How to set up MFA for your team
- MFA means signing in with something you know (a password) plus something you have (your phone).
- For a small Microsoft 365 company, turning on security defaults is the quickest safe start.
Steps
- Pick two admins. Choose two people who can manage accounts. One admin alone is risky if they are away or lose their phone.
- Tell the team first. Say what is changing, the date and why. Show them where to install the authenticator app.
- Turn on security defaults. A Microsoft 365 admin signs in to the Microsoft Entra admin center, opens the tenant properties, and turns on security defaults. This asks everyone to register for MFA.
- Have each person register. At next sign-in, each person follows the prompts and adds the authenticator app. Ask them to add a second method too.
- Check everyone finished. The admin looks at the list of who has registered and follows up with anyone missing.
- Write down the recovery plan. Decide who resets a lost phone and how they confirm it is the real person.
Which method is best?
An authenticator app or a hardware key is stronger than text messages. Text messages are better than nothing.
What may break
Very old mail programs and some scanners that send email cannot use a second step. List those before the switch and ask a pro to move them to a safer method. Do the change early in the week, not on a Friday.
Do the admins first
Admin accounts are the biggest prize for an attacker. Protect them first, and use a separate admin login that is not used for daily email.
When to call a pro
- You are not sure who the admin is, or there is only one.
- You have a scanner, alarm system or app that sends email and may stop working.
- You want rules like only allow sign-in from the United States, set up properly.
- Anyone is locked out.
Need IT support for your business?
Call Ava, or book a free check. We look at your setup and tell you what we would fix first, in plain words, whether or not you hire us.
●●● ●●●-●●●● Book a free check
Common questions
What does MFA stand for?
Multi-factor authentication. It means more than one proof when you sign in.
Is MFA annoying for staff?
A little at first. After the first week most people say it is no trouble, and it blocks most password theft.
What if someone loses their phone?
An admin resets their sign-in step. Have that plan written down before it happens.
Keep reading
- I got a new phone and my sign-in code stopped working
- Strong passwords for a small team
- What to do with IT when an employee leaves
Where we help
Minority- and Black-owned businesses are welcome here, and so is every other small business.
Book a free 30-minute review
Tell us what is not working. We will look at your setup and tell you what we would change, whether or not you hire us.
Book the review ●●● ●●●-●●●●