MFA in a small company — where to start and what not to switch on

Multi-factor authentication stops the most common account-takeover scenario: somebody obtained a password — from a breach, from phishing, from a sticky note — and tries to log in. The password alone stops being enough.

The difficulty is not in the configuration. It is in the order, and in four decisions that have to be taken before you switch anything on. Skipping them usually ends the same way: the first awkward case leads to MFA being disabled for the whole company, which is back to the start with added ill will.

The order that works

1. Administrative accounts — today, no discussion needed

There are a handful of administrative accounts and you manage them. This needs no conversation with the team, no training and no announcement.

They are also the accounts whose compromise costs most. If you were to do one thing from this note, do this one.

2. Management and finance

The most frequent target of targeted phishing, and the place where a compromised account translates directly into money — fake payment instructions coming from a real mailbox work precisely because they are real.

This is the group that most often asks for an exception. An exception here is the worst idea available.

3. Access from outside the company network

VPN, mail on phones, admin panels reachable from the internet.

4. The rest of the company

Only now, once the process has been tested on smaller groups and you know the answers to the questions that will come.

Four decisions before switching on

What we do when somebody loses their phone

This question decides whether the whole rollout succeeds. There has to be a known way of restoring access that can be carried out in reasonable time and that is not itself a hole.

In practice: every user has at least a second method registered, and you have a procedure for an emergency reset with identity confirmed by something other than email. Printed backup codes kept somewhere safe work better in small companies than anything more elaborate.

Who is an exception — and why nobody is

Pressure for exceptions will appear immediately. Settle in advance that there are none, because the first exception becomes a precedent within the same week.

If somebody genuinely cannot use a phone, the answer is a hardware key, not exemption from MFA.

How often it should ask

MFA that prompts at every login on the same company computer will be hated within a week. MFA that never prompts protects nothing.

A sensible arrangement: remembering the device for two to four weeks when access comes from a known place and machine, while always prompting on a new device, from a new location, and for access to anything sensitive.

What about legacy protocols

The most common disappointment: MFA switched on and the account compromised anyway — because the login went through an old mail protocol that does not support two-factor authentication and simply bypasses it.

Switching on MFA without blocking legacy authentication gives the illusion of protection. Check whether such logins still occur before you block them — sometimes an old printer or an invoicing system is using them.

Choosing a method, best first

1. Hardware key — the most effective, because it resists phishing: it cannot be “given away” on a spoofed page. Worth it for administrative accounts and management.
2. An app with number matching — good and convenient. The version showing a number on the login screen is meaningfully better than a plain “approve”, because it eliminates reflexive approval.
3. An app with one-time codes — good, works without internet.
4. SMS — better than nothing, but the weakest: vulnerable to number porting and readable on a lock screen. Treat it as a fallback, not the primary method.

What to expect

The first week: questions and a few people needing to register again. The second week: quiet. After a month nobody notices it.

The biggest resistance usually comes not from MFA itself but from the feeling that it was introduced without warning. An announcement a week ahead, with one paragraph of explanation and a specific date, removes most of the problem — more cheaply than any tool.