How to Roll Out MFA Across Your Business

Multi-factor authentication is the highest-value security control available to a small business, and most businesses that "have MFA" have it on maybe 70% of their accounts. The remaining 30% is where the incidents come from. Here's how to do the rollout properly.

Why this one control matters so much

Password theft is not a hypothetical. Credentials leak constantly through breaches at other companies, and because people reuse passwords, a breach at an unrelated website hands attackers a working login for your business. Attackers don't need to crack anything — they buy lists and try them.

MFA breaks that entire economic model. A password on its own stops being enough, and the automated credential-stuffing that drives most account takeovers simply fails. There is no other control you can deploy in a week that changes your risk profile this much.

Step 1: Inventory everything that accepts a login

This is the step everyone skips, and it's the reason most rollouts leave holes. Before enabling anything, list every system that authenticates a user. Not just the obvious ones.

Attackers specifically probe for the exceptions. An MFA rollout with a documented exemption list is fine; one with an undocumented, forgotten exemption list is how businesses get compromised while believing they're protected.

Step 2: Pick the right second factor

Not all MFA is equal, and the differences now matter in practice.

• SMS codes — weakest, still better than nothing. Vulnerable to SIM swapping, where an attacker convinces a carrier to move a number to their device. Use it only where nothing better is offered.
• Authenticator app codes — solid baseline. Microsoft Authenticator, Google Authenticator, or similar. No carrier involvement, works offline.
• Push with number matching — the practical sweet spot. Plain push approval created "MFA fatigue" attacks: spam someone with prompts at 3am until they tap approve to make it stop. Number matching, where you type a number shown on screen, kills that. If you're on Microsoft 365, this should be your default.
• Hardware security keys — strongest. A physical key (YubiKey or similar) is genuinely phishing-resistant: it cryptographically checks the site's identity, so a fake login page can't relay it. Worth the cost for administrators, finance staff, and anyone who can move money.

That last point matters more each year. Attacker toolkits now proxy the real Microsoft login page in real time and steal the resulting session token — which defeats app codes and push. Security keys and conditional access are what stop it.

Step 3: Close the back doors

Turning on MFA does nothing if there's a path around it. Two things to check on day one:

Block legacy authentication. Older mail protocols — POP, IMAP, SMTP AUTH, and older Office clients — can't present an MFA challenge, so they bypass it entirely. If legacy auth is enabled in your tenant, an attacker with a valid password walks straight past your rollout. Check sign-in logs for legacy auth first so you know what will break, then block it.

Add conditional access rules. Business Premium includes these. The useful starting set: require MFA for all users, block sign-ins from countries you don't operate in, require compliant or managed devices for administrators, and flag impossible-travel sign-ins. This is also where you enforce stricter rules for privileged accounts without making life miserable for everyone — the same logic behind the principle of least privilege.

Step 4: Roll it out without a revolt

The technical work takes an afternoon. Adoption is the hard part, and rollouts fail on people, not technology.

1. Start with IT and leadership. You'll find the surprises on people who can absorb them, and leadership having done it first removes the main objection.
2. Tell people why, once, in plain terms. "A stolen password stops being enough" lands better than a policy memo.
3. Enroll in person or on a call. Ten minutes each, with someone watching, prevents the week of tickets you'd otherwise get.
4. Roll out by department, not all at once. Fix what you learn from the first group before hitting the next.
5. Set expectations on frequency. Most people expect to authenticate constantly. On a managed device with sensible policies it's more like once every couple of weeks. Saying so up front removes most of the resistance.
6. Have a documented lockout path. Somebody will lose a phone in week one. Decide in advance how you verify identity before resetting — because "I lost my phone, reset my MFA" is also exactly what an attacker says.

Step 5: Verify, don't assume

A month in, pull the report of users without MFA registered. There will be some. There are always some — the person on leave during rollout, the account created afterward, the contractor. Make this a recurring check rather than a one-time project, and add "MFA enrolled" to your new-hire checklist so the gap doesn't reopen.

Common questions

Do we have to buy something for this?

Almost certainly not. MFA is included in every Microsoft 365 business plan, and conditional access comes with Business Premium. Most businesses we work with already own everything needed and just haven't configured it.

What about staff who refuse to use personal phones?

It's a reasonable objection and it has clean answers: a hardware security key (around $25–50 one-off), a desk phone voice call, or a company-provided device. Don't let this one become the reason the rollout stalls — it's a solved problem.

Is MFA enough on its own?

No, but it's the right first move. It needs current patching and tested backups behind it — see our security baseline for how the pieces fit together.