Passwords get stolen. They get guessed, reused, leaked, and tricked out of people.
Multi-factor authentication, or MFA, is the single most practical way to make a stolen password far less useful. If you only do one security thing this month, make it this.
Here's what MFA is, where to start, and how to roll it out without a revolt.
What is MFA?
MFA means you need more than a password to sign in. You prove who you are in two or more ways.
Those ways fall into three groups:
- Something you know. A password or PIN.
- Something you have. Your phone, a security key, or a code from an app.
- Something you are. A fingerprint or face scan.
With MFA, a thief who steals your password still can't get in. They'd also need your phone.
You've likely used it already. When your bank texts a code, that's MFA.
Why a password alone isn't enough
Passwords fail in ordinary ways.
- People reuse them across sites. One breach exposes many accounts.
- Phishing emails trick people into typing them into fake pages. See our post on phishing training for employees.
- Simple passwords get guessed.
- Old logins from past employees sit active.
MFA doesn't fix bad habits. But it adds a second lock that a stolen password can't open on its own.
What to turn on first
Don't try to do everything on day one. Start with the accounts that would hurt most if broken into.
1. Email. Your email account is the key to everything else. Attackers use it to reset other passwords and to impersonate you. If you use Microsoft 365, MFA is available and should be on for every user.
2. Admin accounts. Anyone who can change settings, add users, or see everything. These are top targets.
3. Remote access. Any way staff connect to your network from outside the office. If it isn't protected by MFA, it's an open door.
4. Banking and payroll. Where the money moves. Most providers offer MFA. Turn it on.
5. Cloud apps with sensitive data. Accounting, customer records, file sharing, and any app with client or patient information.
6. Everything else, as you go. Social media, vendor portals, and so on.
Which type of MFA is best?
Not all methods are equal. From better to weaker:
Security keys or passkeys. Very strong. A small physical device or built-in device credential. Good for admins and high-risk users.
Authenticator app. A good, common choice. An app on your phone gives you a code or asks you to approve the sign-in. Better than text messages.
Text message codes. Better than nothing. Easier for attackers to intercept than an app. Fine as a starting point, but move to an app when you can.
Email codes. Weak if the email account itself isn't protected. Avoid for anything critical.
One warning: some attacks trick people into approving a sign-in prompt they didn't start. Teach your staff to deny any prompt they didn't trigger, and to tell someone right away.
How to roll it out without the groans
Staff often push back on MFA. It feels like extra work. Here's how to make it smoother.
- Explain why. Two sentences are enough. "We've seen accounts get taken over. This stops most of it."
- Start with a small group. Test with a few people. Fix issues before the whole office.
- Help people set it up. Don't send a link and hope. Sit with them for ten minutes. That's it.
- Plan for lost phones. Decide in advance how someone regains access if their phone is lost or replaced.
- Set a date. "MFA is required starting the 15th" works better than "please do this sometime."
- Follow up. Check who hasn't enrolled and help them.
Most people stop noticing MFA within a couple of weeks.
Common questions
Does MFA make things slower? A few seconds per sign-in. Many systems remember trusted devices, so you aren't prompted all day.
What about employees using personal phones? That's common. Authenticator apps work on personal phones. Some businesses prefer to issue security keys. Talk through the tradeoffs for your office.
Is MFA enough on its own? No. It's a strong layer, not a complete defense. You still need patching, protected devices, email filtering, backups, and trained staff. See our full cybersecurity services.
Does MFA matter for compliance? Often, yes. Healthcare practices and businesses that take card payments are frequently expected to protect access with MFA. If that's you, our compliance IT support covers it. We handle the technical side and aren't a substitute for legal advice.
How we handle MFA for clients
For our managed clients, we enforce and manage MFA. We set it up with you one-on-one, so staff aren't left guessing. Microsoft 365 Business Premium, which is included in our Endpoint Plan, supports MFA and conditional access controls, so we can configure it for your whole team.
That's part of what our managed IT services do: take care of the security basics so you don't have to chase them.
Local, owner-led help
603 Technology Solutions works with businesses across New Hampshire, including Conway and the surrounding area. If you'd like help getting MFA turned on properly, you'll talk with the owner, not a call center.
Next step
Turn on MFA for your email and admin accounts this week. If you want help doing it right, we can walk through it with you.
Call 603-836-8984 or contact us here. We'll keep it simple.