How to turn on MFA for your whole business.

What MFA is, in one line

Multi-factor authentication (MFA, sometimes called two-step verification) means signing in needs something you know, your password, plus something you have, usually your phone or a small security key. A stolen password on its own stops being enough.

It's the single cheapest thing you can do to stop the attacks that hit businesses most: email takeover, invoice fraud, and people being tricked into handing over their login, as Asos found out this month.

Why it matters for Cyber Essentials

Since the scheme was updated in April 2026, if a cloud service you use for work offers MFA and you haven't turned it on, Cyber Essentials is an automatic fail. That applies even when MFA is only available on a paid plan. The only exception is a service that genuinely doesn't offer it.

Step 1: List every account worth stealing

Email is the obvious one, but it's rarely the only one. Make a quick list:

• Email and files: Microsoft 365 or Google Workspace.
• Money: online banking, accounting software, payroll, payment providers.
• Your name online: domain registrar, website host, social media accounts.
• Everything else in the cloud: CRM, booking system, file sharing, password manager.
• Admin accounts: these come first. They're the keys to everything else.

If you can't list them all, that's useful to know in itself. The forgotten account is usually the one that gets used.

Step 2: Pick the method

Not all MFA is equal. From strongest to weakest:

1. Passkeys and security keys. Nothing to type, nothing to read out, and they won't work on a fake sign-in page. Best for admins and anyone who handles money.
2. An authenticator app with number matching. Microsoft Authenticator shows a number on screen that you type into your phone, which stops people approving prompts they didn't ask for. A good default for everyone.
3. Six-digit codes from an app. Fine, but a convincing caller can talk someone out of one.
4. Text messages. Much better than nothing, but the weakest option. Use it only where a service offers nothing else.

If some of your team don't have a work phone and won't use their own, give them a security key. They cost around £25 to £50 each and solve the argument.

Step 3: Turn it on in Microsoft 365

You have two routes, depending on your licence.

• Security defaults (every plan, free). In the Microsoft Entra admin centre, go to Identity, then Overview, then Properties, and choose Manage security defaults. It makes everyone register for MFA with the Authenticator app and blocks old sign-in methods that skip MFA altogether. For most businesses, this is enough.
• Conditional Access (Business Premium, or Entra ID P1). Lets you set rules, such as always requiring MFA for admins, or blocking sign-ins from countries you never work in. Turn security defaults off only once your Conditional Access policies are in place.

Either way, keep one emergency admin account that you'd use only if MFA itself goes wrong, protected with a security key and stored somewhere safe.

Step 4: Turn it on in Google Workspace

In the Google Admin console, go to Security, then Authentication, then 2-step verification. Allow users to turn it on, give them a deadline to enrol, then switch enforcement on. Google lets you set an enrolment period so new starters aren't locked out on day one.

Step 5: Roll it out without the drama

1. Do the admins first, including yourself.
2. Tell everyone a week ahead. What's changing, why, and the date. People cope with change. They hate surprises.
3. Book a 15-minute slot to enrol together. Phones out, apps installed, done. It saves days of "I can't get in".
4. Agree what happens when a phone is lost or replaced, and who can reset someone's MFA. Then make sure that person checks it's really them, by calling them back on a number they already have.
5. Work through the rest of your list. Banking, accounting, domain and website next.
6. Check the sign-in logs a week later. Anyone still signing in without MFA, and any failed attempts from abroad, will show up there.

Things that catch people out

• Shared mailboxes like info@ or accounts@. Don't give them their own passwords at all. Give people access through their own, MFA-protected accounts.
• Leavers. An old account with no MFA is an open door. Disable it on their last day.
• Older apps and printers that send email using a plain password. Find another way for them to send, rather than leaving a gap for everyone.
• "Approve" fatigue. If someone gets a sign-in prompt they didn't ask for, it means someone has their password. Tell them to say no, then tell you, and change the password.

FAQ

Do I have to use my personal phone?

No. If someone doesn't want work apps on their own phone, a security key does the same job and is often stronger.

Will it be annoying?

Less than you'd think. Most services remember a trusted device, so people are usually asked again only on a new device, a new location, or every few weeks.

Is text message MFA good enough for Cyber Essentials?

The scheme accepts it, but an authenticator app, passkey or security key is better. Use text messages only where nothing else is offered.