Multi-factor authentication (MFA) means a password is not enough. A phone prompt, an authenticator code or a hardware key has to agree as well. For a small North East office it is one of the few security changes that is both cheap and noticeable. It is also the change people delay because they are afraid of locking the director out of email on a Monday morning.
A calm rollout avoids that. You register devices on purpose, keep a break-glass account, and turn the requirement on once the team has signed in successfully — not the other way round. This sits next to Microsoft 365 basics and password managers for small teams.
Start with the accounts that matter
Microsoft 365 admin, the shared mailbox that receives enquiries, banking, HMRC, Companies House and the domain registrar are the logins that hurt if they are taken over. Staff Microsoft 365 accounts come next. Wi‑Fi admin panels, the firewall, and the website control panel are easy to forget and just as useful to an attacker.
Do not invent a second personal Microsoft account “just for admin”. Named accounts with extra privileges, plus MFA, are easier to audit when someone leaves. Shared passwords in a notebook make MFA almost pointless, because the second factor ends up on a sticky note as well.
Cyber Essentials expects MFA on cloud admin and email. You do not have to be applying for the badge for that to be a good idea. If you are, read Cyber Essentials for North East SMEs before you book an assessor — MFA is one of the controls they will check, not a guarantee of a pass.
A rollout that does not strand people
- Pick one authenticator app and stick to it, so you are not supporting four methods
- Register each person’s phone on a working day, while they are in the building or on a call with you
- Record two backup methods for the people who cannot afford to lose mail — a spare token or a second registered device, not a shared passcode in chat
- Keep one tightly controlled break-glass admin account with a hardware key, used only when the usual admins cannot sign in
- Tell the team that an unexpected MFA prompt is a reason to tap Deny and call IT, not to approve it so the noise stops
Turn the policy on in stages if you have more than a handful of mailboxes: a pilot group first, then everyone else. Legacy protocols that bypass MFA (old phone mail apps, some printers that send via SMTP) need a decision, not a silent exception that lasts for years.
Shared mailboxes do not sign in as themselves. People open them from their own account. MFA on the person is what protects that shared inbox. The same is true of SharePoint: you are not looking for a “site password”, you are looking for whether the people with access have MFA.
People who travel or work from a van need a method that works without office Wi‑Fi. The Authenticator app does. SMS is a weaker fallback. Paper printouts of backup codes belong in the same place you keep other important business documents, not in a desk drawer that anyone can open.
If someone loses a phone, treat it as a lost second factor. Remove that device from the account before you replace the handset. Leaving old authenticators registered is how a sold or stolen phone still approves logins.
What MFA does not replace
MFA will not stop someone approving a fake invoice after a well-written email. It will not patch Windows or back up SharePoint. It will not help if the website admin login is still “admin” and last year’s password. Treat it as one control among the cyber security basics, not the whole programme.
Write down who is allowed to approve MFA resets. In a five-person firm that is often the director plus whoever looks after IT. If anyone in the office can talk a helpdesk into sending a reset, the second factor is theatre.
Garvey's IT turns MFA on as part of IT support for Microsoft 365 tenants we look after — including the awkward accounts, the printers, and the person who only uses a desktop. Book a short MFA rollout if you want it done on a planned morning rather than after the first suspicious sign-in.
Common questions
Is the Microsoft Authenticator app required for MFA?
No. An authenticator app is the better default for office accounts. SMS can work as a backup for people who struggle with apps, but it is easier to intercept. Avoid emailing one-time codes to the same mailbox you are protecting.
Will MFA stop every account takeover?
No. It blocks a large class of password-only attacks. Prompt bombing, stolen session cookies and a user who approves a login they did not start are still possible. Pair MFA with a habit of denying unexpected prompts and with the phishing checks in our other guides.