsoft 365 plan basic MFA for free. Business Premium adds conditional access, which lets you require stronger methods, block sign-ins from countries you do not do business in, and skip prompts on managed devices.

How long does a rollout take?

A company of thirty can be fully enrolled in a week: an announcement, a short guide, enrolment in small groups with help on hand, then enforcement. The mistake is announcing and enforcing on the same day.

Can MFA be defeated?

The weaker forms can. Push bombing, fake help-desk calls and real-time phishing pages all target the human step. Number matching, passkeys and hardware keys resist them, which is why they are worth the small extra effort for administrators and finance staff.

Talk to us

If MFA is turned on for some of your people and not others, or you are not sure, we will check the tenant and finish the job. Call 952-548-5558 or contact us; the first conversation is free and there is no long-term contract.