How to Set Up Multi-Factor Authentication for a Company

CISA's guidance for small and medium businesses lists the main options from most to least secure (CISA SMB guidance):

CISA calls phishing-resistant MFA "the gold standard" and says organizations "should make migrating to it a high priority effort." It also states that "the only widely available phishing-resistant authentication is FIDO/WebAuthn authentication," with support built into major browsers, operating systems and phones (CISA fact sheet). A less common alternative is MFA based on an enterprise public key infrastructure, such as smart cards, which CISA notes requires highly mature identity management.

The FIDO Alliance describes a passkey as a credential based on FIDO standards that can be stored on a phone or computer or in a hardware security key, and notes that passkeys are built on the FIDO2 specifications (FIDO Alliance).

A practical tiering for most companies:

• Administrators, executives, finance and anyone with production access: hardware security keys or device-bound passkeys.
• Everyone else: passkeys where the system supports them, otherwise an authenticator app with number matching.
• Text message codes: only for systems that support nothing better, and never as the recovery path for a stronger method.

CISA recommends that IT leaders prioritize by asking two questions (CISA fact sheet):

1. What resources do I want to protect from compromise? Attackers often target email, file servers and remote access to reach data, and identity systems that would let them create or take over accounts.
2. Which users are high-value targets? Every organization has a few accounts with extra access. CISA's examples are system administrators, attorneys with e-discovery rights to read staff email, and HR staff with personnel records.

CISA's small business page gives the same order in practical form: turn on MFA across email, file storage and remote access, start with admin accounts and employees who handle sensitive data, and confirm that all remote and privileged access requires it (CISA SMB guidance).

IS Decisions adds a point that is easy to miss: the value comes from protecting any account with access to critical data, not only privileged ones. Its example is the head of sales, whose account does not look privileged but has complete access to the customer database (IS Decisions).

A typical first-wave list:

• The identity provider or single sign-on system, since it guards everything behind it
• Email and calendar
• Cloud consoles, code hosting and the domain registrar
• Banking, payroll and payment platforms
• File storage and remote access

Trying to move everyone at once is the most common way rollouts stall. CISA suggests an initial phase for groups such as help desk staff and IT administrators, then expanding with lessons learned. It also recommends starting with services that already support phishing-resistant MFA, noting that "most hosted mail and SSO systems support FIDO" (CISA fact sheet).

A phased plan for a small or mid-sized company:

Communication matters as much as configuration. CISA's advice is that if users resist, security leaders should take the risk to senior leadership, who "are best positioned to manage cultural and communications challenges" (CISA fact sheet). Microsoft's deployment guide makes the same point from the IT side: inform users about upcoming changes and registration requirements before they hit a prompt (Microsoft Learn deployment guide).

Be careful with prompt frequency. Microsoft warns that asking for credentials too often can backfire, because users trained to enter credentials without thinking may hand them to a malicious prompt (Microsoft Learn deployment guide). Prompt when risk changes, such as an unfamiliar device, an unusual location or a sensitive action, and stay out of the way otherwise.

A dashboard that says "MFA enforced" can hide several ways around it. Zip Security's guide lists four common failure modes (Zip Security):

1. Legacy protocols. Older mail protocols such as IMAP, POP3 and SMTP AUTH authenticate before the identity provider can ask for a second factor. Block them unless a specific system truly needs them.
2. Exception lists that never expire. Temporary exclusions become permanent MFA-free paths. Give every exception an owner and an end date.
3. Service accounts. Automated accounts cannot answer a prompt, so they get excluded wholesale. Move them to workload identities or tightly scoped credentials. Microsoft's own rollout included identifying and migrating user-based automation to workload identities (Microsoft Learn on phishing-resistant MFA).
4. Apps outside single sign-on. An employee who signs up for a tool with a work email and a personal password creates an account your policy never sees. Keep an app inventory and bring tools under single sign-on or enforce MFA in each one.

Microsoft also recommends letting administrators control which methods are allowed at all, for example blocking the least secure methods such as SMS (Microsoft Learn deployment guide).

Every MFA rollout produces lost phones and forgotten keys within weeks. If recovery is weak, attackers will use recovery instead of the front door. Zip Security puts it directly: "Allowing SMS account recovery weakens even a phishing-resistant primary method" (Zip Security).

Build recovery in from day one:

• Two methods per person. Microsoft's deployment guide recommends enabling more than one MFA method so users have a backup if the primary one is unavailable (Microsoft Learn deployment guide). For security keys, issue two and store the second safely.
• Verified identity before reset. The help desk must confirm who is calling before resetting a factor, through a video call, a manager's confirmation or an in-person check. Attackers target help desks with convincing stories.
• Time-limited onboarding credentials. Microsoft's rollout used temporary access passes, which are time-bound credentials, for onboarding and recovery (Microsoft Learn on phishing-resistant MFA).
• Break-glass accounts. Keep one or two emergency administrator accounts protected by hardware keys stored offline, excluded from normal policies, monitored for any sign-in and tested on a schedule.

MFA coverage decays. Zip Security observes that people who just joined never complete enrollment, phone replacements break authenticator registrations and exception lists grow, and recommends monthly identity provider audits to find the gaps (Zip Security).

A monthly check takes under an hour:

1. Export the list of accounts without a registered second factor and chase each one.
2. Review every exception and service account for an owner and an end date.
3. Confirm legacy protocols are still blocked.
4. Compare the app inventory with what sits behind single sign-on.
5. Look at the share of sign-ins using phishing-resistant methods, which Microsoft lists as a metric for its own program (Microsoft Learn on phishing-resistant MFA).

Tie MFA into onboarding and offboarding. Microsoft describes embedding phishing-resistant MFA in onboarding, role changes and deactivation workflows, so a person's methods are issued and revoked with their account rather than as a separate task.