What is MFA? A plain guide to multi-factor authentication: how it works, why it stops most account hacks, and how to turn it on across your business.
MFA, or multi-factor authentication, is a security step that asks for a second proof of identity on top of your password, usually a code from your phone or a tap in an app. It matters because a password alone can be stolen or guessed, but a criminal on the other side of the world almost never has your phone too. Turning it on is the single most effective thing most businesses can do to protect their accounts.
If you have ever been sent a code by text to log in to your bank, you have already used MFA. The good news is you can switch it on across your business accounts, and in most cases it is free.
How does MFA work?
MFA combines two of three things: something you know (your password), something you have (your phone or a security key), and something you are (a fingerprint or face). When you log in, you enter your password and then approve a second prompt. Even if someone has your password, they are stopped at that second step.
Note: The second factor works best on a different device from the one you type your password on, which is why a phone prompt beats a code saved on the same laptop.
Why does my business actually need it?
Because stolen passwords are behind a huge share of business breaches, and MFA neutralises them. Microsoft has reported that MFA blocks the overwhelming majority of account-compromise attacks. For the effort of a few minutes per person, it removes one of the most common ways businesses get hacked.
It is especially important for email. If a criminal gets into your email, they can reset other passwords, read sensitive messages, and send fake invoices to your clients from your real address. That is how many phishing chains turn into real losses.
Warning: Your inbox is the highest-value target, because whoever controls it can trigger password resets on almost every other account you own.
What are the different types of MFA?
The most common types are app-based, text-based and hardware keys, and they are not all equally secure. An authenticator app is the sweet spot for most small businesses: free, quick, and much safer than text messages.
Best practice: Move admins and anyone who handles money or client data onto an authenticator app or hardware key first, since those accounts cause the most damage if breached.
| Type | How it works | Best for |
|---|---|---|
| Authenticator app | Approve a prompt or enter a rotating code | Most businesses (recommended) |
| Text message code | A code sent by SMS | Better than nothing, but least secure |
| Hardware key | A physical key you tap or plug in | High-risk accounts and admins |
How do I turn MFA on?
In Microsoft 365, an admin can enable MFA for everyone through security defaults or Conditional Access, then each person sets up an authenticator app once. If you use Microsoft 365, it is already included, so there is no extra cost to switch it on.
- Enable MFA at the account level (security defaults is the quick option).
- Have each staff member install an authenticator app.
- Prioritise admins and anyone with access to money or client data.
If you would like this set up properly across your business, it is part of a well-configured Microsoft 365 environment, and a core piece of the cyber security essentials.
The short version: MFA adds a second check beyond your password, blocks the large majority of account attacks, and is usually free to turn on, so there is no good reason to leave it off.
Frequently asked questions
What does MFA stand for?
Multi-factor authentication. It means proving who you are with more than one factor, typically your password plus a code or prompt on your phone.
Is MFA the same as 2FA?
Almost. Two-factor authentication (2FA) uses exactly two factors, while MFA means two or more. In everyday use the terms are used interchangeably.
Is MFA free?
Usually yes. If you use Microsoft 365 or Google Workspace, MFA is included at no extra cost, and free authenticator apps work with almost any account.
Is text-message MFA safe enough?
It is far better than no MFA, but SMS codes can be intercepted. An authenticator app is more secure and just as easy, so prefer that where you can.
What happens if a staff member loses their phone?
An admin can reset their MFA so they can set it up again on a new device. It is worth having a simple process for this before it happens.
Want MFA switched on across your business without the hassle? Take the free business health check and we will show you where you stand.