Multi-factor authentication (MFA) is one of the most effective controls available to a small business for protecting email accounts. It requires a second form of verification — beyond just a password — before a login is accepted. Even if an attacker has a correct username and password, they cannot access the account without also having the second factor. For business email specifically, where the stakes of compromise include invoice fraud, data theft, and client harm, enabling MFA is a fundamental step.
Prioritise owners, admins, and finance
Not all email accounts carry the same risk if compromised. The highest priority accounts for MFA rollout are those with the most access and the most sensitive correspondence: business owners, administrators with access to billing and domain settings, finance staff who approve payments, and anyone with admin access to your email platform itself.
In Google Workspace, the admin console allows you to enforce MFA for all users or specific groups, and to monitor who has and has not enrolled. In Microsoft 365, Conditional Access policies can require MFA for specific user roles or when signing in from new devices or locations. Both platforms allow you to see a report of which accounts have MFA enabled, making it easy to identify gaps.
If you run a small team and managing MFA enforcement through a policy feels complex, start by enabling it on your own account and asking every person with billing or payment visibility to do the same. Personal account-level MFA is better than none while you work toward a platform-wide rollout.
Authenticator apps versus SMS
MFA can be delivered via SMS (a one-time code sent to a mobile phone), via an authenticator app (which generates a time-based code locally on the device), or via a hardware security key. SMS is the most familiar option and significantly better than no MFA at all, but it is the weakest of the three because phone numbers can be ported to a new SIM by an attacker — a technique known as SIM swapping.
Authenticator apps like Google Authenticator, Microsoft Authenticator, or Authy generate codes locally without any network dependency. They are harder to intercept than SMS codes and are the recommended option for business use. Setup takes about five minutes per account: scan a QR code in the account's security settings, and the app begins generating codes.
Hardware security keys (such as YubiKey) are the most secure option and are worth considering for accounts with the highest privilege — admins and finance. They require physical possession of the key to authenticate, making remote account takeover essentially impossible even with a correct password. Keys are available for under $100 and work with Google, Microsoft, and most major platforms.
Recovery planning before rollout
The most common reason businesses delay MFA rollout is fear of lockout — what happens if someone loses their phone or cannot receive a code? Planning recovery options before rollout prevents this from becoming a crisis. Both Google Workspace and Microsoft 365 provide administrator recovery tools for MFA-enrolled accounts. Generate and securely store backup codes for each account. Keep at least one recovery email or backup phone number on file for each user.
- Enable MFA immediately on all owner, admin, and finance email accounts.
- Use an authenticator app (Google Authenticator, Microsoft Authenticator, Authy) rather than SMS where possible.
- Generate and store backup codes before completing rollout — keep them in a secure location separate from the device.
- Use your email platform's admin console to view MFA enrollment status across all accounts.
- For the highest-risk accounts, consider hardware security keys as an upgrade from app-based MFA.
- Review MFA enrollment after any staff change — offboarding should include verifying the account is disabled, not just the MFA.
Multi-factor authentication is one of the highest-value controls for email accounts.
Check email login security