Multi-Factor Authentication for Businesses: A Practical Guide

• Security keys and passkeys. A physical key, or a passkey stored on a phone or computer. They resist phishing because they only work on the real sign-in site.
• Authenticator app with number matching. The phone shows a prompt and the user enters the number shown on the sign-in screen, which stops people from approving prompts they did not start.
• Authenticator app codes. A six-digit code that changes every 30 seconds. Better than text messages, but a code can still be typed into a fake site.
• Text message or phone call codes. Better than a password alone, but codes can be intercepted or redirected if a phone number is taken over. Use them only where nothing stronger is available.

• Email and Microsoft 365 or Google Workspace for every user.
• Administrator accounts, with phishing-resistant methods where possible.
• Remote access, such as VPN and remote desktop tools.
• Banking, payroll and payment systems.
• Business and cloud applications that hold customer or financial data.
• Your domain registrar, website and other accounts that could be used to impersonate your business.

1. List your accounts and systems. Include shared mailboxes, service accounts and older applications that may not support MFA.
2. Choose the methods. An authenticator app with number matching for most users; security keys or passkeys for administrators.
3. Tell employees what is coming. Explain why, when and how to set it up, and who to call for help.
4. Turn it on in stages. Start with administrators and a pilot group, then the rest of the company.
5. Block sign-ins that skip MFA. Turn off older sign-in methods that cannot ask for a second factor.
6. Plan for lost phones. Decide how a user proves who they are before MFA is reset, so a caller cannot talk their way in.

Prompt fatigue. Attackers who have a password sometimes send repeated approval requests, hoping someone taps approve. Number matching, and employees who report prompts they did not expect, reduce that risk.

Exceptions that never close. Accounts excluded during a rollout are often forgotten. Review exclusions regularly and remove them when they are no longer needed.

Help desk resets. Reset MFA only after confirming who is calling, for example with a call back to a known number.

TechStarters manages Microsoft 365 sign-in security as part of our managed IT services, including multi-factor authentication and conditional access, and our 24/7 help desk helps employees set up and reset MFA. See our Microsoft 365 security checklist for the related settings.

Every engagement starts with a free IT assessment and a written proposal; see how managed IT pricing works. We support businesses nationwide from offices in New Jersey, Pennsylvania, Delaware and New York.