Rolling out MFA in a 15-person SME: a step-by-step plan without the hassle
Two-step verification is the measure that removes the most risk for the least effort. Which form to choose, in what order to roll it out, which mistakes to avoid and how much time it realistically takes for a team of fifteen.
Ian
Co-Founder & CEO
If we could pick one measure at an SME that removes the most risk for the least effort, it would be two-step verification, usually shortened to MFA. Yet many business owners put it off for fear of hassle: employees complaining, people locked out, a week of lost productivity. It does not have to be that way. With the right order, rolling out MFA in a team of fifteen is a matter of a few days. This is the step-by-step plan we use ourselves.
What MFA is, and why a password alone is no longer enough
MFA stands for multi-factor authentication. In plain language: to sign in you need something else besides your password, usually a code or an approval on your phone. Something you know (the password) plus something you have (your phone). Someone who only knows your password therefore does not get in.
And that is necessary, because passwords leak, even when your employees are not careless.
- After a data breach at some random web shop, your employee's password ends up on a list that is tried automatically against Microsoft 365 and Google Workspace.
- A phishing email that looks just real enough catches a password in every team sooner or later.
- A business owner is an attractive target: whoever sits in their mailbox can redirect invoices and send colleagues instructions.
With MFA, a leaked password becomes an annoying incident instead of a break-in. A password manager for your team takes care of unique passwords, MFA catches what leaks anyway. Together they form the foundation.
Which form of MFA do you choose?
Not every form is equally strong. In practice, three come into consideration.
- An authenticator app on the smartphone (Microsoft Authenticator, Google Authenticator or a similar app). This is our default choice: free, works without mobile coverage and cannot be intercepted the way SMS can.
- A code via SMS. Better than nothing, but text messages can be intercepted or redirected via your SIM card. Only as an interim step or for people without a smartphone.
- A hardware key, a small USB or NFC key. The strongest option, and a sensible extra for administrator accounts and the business owner. For the rest of the team the app is more than enough.
With the app, go for number matching, where you type a number from the sign-in screen instead of tapping 'approve'. That way nobody accidentally approves an attacker's sign-in.
The step-by-step plan, in this order
The order matters. Anyone who starts with the whole team at once without preparation gets exactly the chaos everyone is afraid of.
- Inventory your accounts. Email and collaboration (Microsoft 365 or Google Workspace), your accounting package, the bank, your CRM and the company's social media. Note per service who has access.
- Start with the administrator accounts, the accounts that can do everything. Preferably with a hardware key as a second method.
- Then put MFA on everyone's email. Email is the key to all other accounts, because whoever has the mailbox can click 'forgot password' everywhere.
- Communicate to the team with a date. A short email: what changes, why, what to do beforehand (install the app) and when it takes effect. Give a week.
- Roll out per employee, preferably with someone alongside: ten minutes per person, at their own desk.
- Keep the back-up codes. Every service provides recovery codes for when the phone is lost. Put them in the password manager, not in an email or on a note.
- Sort out the exceptions. Shared mailboxes like info@ no longer get their own password, people get access through their own account. A scanner that sends email gets a separate app password.
- Do a check after two weeks. Is MFA on for everyone? Were any accounts forgotten? Are there temporary exceptions still open?
Common mistakes
The rollout itself usually goes smoothly. The problems come afterwards, when attention slips.
- Leaving exceptions in place. 'Just switch it off for John, he is travelling' is months later still an account without MFA. Put an end date on every exception.
- Leaving old sign-in protocols open. In Microsoft 365, outdated ways of signing in can bypass MFA entirely if they are not disabled. Ask your IT partner to block 'legacy authentication'.
- No recovery procedure for someone who loses their phone or gets a new one. Then MFA gets switched off 'for a moment' to help quickly, and that is exactly what an attacker on the phone asks for too.
- Securing only email and forgetting the bank, the accounting or the social media.
- No agreement on who may reset MFA and how that person verifies it really is the right colleague.
How much time does it take for a team of fifteen?
An honest estimate, without precise promises, because every company has its quirks.
- Preparation: half a day for the inventory, the administrator accounts, the communication and the exceptions.
- Rollout: about ten minutes per employee if someone helps. For fifteen people that is two to three hours, spread over a few days.
- Aftercare: an hour after two weeks for the check, and after that the occasional question from someone with a new phone.
Count on roughly a working week of lead time and a day of actual work. The support questions afterwards are almost always the same: a new or lost phone, or someone who deleted the app. With a short procedure you are done in five minutes.
Want MFA rolled out without it eating your own time, with the exceptions and old protocols set right at the same time? As IT partner for your SME we do it together with your team, right the first time.