Stolen passwords are behind a large share of business email compromises. Multi-factor authentication (MFA), a second check such as an app notification, stops most of those attacks cold. Yet many businesses delay it because they expect complaints. With a little planning, the rollout can be almost painless.
Choose the right method
- Authenticator app with number matching is the best everyday option. Users type a number shown on screen into the app, which prevents accidental approvals.
- Text-message codes are better than nothing, but they can be intercepted and should be a fallback, not the default.
- Passkeys or security keys are phishing-resistant and ideal for administrators and finance staff.
Roll it out in stages
- Start with admins and leadership. These accounts are the most valuable targets.
- Announce it a week ahead. Explain why, what will change, and how long setup takes, usually about five minutes.
- Enroll department by department, with someone available to help in real time.
- Enforce it everywhere once everyone is enrolled, including email on phones and remote access.
Reduce the prompts
MFA fatigue is real. In Microsoft 365, Conditional Access policies can require MFA based on risk: for example, prompting less often on company-managed devices in the office and more often from unfamiliar locations. Users get fewer interruptions while security actually improves.
Plan for lost phones
Decide in advance how someone regains access if their phone is lost or replaced, and make sure that process verifies identity. Attackers frequently call help desks pretending to be employees who “got a new phone.”