If one security control is worth the money above all others, it's multi-factor authentication, usually shortened to MFA. It means a leaked password isn't enough on its own to get into an account. A second step, a code or a tap on your phone, has to clear too. Passwords leak all the time, through phishing and through breaches at companies you've never heard of, so that second step defeats the most common attack a small business sees.
Rollouts still turn into weeks of complaints, and almost every time the cause is a setup choice that can be changed. I want to walk through the choices that cause the trouble, because they're all avoidable.
Constant prompts are a configuration problem
The complaint I hear most is that it asks me every single time. It doesn't have to. A setup done well remembers the devices you trust, so the office computer someone uses every day rarely asks, while a sign-in from a new device or an unexpected country asks every time.
That's the point: more friction for an attacker and less for the person at their own desk. In my experience, if your prompts never let up, someone picked the strictest settings, or nobody picked at all and the cautious defaults took over. Either way I can usually fix it in an afternoon, and fixing it wins over most of the people who were complaining.
Constant prompting is also a security problem. People who approve a prompt several times a day will eventually approve one they shouldn't. Attackers count on that. They fire off prompt after prompt late at night, hoping someone taps approve to make it stop.
Number matching, where the screen shows digits you type into the app, closed most of that gap. Fewer, smarter prompts close the rest.
Staff who don't want MFA on a personal phone
Some staff don't want a work app on a personal phone, and that's a fair thing to raise. I'd have the answers ready before it turns into a policy fight. The authenticator app tells the employer nothing about the phone and can't track anyone, and saying that clearly and early heads off most of the worry.
For anyone still unwilling, a hardware security key works with no phone at all and happens to be the most phishing-resistant option there is, so I treat those holdouts as a chance to pilot the best method. Text-message codes are the last resort. They beat nothing and they're weaker than the alternatives, so I use them only as a temporary bridge.
No MFA exceptions for leadership
The most dangerous rollout is the one that quietly exempts the people who found it inconvenient. Those exemptions gather at the top of the org chart, where the access is broadest and the email is worth the most to steal. Attackers know who tends to get exempted, and that's exactly who they aim at.
The same goes for shared accounts and service accounts, including the one login for the old system everyone uses. The accounts nobody wants to deal with are the ones that need this most, and there's a known, workable pattern for every awkward case.
How to roll out MFA
The order of operations matters more than the technology:
- Set up trusted devices and sensible policies before the first person is enrolled, so nobody meets the bad version
- Enroll a friendly pilot group first and let them grumble at us instead of you
- Give everyone the personal-phone answer before they have to ask
- Enroll the rest in small waves, with someone reachable while it is still fresh
- Take the exceptions list down to zero, politely and completely
Done in that order, the whole thing is a few quiet weeks, which is what a security project should feel like.
Our cybersecurity services include this as standard work, and it pairs naturally with a Microsoft 365 review, where the licenses you already pay for usually cover the tools. If MFA has been on your list for a while, schedule a call and I'll tell you what the rollout would look like in your setup.