Multi-factor authentication blocks over 99% of automated account attacks. It's one of the highest-impact security measures an SMB can implement. It's also one of the most poorly rolled out — leading to frustrated employees, IT support tickets, and lockouts. Here's how to do it right.
Password breaches are now so common that assuming any given password is already in a criminal database is a reasonable starting point. Credential stuffing attacks — where attackers try leaked username/password combinations across hundreds of services — are fully automated and cost almost nothing to run at scale.
MFA doesn't make accounts unbreakable, but it raises the cost of an attack to the point where automated tools move on. Microsoft's own data consistently shows that accounts with MFA enabled are over 99% less likely to be compromised.
2026 note: Cyber insurance providers are increasingly requiring MFA as a condition of coverage. If you're renewing or applying for a policy, check the requirements — lack of MFA on admin accounts can invalidate a claim.
| Method | Security level | Usability | Recommendation |
|---|---|---|---|
| Authenticator app (TOTP) | High | Good | Best default choice |
| Hardware key (FIDO2) | Very high | Moderate | For admin & finance roles |
| Push notification | High | Very easy | Good for non-technical staff |
| SMS code | Moderate | Easy | Only if no better option |
| Email code | Low | Easy | Avoid — email is often compromised first |
For most SMB teams, an authenticator app (Google Authenticator, Microsoft Authenticator, or Authy) is the right default. It's free, works offline, and covers the vast majority of services. Reserve hardware keys for the accounts that matter most: admin access, banking, and payroll.
Rolling out MFA to all accounts on the same day is a recipe for chaos. Do it in phases, starting with the highest-risk accounts first.
Start with the accounts that have the most access. If your IT admin account is compromised, an attacker can disable MFA for everyone else. Lock these down first, test the process, and work out any tool-specific quirks before involving the wider team.
These accounts have access to money and sensitive employee data — high-value targets for attackers. Roll out MFA here next, with hands-on support for each person. Don't do it via email instruction alone.
Email is the master key — it resets most other passwords. Enabling MFA on email accounts across the whole team is the single highest-impact step. Book 15 minutes with each person to walk them through setup on their phone.
CRM, project management, cloud storage, communication tools. Send a company-wide guide with screenshots for each tool you use. Give a two-week deadline, then audit who hasn't enabled it and follow up individually.
There is always one. Their objections usually fall into a few categories:
If resistance continues: make it a policy. MFA on company accounts is a security requirement, not a preference. Frame it the same way you'd frame wearing a seatbelt — not optional.
MFA is most effective when combined with strong, unique passwords — something humans are bad at without help. A password manager solves both problems: strong unique passwords generated automatically, and many password managers now also store TOTP codes so your team only needs one app.
NordPass Business includes TOTP support and team vaultsFrom $1.79/user/mo · We may earn a commission
Enable MFA on email accounts first — that single step removes the master key from attackers' reach and protects every other account that uses that email address for password resets.