How to Set Up MFA (2FA) for Business Accounts, Step by Step

Which MFA method to use

Not all second factors are equally strong. From weakest to strongest:

Microsoft's security defaults documentation explains that when users approve a sign-in in Microsoft Authenticator they are shown a number to enter, which helps prevent "MFA fatigue" attacks where criminals send repeated prompts hoping someone taps Approve.

Microsoft 365: turn on security defaults

Security defaults is Microsoft's free baseline for tenants without Conditional Access. According to Microsoft, it:

• requires all users to register for multifactor authentication;
• requires administrators to use MFA every time;
• asks users for MFA when needed, for example on risky sign-ins;
• blocks legacy authentication protocols, which can't do MFA and are a common way in.

Microsoft notes that since 29 July 2024 the old 14-day grace period for registering MFA has been removed, so users are asked to register straight away. To switch it on:

1. Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator (a Global Administrator also works).
2. Go to Entra ID, then Overview, then Properties.
3. Select Manage security defaults, set it to Enabled, and save.
4. Revoke existing sessions so everyone has to sign in again and register MFA.
5. Tell staff beforehand to install Microsoft Authenticator, and be available on the day to help.

If you have Microsoft 365 Business Premium (which includes Entra ID P1), Microsoft says security defaults are probably not right for you and points to Conditional Access instead. Conditional Access policies let you require stronger methods for admins and block sign-ins from risky locations or unmanaged devices.

Google Workspace: allow, enrol, then enforce 2-Step Verification

Google's 2-Step Verification deployment guide splits it into steps. Google also enforces 2SV for administrator accounts.

1. Tell users the date by which 2SV will be required and which method you want them to use.
2. As a super administrator, go to Security, then Authentication, then 2-step verification in the Admin console, and tick "Allow users to turn on 2-Step Verification".
3. Ask users to enrol: security keys, Google prompts, the Google Authenticator app or backup codes.
4. Track enrolment in the reports until everyone is done.
5. Set Enforcement to On, or "Turn on enforcement from date". Google says enforcement from a date starts within 24 to 48 hours of that date.
6. Set a new user enrollment period (Google allows 1 day to 6 months) so new staff can sign in and set up 2SV in their first days.

Google warns that when 2SV is enforced, users who haven't finished enrolling can be locked out, so check the reports before you switch enforcement on.

The other accounts that need MFA

Email is the most important account, because it can reset the passwords of everything else. Then work through the accounts that hold money, customers or your online presence:

• Domain registrar and DNS host (whoever controls your domain controls your website and email).
• Business banking, payment gateways (Stripe, HitPay) and accounting (Xero, QuickBooks).
• Website admin (WordPress, Shopify, Wix) and hosting control panels.
• Social media and Meta Business accounts, plus WhatsApp Business (turn on two-step verification with a PIN).
• Password manager (protect it with a strong master password and MFA).
• Government accounts such as Corppass, which uses Singpass for two-factor sign-in.

CSA's advice to use strong passwords and enable 2FA recommends long passphrases of at least 12 characters alongside 2FA, and never reusing passwords across accounts.

Avoiding lockouts

• Keep a break-glass admin account: a second admin with a long random password and a security key, stored safely and used only in emergencies.
• Register two methods per person where possible (for example, the app plus a backup phone number or backup codes).
• Save backup codes in your password manager, not in a document on the desktop.
• Plan for lost phones: decide who can reset a user's MFA, and how they confirm it's really that person before doing so.
• Handle leavers properly: remove their MFA methods and sessions on their last day, as well as their password.

Rolling it out to staff without drama

Most MFA rollouts that go wrong do so because staff were surprised. A simple plan for a small team:

1. Announce it a week ahead in plain language: what it is, why, and what they need to do.
2. Share a one-page guide with screenshots for installing the authenticator app.
3. Turn it on for admins first, then everyone else.
4. Pick a time when someone can help, not just before a deadline.
5. Check the next day that nobody has been left out, including shared mailboxes and service accounts.

If you are also tidying up how passwords are shared, our guide to choosing a password manager covers the next step.

Do it yourself or get help?

For a team of a few people, security defaults or Google's 2SV enforcement can be set up in an afternoon using the steps above.

Microsoft 365 / Google Security Lockdown (S$590) enforces MFA for up to 15 users, blocks legacy sign-in and risky apps, sets anti-phishing policies and sharing rules, cleans up admin roles with a break-glass account, and gives you a before and after report. Pair it with a Password Manager Rollout (S$290) so strong, unique passwords become the easy option.