Introducing multi-factor authentication: a step-by-step guide for SMEs

Why passwords alone are no longer enough

A password is a single secret that can be stolen in many ways: through a phishing page, malware on a laptop, a breach at another service where the same password was used, or simple guessing. Anyone who knows it looks like the legitimate user to the system. Multi-factor authentication (MFA) closes this gap by requiring a second, independent proof at sign-in.

That second factor is something the person has, such as a smartphone or a security key, or something they are, such as a fingerprint that unlocks the key. MFA does not replace a well-designed password policy, but it greatly limits the damage of a leaked password.

MFA methods compared: not every second factor is equally strong

The key difference is whether a convincing fake login page can fool them. Modern phishing kits sit between the user and the real service and pass on everything entered, including one-time codes. Only methods cryptographically bound to the genuine website are considered phishing-resistant.

Authenticator app with number matching

For most employees, an authenticator app on their smartphone is the practical standard. With number matching, the user types a short number shown on the sign-in screen into the app. This stops people approving someone else's sign-in out of habit, but not a fake login page that relays the number live.

FIDO2 security keys and passkeys

FIDO2 security keys are small USB or NFC devices. Passkeys use the same standard and live on a smartphone, a laptop or in a password manager. Both respond only to the service's genuine domain, so a fake page gets nothing usable. They are the right choice for administrators and anyone with access to finance or sensitive data. If you use security keys, plan for two per person, one as a spare.

Why SMS is only a stopgap

SMS codes beat having no second factor, but they are the weakest option. Attackers can hijack phone numbers through SIM swapping, and the codes can be phished just like passwords. The US standards institute NIST classifies SMS and voice codes as a restricted method, to be used only with extra safeguards such as offering a stronger alternative. Use SMS only where nothing else works.

Where to start with MFA: the accounts with the greatest leverage

You do not have to secure everything at once. Start where a takeover would do the most damage:

1. Administrator accounts: Microsoft 365 or Google Workspace admins, firewall, backup console, domain registrar and hosting.
2. Email and collaboration: Mailboxes are the key to resetting passwords for almost every other service.
3. VPN and remote access: VPN gateways, remote desktop and remote maintenance tools are popular entry points.
4. Cloud applications with sensitive data: Accounting, payroll, CRM and file storage.
5. The password manager itself: It holds every other credential.

Next, look for legacy sign-ins without MFA, such as mail clients, printers or scanners that use only a user name and password over POP, IMAP or SMTP (basic authentication). Large providers are phasing these out, but wherever they still work, attackers can bypass the second factor. Our article on securing Microsoft 365 explains how to tackle this.

Rollout plan: introducing MFA in six steps

1. Take stock: List all accounts, services and access paths, including shared mailboxes and service accounts.
2. Choose methods: Define the standard for staff, the method for administrators and a fallback for exceptions.
3. Pilot: Start with IT and a few volunteers from different departments, and note any problems.
4. Communicate: Announce the change early, explain why and provide a short guide with screenshots.
5. Registration phase: Give everyone a fixed period to set up their methods, with support on site or by phone.
6. Enforce and review: Make MFA mandatory, block legacy access and check regularly that all accounts are covered.

Acceptance depends above all on communication: employees should know why the change is coming, what they have to do and whom to contact if something goes wrong. A fixed switchover date, a set-up session during working hours and a named contact person reduce resistance considerably.

MFA fatigue: recognising and stopping push bombing

An attacker who already has a password can trigger push notifications again and again, often late at night or alongside a call posing as IT support. The hope is that the person eventually approves just to make it stop. This is known as MFA fatigue or push bombing, and the password often comes from a phishing email. These countermeasures help:

• Enable number matching and additional context such as the app name and location.
• Limit sign-in attempts and alert IT to unusual patterns.
• Make it clear that IT will never ask for an approval or a code by phone.
• Use phishing-resistant methods for administrators and other critical accounts.

Lost devices and account recovery

Sooner or later a smartphone gets lost, breaks or is replaced. Without a clear process, the temptation to simply switch MFA off is high, and attackers exploit this with fake help desk calls. Define in advance how a person proves their identity before a new device is registered.

• Register at least two methods per person, such as an app and a security key.
• Verify identity by calling back a known number or in person, never on request alone.
• Use time-limited one-off access codes for re-registration instead of disabling MFA.
• Remove lost devices from the account immediately and document every reset.

Conditional access: MFA with context

Conditional access lets sign-in rules weigh up context: who is signing in, from which device and country, and to which application? A typical rule set requires MFA for all users, allows access to sensitive data only from managed devices and blocks sign-ins from countries where the company does not operate. Administrators must also use phishing-resistant methods.

In Microsoft 365, the free security defaults provide basic protection. Fine-grained conditional access policies need a Microsoft Entra ID P1 licence, included for example in Microsoft 365 Business Premium. Test new rules in report-only mode first so that nobody is locked out by mistake.

Conclusion: introduce MFA in a planned way, not overnight

MFA offers businesses of any size a very good ratio of effort to effect, and the NIS2 directive explicitly lists it among its risk management measures. If you would like support, Q-entra sets up MFA as part of cyber security and can look after the settings on an ongoing basis with managed security.