MFA for a ten-person office in one afternoon
Multi-factor authentication stops the majority of account takeovers. Everyone knows that. The reason small offices still don't have it is not ignorance; it's the fear of a revolt from staff, a locked-out owner, and a week of help-desk calls. Here is the order of operations that avoids all three.
Before you touch anything
- Pick the method. Use an authenticator app (Microsoft Authenticator, Google Authenticator, or the one built into your password manager) as the default. Avoid SMS codes except as a last-resort fallback: they're vulnerable to SIM swapping and phishing. If you handle sensitive data, consider hardware keys (FIDO2) for the owner and anyone with admin rights.
- Put a password manager in first. MFA on top of reused passwords is a seatbelt on a car with no brakes. Deploying the manager the same afternoon means people set up both at once and only have one new habit to learn.
- Create a break-glass admin account. One emergency administrator with a long random password stored offline, excluded from the MFA policy, monitored for any sign-in. This is what saves you when the owner drops their phone in the pool.
- Send a two-paragraph email the day before. What's happening, why (one sentence about the phishing wave hitting your industry), what they need to bring (their phone), and that someone will be in the room to help.
The afternoon
- 1:00 — Admins first. Owner and anyone with admin rights enrol, with the strongest method. Test sign-in, test recovery codes, store the codes in the password manager.
- 1:30 — Turn it on in report-only mode. In Microsoft 365, a conditional-access policy in report-only shows who would be blocked without blocking anyone. Google Workspace has an equivalent enrolment period. Fix the surprises now: the shared mailbox someone signs into directly, the scanner that emails via an account, the old phone with a cached password.
- 2:00 — Enrol everyone else, in the room. Ten people, ten minutes each at most, in parallel. The questions are always the same: "which app", "what if I get a new phone", "do I have to do this every time". Answers: this one, we'll move it with you, no — once per device, roughly every few weeks.
- 3:30 — Enforce. Switch the policy from report-only to on. Watch the sign-in log for the next hour.
- 4:00 — The exceptions list. Service accounts, shared mailboxes and devices that can't do MFA get documented, locked down another way (app passwords with scoped permissions, IP restrictions, or replaced), and reviewed quarterly. Write the list down; undocumented exceptions become next year's breach.
What to say when someone objects
"It's a hassle" — it adds about four seconds, once per device, every few weeks. The alternative hassle is explaining to clients why their files were leaked from your account. "I don't want work on my personal phone" — the authenticator app stores no company data and needs no management; if that's still a no, a $25 hardware key on their keyring works fine.
Don't stop at email
The afternoon covers your identity provider. Over the following weeks, extend it: the VPN, remote desktop gateways, the accounting system, the practice-management portal, the domain registrar, the backup console. Admin accounts on anything internet-facing should never be a single password again.
If you'd rather someone else ran the afternoon, it's the first week of every managed onboarding we do — and the single change that most reduces how often we hear from you in a crisis.