MFA Implementation Guide

MFA Implementation Guide

Photo by Jakub Zerdzicki on Pexels

Now that you understand how MFA works, let's implement it across your small business. This step-by-step guide covers the most common platforms and includes free tool recommendations.

Phase 1: Protect Your Most Critical Accounts First

Not all accounts are equal. Prioritize in this order:

1. Email administrator accounts: If an attacker compromises your admin email, they can reset passwords for every other service. Start here.
2. Cloud service admin (Microsoft 365, Google Workspace): These are your identity providers—protecting them protects everything else.
3. Financial accounts: Banking, accounting software, payment processors.
4. Remote access: VPN, RDP, remote management tools.
5. All employee accounts: Enforce MFA company-wide.

Phase 2: Enable MFA on Microsoft 365 (Most Common Small Business Platform)

1. Sign in to the Microsoft 365 admin center (admin.microsoft.com)
2. Go to Users > Active Users
3. Click "Multi-factor authentication" in the top bar
4. Select all users and enable MFA
5. Configure "Conditional Access" to require MFA for all sign-ins (requires Azure AD P1, included in Microsoft 365 Business Premium)
6. Users will be prompted to set up MFA on their next sign-in—direct them to install Microsoft Authenticator app
7. For admin accounts, additionally require hardware security keys via the Azure AD portal

Phase 3: Enable MFA on Google Workspace

1. Sign in to admin.google.com
2. Go to Security > Authentication > 2-Step Verification
3. Select "Enforce 2-Step Verification for all users"
4. Set a grace period of 1-2 weeks for users to enroll
5. Users enroll at myaccount.google.com/security
6. For admin accounts, enable security key enforcement

Phase 4: Free MFA Options for Other Services

For services that don't have built-in MFA management, use these free tools:

• Microsoft Authenticator (Free): Works with Microsoft accounts and any TOTP-compatible service. Generates codes offline. Available on iOS and Android.
• Google Authenticator (Free): Simple TOTP code generator. Works with almost any service that supports MFA. Available on iOS and Android.
• Authy (Free): Like Google Authenticator but with cloud backup and multi-device support. Good for users who switch between phone and tablet.
• 2FAS (Free, Open Source): Privacy-focused authenticator with browser extension support. No account required.

Phase 5: Handle MFA for Shared Accounts

Shared accounts (like a company social media account) present a unique challenge: multiple people need to access one account, but MFA is tied to one phone. Solutions:

• Use a password manager that supports shared TOTP codes (Bitwarden, 1Password)
• Register the MFA to a shared phone or tablet kept in the office
• Use a service like Twilio Authy that allows multiple devices

Phase 6: Backup and Recovery

If an employee loses their phone, they're locked out. Plan for this:

• Generate and securely store backup codes when setting up MFA (print and keep in a safe)
• Designate an MFA admin who can reset MFA for locked-out users
• For hardware keys, have a spare key stored securely as a backup
• Document the MFA recovery process in your IT policies

Key Takeaways

• Start with admin and email accounts—they're the highest value targets
• Microsoft 365 and Google Workspace have built-in MFA management—use it
• Free authenticator apps (Microsoft Authenticator, Google Authenticator) are sufficient for most needs
• Plan for MFA recovery—backup codes and admin reset procedures prevent lockouts
• Enforce MFA company-wide within 2-4 weeks of starting rollout

Access Control Models: From Basic to Advanced

Access control determines who can access what resources and what actions they can perform. The three primary models are: Discretionary Access Control (DAC), where resource owners decide who gets access; Mandatory Access Control (MAC), where a central authority defines access based on security classifications; and Role-Based Access Control (RBAC), where access is granted based on job roles. Most businesses use RBAC — it balances security with manageability by grouping permissions into roles like 'Sales Rep,' 'Accountant,' or 'IT Admin.'

Implementing RBAC starts with role definition. List every job function in your organization and the systems they need access to. For example: 'Sales Rep' needs access to CRM (read/write customers), email (internal/external), and inventory (read-only). 'Sales Manager' adds access to reports, forecasts, and team configuration. Document these role definitions in an access matrix — a spreadsheet showing which roles have access to which systems and at what permission level. Free tools like Apache Guacamole provide a web-based gateway for managing access to internal systems, while Keycloak offers open-source identity and access management with built-in RBAC support.

The principle of least privilege (PoLP) should guide all access control decisions. Give users the minimum access needed to perform their job — nothing more. A common mistake is giving all employees local administrator rights on their computers to avoid support calls. Instead, use standard user accounts with controlled elevation: on Windows, User Account Control (UAC) prompts for admin credentials when needed; on macOS, users can be given standard accounts with specific applications whitelisted for admin access; on Linux, sudo rules limit which commands can be run with elevated privileges. Review access rights quarterly and remove any that are no longer needed — especially after role changes, promotions, or department transfers.

Common Questions

Q: How often should I review access rights?

At minimum, conduct a quarterly access review. For high-security environments, review monthly. Create a report listing all users and their access rights, and have department managers verify that each user's access is still appropriate. Remove any access that's no longer needed. This process catches orphaned accounts (employees who changed roles but kept old access), dormant accounts (accounts that haven't been used in 30+ days), and excessive permissions that accumulated over time.