MFA for Small Teams: What to Turn On First, and in What Order
7 min readAccounts & Access
Multi-factor authentication is the highest-return hour you will spend on security, and it is the control most likely to have been done halfway — enabled for people who volunteered, skipped on the accounts that matter most, and left off entirely on the one account that controls all the others.
This is how to finish it.
Not all MFA is equal
"We have MFA" describes at least four different levels of protection. In increasing order of strength:
SMS codes. A code by text message. Real protection against the most common attack — someone using a password from a breach dump — and it stops credential stuffing dead. But it is phishable: a fake login page simply asks for the code and relays it in real time. It is also vulnerable to SIM swapping, where an attacker convinces a mobile carrier to move a number to their own SIM. Use it as the bridge that gets a reluctant colleague protected today, not as your destination.
Authenticator app codes (TOTP). A six-digit code from an app on the phone. Immune to SIM swapping and much better than SMS. Still phishable in the same real-time way: the fake page asks, the user types, the attacker relays within the thirty-second window. This is the practical baseline for most small companies.
Push notifications. "Approve this sign-in?" Convenient, and vulnerable to a specific and widely used trick — see MFA fatigue below. Only use push if it shows a number-matching challenge, where you must type a number displayed on the login screen into your phone. Plain yes/no push is meaningfully weaker.
Passkeys and security keys (FIDO2/WebAuthn). Structurally different, and the only option on this list that is genuinely phishing-resistant. The credential is cryptographically bound to the real website's domain. A lookalike site cannot use it, because the browser will not offer it — not because the user noticed something, but because the mechanism physically cannot produce a valid response for the wrong domain. There is no code to read out, so there is nothing to relay.
That last property is the one that matters. Every other form of MFA still depends on a human not being fooled. Passkeys do not.
The rollout order that avoids a revolt
Do not start with "everyone, everything, this week". Start where a compromise is worst.
Tier 1 — do this today. These are the accounts that grant access to other accounts:
- Your email tenant (Google Workspace / Microsoft 365), administrators first, then everyone. Email is where password resets land; email is the master key.
- Your domain registrar. Whoever controls DNS controls where your email goes. Enable registrar lock while you are there. This account is often ten years old, on a personal address, with a password from a different era.
- Your password manager, if you have one. If you do not, this is the week to get one.
Tier 2 — this week. Anything holding money or the ability to move it: business banking, payroll, payment processor, accounting software, expense cards.
Tier 3 — this month. Anything holding customer data or production access: cloud provider (AWS/GCP/Azure), code repository, CRM, support desk, analytics, and your CI/CD system. Root and owner accounts get a hardware security key, not an app.
Tier 4 — this quarter. Everything else: design tools, project management, marketing platforms, the long tail of SaaS.
Enforce rather than encourage at every tier. An optional MFA rollout stalls at partial adoption and never finishes, and the people who opt out are not randomly distributed — they skew towards the busiest and most senior, which is to say the most valuable to attack.
Get the 31-point security checklist
The checklist, then one email a week on what changed and what a company your size should do about it.
Weekly. Unsubscribe in one click. See the checklist first.
Passkeys: what changed and why it matters to you
Passkeys moved from "interesting" to "the default worth choosing" once the major platforms shipped them properly. Google Workspace, Microsoft 365, and most serious SaaS now support them, and they sync through Apple, Google or your password manager, so losing a phone no longer means losing access.
Two practical reasons to care:
They kill your worst phishing risk. The credential only works on the genuine domain. That removes the entire category of "convincing fake login page", which is how most account takeovers at small companies begin.
They are faster than what you have now. Face or fingerprint, no code, no app-switching. This matters more than it sounds: MFA that is slower than a password creates a constituency lobbying you to turn it off. MFA that is faster creates the opposite.
Practical approach: enable passkeys wherever offered, keep an authenticator app enrolled as backup while support is uneven, and give your two or three highest-privilege accounts a pair of hardware security keys — one carried, one in a safe. Buy two. The failure mode of a single key is being locked out of your own company.
The accounts people forget
Go through this list. Most companies find at least three gaps.
- The domain registrar. Mentioned twice on purpose. It is the single most consequential forgotten account.
- Shared or role accounts — info@, billing@, support@, the shop floor login, the social media accounts. Nobody owns them, so nobody secures them. Convert them to a shared mailbox or a group that delivers to individually-secured accounts, so there is no shared password at all. Where a genuine shared login is unavoidable, put it in the password manager with MFA seeded in the manager itself, and record who has access.
- The bookkeeper's, accountant's, or agency's access. External parties with real access and security you do not control. Ask them directly what their MFA situation is. It is a fair question.
- Break-glass administrator accounts. The emergency account you keep in case you lock yourself out. It needs the strongest protection, not the weakest, and its credentials belong in a sealed envelope in a safe.
- The former employee's account that still exists. See offboarding.
- Personal accounts used for company things — the founder's personal Gmail that owns the Google Ads account, the developer's personal GitHub with production keys. Migrate them; until then, secure them as if they were company accounts, because they are.
MFA fatigue and how attackers get around it
Two techniques you should know by name, because they are the reason "we have MFA" is not the end of the conversation.
Push bombing (MFA fatigue). The attacker has your password and simply triggers login attempts repeatedly. Your phone buzzes at 2am, over and over. Eventually someone taps approve to make it stop, or taps it half-asleep by reflex. The defence is number matching — if approving requires typing a number shown on the attacker's screen, an accidental tap cannot approve anything. Enable number matching if your provider offers it, and tell your team that an unexpected prompt means someone has your password and must be reported, not dismissed.
Adversary-in-the-middle phishing. The fake login page is a live proxy to the real site. You enter your password, it forwards it; the real site asks for your code, the fake page asks you, you type it, it forwards that too — and then it steals the resulting session cookie. You are logged in, everything looks normal, and the attacker has a valid session that survives you changing your password later. Codes cannot defend against this. Passkeys can, because there is no transferable secret.
This is also why session revocation matters: after any suspected compromise, changing the password is not enough. Sign out all sessions.
A two-week rollout plan
Day 1 (90 minutes). Enable and enforce MFA for administrators in your email tenant. Secure the domain registrar and enable registrar lock. Buy two hardware security keys for the highest-privilege accounts. Choose a password manager and buy the team plan.
Days 2-3 (one email, one 15-minute meeting). Tell the team what is happening and, more importantly, why — using the account-takeover story rather than the word "compliance". Show them the enrolment in real time; the demo is worth more than the instructions. Announce the deadline.
Days 4-8. Staff enrol. Publish a two-paragraph guide with screenshots. Hold a 30-minute drop-in session — this converts the stragglers far better than reminder emails. Deal with the person who has no smartphone by issuing a hardware key rather than granting an exemption.
Day 9. Turn on enforcement for everyone. Expect two or three people to be locked out; have your reset process ready and staffed for that morning.
Days 10-14. Work Tier 2 and Tier 3. Enable passkeys wherever supported. Document one thing: what happens when someone loses their phone. Who do they contact, how do they prove identity, who is authorised to reset. Without this written down, the recovery process becomes a social-engineering target — and helpdesk impersonation is exactly how attackers get past MFA at larger companies.
Then put a quarterly reminder in the calendar to re-run the forgotten-accounts list above. New tools arrive constantly, and they arrive unprotected.
The one thing to get right
If you take one decision from this: enforce phishing-resistant MFA on email and the domain registrar, this week. Those two accounts sit above everything else you own. Every other item on the list is worth doing, and none of them is worth doing first.