Turn On Multifactor Authentication for Your Business Email

Your business email is the key to almost everything else: password resets for your bank, your accounting software, your website, and your customer records all land there. If someone gets into it, they can get into the rest.

Multifactor authentication (MFA) means a stolen password is no longer enough. After entering the password, you also confirm it is really you with something you have, usually your phone. Government guidance from CISA and the FTC lists it among the most effective steps a small business can take.

Which kind to choose

• Best: passkeys or a physical security key. These resist phishing because there is no code to trick you into typing on a fake site.
• Good: an authenticator app that shows a code or asks you to approve the sign-in.
• Better than nothing: a code sent by text message. Use it if it is the only option, but move to an app when you can.

Where to switch it on

Most business email runs on Google Workspace or Microsoft 365. Both support MFA for every user, and the administrator can require it for the whole business rather than leaving it to each person.

• Google Workspace: in the Admin console, open the Security settings for 2-Step Verification, allow it, then set a date to enforce it for everyone.
• Microsoft 365: in the Microsoft Entra admin center, turn on security defaults, which require MFA registration for all users. Larger setups may use Conditional Access instead.
• Personal or single-user accounts: open your account's security settings and look for 2-step verification or passkeys.

Menus change from time to time, so if a setting has moved, search your provider's help pages for "turn on multifactor authentication for all users."

Do it in this order

1. Email first, for every person in the business.
2. Then banking and payment accounts.
3. Then accounting, payroll, and the tools that hold customer data.
4. Print or securely store the backup codes each service gives you, so a lost phone does not lock you out.