Multi-factor authentication setup for a small business takes roughly two weeks of real work, and the order matters more than the tool: administrators first, then a pilot group of five to ten people, then everyone else, with at least one break-glass account deliberately left out and its password locked in a safe. Use an authenticator app with number matching or hardware security keys, not text message codes, and pair it with conditional access so people are not challenged every hour on a company laptop they already signed into this morning.
That is the whole answer. The rest of this is why each piece is there and what goes wrong when you skip one.
What does multi-factor authentication actually stop?
MFA stops an attacker who has your password from using it. That is the entire job, and it is a bigger job than it sounds, because stolen passwords are how most small business email compromise starts.
The attacker does not guess. They buy a list, or they run credentials leaked from an unrelated breach against your Microsoft 365 tenant and wait for a reused password to land. Microsoft has published that MFA blocks more than 99.9 percent of automated account compromise attempts. Even discounting a vendor’s own number, the direction is not in dispute: password-only accounts are picked off at scale, and accounts with a second factor mostly are not.
What MFA does not stop is worth saying plainly. It does not stop malware already running on a laptop. It does not stop an employee wiring money because a convincing email told them to. It does not stop a session token stolen after a valid login. MFA closes one door, the most commonly kicked-in door, and you still need endpoint protection, email filtering and someone watching logs behind it.
Why are SMS text codes the weakest common method?
Because the phone number is not really yours. A SIM swap moves your number to an attacker’s device with a phone call to a carrier rep, and text messages follow the SIM, not the person. SMS codes are also readable from a lock screen and forwardable, and the whole exchange depends on a telecom network nobody in your company controls.
NIST has treated SMS as a restricted authenticator since the 2017 revision of SP 800-63B, meaning it is allowed but discouraged and expected to be phased out. CISA’s guidance ranks it the same way: better than nothing, worst of the real options.
Use SMS only as a stopgap for a specific person who genuinely cannot run an app, and write down when you are going to fix it.
App codes, push approval, or hardware keys?
Three tiers, and most small businesses should end up with two of them.
Authenticator app with push approval and number matching. Microsoft Authenticator, Cisco Duo, Google Authenticator. The user gets a prompt on their phone and taps to approve. This is the right default for the general staff population. It is free or close to it, people already have the phone, and enrollment takes about ninety seconds.
Time-based codes (TOTP) from an app. The rotating six-digit number. Slightly more friction than push, and useful as the fallback method for anyone whose phone cannot receive push.
Hardware security keys. Yubico YubiKeys and other FIDO2 keys are phishing-resistant in a way the other methods are not: the key checks the domain it is talking to, so a fake login page that perfectly copies your Microsoft sign-in screen gets nothing. Keys cost roughly $25 to $70 each and someone will lose one, which is why they are issued in pairs.
Our recommendation for a 40 to 150 person company: hardware keys for global administrators, finance, and anyone who can move money or change payroll. Authenticator app with number matching for everyone else. SMS for nobody, unless there is a documented exception.
What is MFA fatigue, and does number matching fix it?
MFA fatigue is an attacker with your password hitting the login button over and over at eleven at night until you approve a push notification just to make your phone stop buzzing. It has worked against companies far larger than yours.
Number matching largely fixes it. Instead of an approve button, the login screen shows a two-digit number and the phone asks you to type it in. You cannot approve a prompt you did not trigger, because you cannot see the number. Microsoft made number matching the default in Microsoft Authenticator in May 2023, and Duo has an equivalent verified push. If your tenant is old enough that someone turned this off, or it was configured before 2023 and never revisited, check it. That is a five-minute fix worth doing today.
Where does conditional access fit?
Conditional access is the setting that decides when to ask. Without it you either prompt constantly, which makes people hate the whole program and start looking for workarounds, or you prompt rarely, which leaves gaps.
In Microsoft Entra ID, conditional access policies let you say things like: a compliant, company-owned device on a known network gets challenged once every so often, while a sign-in from a new country, an unmanaged device, or a legacy protocol gets blocked outright or forced through MFA every time. It is also where you block legacy authentication, which is the protocol path that ignores MFA entirely and is still the way a surprising number of breaches happen.
The licensing detail people get wrong: security defaults are free and turn MFA on for everyone with no ability to tune it. Real conditional access policies need Entra ID P1, which is included in Microsoft 365 Business Premium. If your company is on Business Standard, the conditional access conversation is really a licensing conversation first.
What rollout sequence avoids a help desk pile-up?
Do it in four waves. The failure mode is turning MFA on for 120 people on a Monday and spending the week resetting them one at a time.
Week 0, before anyone is enrolled. Inventory what breaks. Shared mailboxes, scan-to-email on the copier, the line-of-business app with a service account, anything using legacy authentication. Create two break-glass accounts (below). Decide your methods and write the one-page instruction sheet with real screenshots from your own tenant, not the vendor’s.
Week 1, administrators. Every account with elevated privileges, no exceptions, hardware keys where possible. Admins are the highest-value target and the smallest group. Microsoft has been progressively enforcing MFA on admin portal sign-ins anyway, so this is happening with or without you.
Week 2, pilot group of five to ten. Pick loud people, not easy people: one person from finance, one from operations, the person who complains most, and at least one who works from a job site on a phone. You want the objections surfaced now, at a size where you can answer each one personally. Run it a full week so weekly workflows get exercised.
Weeks 3 and 4, everyone else, in departments. Announce it twice, once two weeks out and once the day before, and name a person, not an inbox, as the contact. Staff the first two mornings with extra coverage. Enrollment during a scheduled fifteen-minute window with someone available beats self-service enrollment with a link and hope.
What is a break-glass account and why two?
A break-glass account is a cloud-only global administrator account excluded from MFA and conditional access, with a long random password split across a sealed envelope in a safe and a password manager entry a second person can reach. You build two, in case one is compromised or the credential is lost.
It exists for the day your MFA provider has an outage, or a policy misconfiguration locks every administrator out of the tenant at once. That is not hypothetical. Alert on any sign-in from those accounts, review the alerts, and test them on a schedule so you find out they work before you need them.
What happens when someone loses their phone?
This is the question that decides whether your rollout survives contact with reality, and it needs an answer before day one, not after.
The workable version: the help desk verifies the person’s identity out of band (a video call, or a manager who knows their voice, never an email request), then issues a temporary access pass that lets them re-enroll a new device within a set window. Entra ID has this built in as Temporary Access Pass. Duo has bypass codes. Both are logged.
The dangerous version is a help desk that resets MFA for anyone who calls sounding stressed. Social engineering the help desk is a known attack path against exactly this workflow. Write the verification steps down, make them non-negotiable, and back them with a second registered method (a second key, or a backup code sheet) so most lost-phone events never reach the help desk at all.
What does this look like for a small business in the Chicago area?
A common pattern at Chicago-area companies is MFA turned on for leadership years ago and never finished for everyone else. The work is less about installing something new and more about finishing what was started and closing the legacy authentication path that quietly bypasses all of it.
Manufacturing and distribution companies in the Chicago suburbs have a specific wrinkle: shop floor and warehouse staff who do not have company phones and are not going to install a work app on a personal one. Hardware keys on a lanyard, or shared kiosk-style sign-in with strong device controls, is usually the honest answer there, and it costs money. Professional services firms downtown hit a different wall, which is client-facing people traveling with legacy VPN clients and older mail apps that break the moment MFA is enforced properly.
RJ2 Technologies has served businesses across Chicagoland and Northern Illinois since 1998 and is headquartered in Deer Park, Illinois. Engineers working downtown use a drop-in space at 333 S. Wabash Ave., Suite 2700, which is a working space rather than a staffed office. RJ2’s site lists Cisco Duo among the platforms deployed for clients, and we work in Microsoft Entra ID for tenants that are already Microsoft-first. If you want the rollout planned and staffed rather than improvised, that is the conversation: 847-303-1194 or sales@rj2t.com.
Related: Cyber Security Services and our pillar guide, Cybersecurity for Regulated Industries.
FAQ
Is multi-factor authentication enough on its own?
No. MFA stops password reuse and credential stuffing, which is the most common way small business accounts get taken over, but it does not stop malware on a laptop, a wire fraud email, or a stolen session token. Treat it as the first control you turn on, not the last.
How long does MFA rollout take for a 50 person company?
About four weeks of calendar time and considerably less than that in actual hours: a week of prep and inventory, a week for administrators, a week for a pilot group, then the rest of the company in departments. Compressing it into one weekend is what generates the help desk backlog.
Should we use text message codes for MFA?
Only as a temporary exception for someone who cannot use anything else, with a date to fix it. SMS codes can be intercepted through SIM swapping and are classified as a restricted method by NIST. An authenticator app is free and materially stronger.
What is number matching and do we need it?
Number matching shows a two-digit number on the login screen that you type into your phone, instead of a simple approve button. It defeats MFA fatigue attacks, where an attacker with your password spams approval prompts until you tap one. It has been the Microsoft Authenticator default since May 2023, so mostly you are verifying it was never disabled.
Do we need hardware security keys, or is an app good enough?
An app with number matching is good enough for most staff. Hardware keys such as YubiKeys are worth the cost for global administrators, finance, and anyone who can move money, because they are resistant to phishing pages that fool app-based approval. Issue two per person so a lost key is not a lockout.
What happens if someone loses their phone?
The help desk verifies who they are out of band, never by email, then issues a temporary access pass so they can enroll a new device. Registering a second method up front, either a backup key or a printed code sheet, keeps most of these from becoming a help desk ticket at all.