Rolling out MFA without a revolt: a playbook for small teams
Multi-factor authentication is the highest-value control most small businesses can add. Here is how to roll it out without drowning in support tickets.
1 min read
Multi-factor authentication (MFA) blocks the large majority of account-takeover attacks. Yet many small businesses still have gaps, usually because a past rollout created friction and was quietly abandoned.
Start with an inventory#
Before you change anything, list every system that holds business data or can reach it: email, file storage, finance tools, the website admin panel, domain registrar, and remote-access tools. The registrar and DNS host are the ones most often forgotten.
Choose the right factor#
Not all second factors are equal:
| Factor | Phishing-resistant | Notes |
|---|---|---|
| Passkeys / FIDO2 keys | Yes | Best option where supported |
| Authenticator app (push with number matching) | Partly | Good default for most users |
| SMS codes | No | Better than nothing; avoid for admins |
Communicate before you enforce#
Announce the change two weeks ahead, explain why in one paragraph, and offer short drop-in sessions. Then enforce in waves: admins first, then finance, then everyone else.
Plan for lost devices#
Write down the recovery process before day one. Who can reset a factor, how they verify the person’s identity, and how fast. That one page prevents most of the frustration.