One free setting stops 99% of account takeovers. Most small businesses still haven't turned it on. Here's everything you need to know — and exactly how to fix that.
If I had to pick one security improvement every small business should make this week — just one — it would be enabling multi-factor authentication on every business account. Not a firewall upgrade. Not a new antivirus. Not a security awareness training program. MFA first, everything else second.
Microsoft has been collecting data on this for years, and the number they consistently land on is striking: MFA blocks over 99% of account compromise attacks. One setting. More than 99% of the most common attack type stopped cold. That's not a vendor claim — it lines up with what we see on the ground helping small businesses recover from breaches. Almost every compromised email account we've dealt with had one thing in common: no MFA.
And yet most small businesses we talk to for the first time either don't have it turned on, have it set up for only some accounts, or have it configured in a way that's weaker than it should be. Let's fix that. This post explains what MFA actually is, why the threat is real, and how to roll it out — specifically in Microsoft 365 — without making your team hate you.
You already understand MFA. You use it every time you log into your bank and they send a code to your phone. That's it. That's the concept.
The idea is that instead of proving who you are with just one thing — your password — you prove it with two. Something you know (your password) and something you have (your phone, a hardware key, an authenticator app). An attacker might steal your password, but they almost certainly don't have your phone too.
That's the whole thing. The math is simple: a stolen password alone gets an attacker nowhere if they also need a six-digit code that changes every 30 seconds and lives on a device that's physically in your pocket.
You'll hear it called a few things — MFA (multi-factor authentication), 2FA (two-factor authentication), two-step verification. They all mean the same basic concept. For our purposes, we'll use MFA throughout.
Not all MFA is created equal. From least to most secure:
SMS text codes are the most common and the most familiar. Your bank sends a six-digit code to your phone. It works, it's better than nothing, but it has weaknesses — SIM-swapping attacks can redirect your texts to an attacker's phone, and it's slow when you're trying to log in quickly. Still, SMS MFA is vastly better than no MFA. Don't let perfect be the enemy of good.
Authenticator apps are what we recommend. Apps like Microsoft Authenticator, Google Authenticator, or Authy run on your phone and generate time-based codes that change every 30 seconds — even when you have no cell signal. They're faster than SMS, more secure, and free. For business use, Microsoft Authenticator integrates nicely with Microsoft 365 and supports push notifications: you get a tap-to-approve prompt instead of typing a code. Most people actually prefer it once they're used to it.
Hardware security keys (like a YubiKey) are physical USB or NFC devices. You plug them in or tap them to your phone. This is the gold standard — essentially unphishable. We recommend them for high-privilege accounts like IT administrators and executives. For regular employees, an authenticator app hits the sweet spot of security and convenience.
Here's what a lot of small business owners don't realize: your employees' passwords are probably already out there. Not because your systems were hacked — because other companies' systems were hacked. LinkedIn, Adobe, Dropbox, LastPass, a dozen healthcare companies, a dozen retailers. Billions of username and password combinations from breached websites circulate on the dark web, available for pennies per record.
Attackers use those lists in something called credential stuffing: automated tools that try the same email and password combinations against Microsoft 365, Google Workspace, banking portals, and any other login they can reach. They run thousands of attempts per minute. If your employee used the same password for their LinkedIn account as they do for their work email — and a huge percentage of people do, despite knowing better — attackers will eventually find that match.
And they're not sending you a ransom note when they get in. The good ones are quiet. They set up email forwarding rules to BCC themselves on every email. They watch your conversations. They learn your billing relationships, your payment processes, your vendors. Then, when the moment is right, they impersonate you or your vendor and instruct someone to wire money to a new bank account. This is called Business Email Compromise, and the FBI's latest numbers put losses in the billions annually.
With MFA enabled, none of that matters. The attacker might have a valid password. They still can't get in without the second factor. They move on to an easier target.
Passwords have a fundamental problem: they're static secrets that can be stolen, guessed, phished, or leaked without you ever knowing. MFA adds a layer that changes constantly and requires physical possession of something the attacker doesn't have. That's why the number holds up at 99%.
Most small businesses run Microsoft 365 for email, so let's get specific. Microsoft has actually made it pretty easy to turn on MFA for your whole organization. Here's what you need to know.
If you haven't done anything with MFA yet, Microsoft may have already turned on something called Security Defaults for your tenant. This is a bundle of basic security settings that includes requiring MFA for all users. Check if it's enabled by going to the Azure Active Directory admin center under Properties > Manage Security Defaults.
Security Defaults is a good starting point for very small organizations, but it has limitations: you can't customize which accounts are excluded or what methods are allowed. If you have more than a handful of users, you'll want to move to Conditional Access policies instead.
Conditional Access is available on Microsoft 365 Business Premium and higher tiers (another reason we recommend Business Premium for most small businesses — see our post on M365 settings most businesses get wrong). It lets you create policies like "require MFA for all users except the emergency admin account" or "require MFA when logging in from outside the office network."
The most important Conditional Access policy to create is simple: require MFA for all users, for all apps. Go to the Microsoft Entra admin center (formerly Azure AD), navigate to Protection > Conditional Access, and create a new policy targeting all users and all cloud apps, requiring multi-factor authentication under Grant controls.
A few things to do before you flip that switch:
Some older applications — especially email clients like Outlook 2013 or anything that connects to Exchange using basic authentication — don't support MFA. Those apps will stop working when you enforce it. Microsoft has been deprecating basic authentication for years, so this is increasingly rare, but it's worth auditing your environment before you flip the switch. If you're running Office apps that are more than a few years old, now's a good time to update them.
Here's the honest truth: you're going to get some pushback. "It's annoying." "It slows me down." "I forget my phone sometimes." These are real objections, and they deserve real answers.
The "it's annoying" problem is mostly about the authentication method. If you're using SMS codes, it is a little annoying. Switch people to the Microsoft Authenticator app with push notifications — they get a tap-to-approve prompt instead of a code, and it takes about three seconds. Most people stop complaining within a week.
The "I forget my phone" problem is rarer than people expect, because most employees' phones are basically attached to them. But it does happen. Have a backup plan: a recovery code or a secondary authentication method registered on their account. Don't leave people stranded — define the process for what happens when someone genuinely can't authenticate before someone needs it.
The "it slows me down" problem largely goes away with Conditional Access. You can configure policies to remember MFA on trusted devices for a set number of days (we usually recommend 7-14 days for business devices). Once someone's logged in on their work laptop and approved the MFA prompt, they won't be asked again until that period expires or they switch networks. The friction drops to near zero for day-to-day work.
The framing matters too. Don't position MFA as "IT is making you do this." Position it as "we're protecting your accounts and your work." Most employees don't want to be the one whose account got compromised and caused a business problem. When you explain what's at stake in plain terms, the vast majority get on board.
Email is the highest priority, but it's not the only place you need MFA. Think about every account that has access to sensitive business data, money, or the ability to cause serious damage if compromised:
If you're not sure where all your business accounts are, a password manager is the right tool for that problem. It gives you a complete inventory of every account, which makes auditing MFA enrollment much easier.
Enabling MFA everywhere sounds like a lot of work, but most of it is a one-time setup. And compared to the average cost of recovering from a compromised email account — which regularly runs into tens of thousands of dollars when you factor in forensics, legal notification, lost business, and the staff hours to clean it up — a few hours of setup is an extraordinarily good investment.
We've been in this business for 30+ years, and we've watched the threat landscape change dramatically. Firewalls, antivirus, training — all of it matters. But no single control has a better return on investment than MFA. It's free or close to it, the technology is mature, and the protection it provides is measurable and massive.
If your Microsoft 365 environment doesn't have MFA enforced for all users right now, that's the single highest-priority security task on your list. Not next quarter. This week.
If you need help configuring it correctly — setting up Conditional Access, migrating away from Security Defaults, training your team, or auditing which other accounts still need it — that's exactly the kind of thing we do. It usually takes a few hours, and the peace of mind is well worth it. Check out our Cybersecurity Essentials guide for more on building a complete security foundation, or see what we do if you want a hand getting this done right.