A stolen or guessed password is still one of the fastest ways a small business gets broken into — through email, banking, or the accounts that run day-to-day operations. Two-factor authentication (2FA) closes most of that gap by requiring a second proof of identity, like a code from your phone or a physical security key, before anyone can log in.
Table of Contents
This guide walks through which accounts to protect first, how to set up 2FA for yourself and your team using authenticator apps or hardware keys, and how to enforce it company-wide in Google Workspace or Microsoft 365 without locking people out.
Quick Answer
Install an authenticator app (Microsoft Authenticator or Google Authenticator) or a hardware security key, then turn on 2FA in the security settings of each account — starting with email, your domain registrar, banking, and your password manager. If you use Google Workspace or Microsoft 365, enforce 2FA for the whole team from the admin console rather than relying on each person to opt in.
Step 1: Protect Your Most Critical Accounts First
You can’t do everything at once, so prioritize by blast radius. Start with your business email (a compromised inbox lets attackers reset passwords on almost everything else), your domain registrar and DNS host (hijacking these can take down your website or email entirely), your bank and payment processor, your password manager, and any cloud accounting or CRM software holding customer or financial data. Social media accounts and less-sensitive SaaS tools can come next.
For each account, look in Settings under a heading like ‘Security,’ ‘Login & Security,’ or ‘Two-Factor Authentication,’ and turn it on. Most services will ask you to scan a QR code with an authenticator app or register a security key.
Step 2: Choose an Authenticator App or Security Key
Avoid SMS text-message codes where you have another option — phone numbers can be hijacked through SIM-swapping. An authenticator app is the more secure, still-free baseline: Microsoft Authenticator integrates smoothly if you’re on Microsoft 365, while Google Authenticator is a simple, widely supported option that now backs up codes to your Google account so you don’t lose access when you switch phones. (Authy is still usable on mobile, but Twilio discontinued its desktop apps in March 2024 and has scaled back development, so it’s no longer a great pick for new setups.)
For your highest-value accounts — email, banking, domain registrar, password manager — consider a physical hardware security key, which is effectively immune to phishing because it verifies the actual website you’re logging into. Yubico’s entry-level Security Key series starts around $29, with the more full-featured YubiKey 5 series starting around $58; buy two per person so there’s a backup if one is lost.
If you use a password manager like 1Password or Bitwarden, both support storing passkeys and using a hardware key to unlock the vault itself, which is worth setting up since the password manager is often the single account protecting everything else.
Step 3: Roll It Out Across the Whole Team
Individual sign-ups aren’t reliable at a company level — someone will skip it. If your business runs on Google Workspace, go to the Admin console, then Security > Authentication > 2-Step Verification, and set enforcement to ‘On’ or use ‘On From’ to schedule a deadline. Google’s own guidance recommends turning it on as optional first, giving staff about two weeks to enroll, and allowing ‘Any except text/phone’ as the verification method so people can’t fall back to the weakest option.
On Microsoft 365, the fastest path for most small businesses is enabling Security Defaults in the Microsoft Entra admin center, which requires every user and admin to register for MFA using Microsoft Authenticator or another authenticator app. Tenants created after October 2019 often have this on already; if you need finer control — like requiring MFA only for certain apps or locations — use a Conditional Access policy instead (note the two can’t run simultaneously).
Tips and Common Mistakes
Save your backup/recovery codes somewhere other than the device that generates your codes — a locked drawer or an encrypted note in your password manager works. If you lose your phone and have no backup codes, account recovery can take days.
Don’t leave SMS as the only second factor on accounts that offer app-based or key-based options; it’s better than nothing, but it’s the easiest method for an attacker to defeat. Also assign at least two admins with 2FA on any critical account (domain registrar, hosting, bank) so a single lost device doesn’t lock out the whole business, and revoke 2FA methods immediately when an employee leaves.
Explore more: More small business tech guides.
Two-factor authentication for small business FAQs
Is two-factor authentication the same as multi-factor authentication (MFA)?
2FA is a specific case of MFA using exactly two factors — usually a password plus a code or key. MFA is the broader term and can include more factors, but for most small businesses the two terms describe the same practical setup.
What’s the difference between an authenticator app and SMS codes?
An authenticator app generates codes locally on your device using an encrypted key, so it can’t be intercepted by hijacking your phone number. SMS codes are sent over the cellular network and are vulnerable to SIM-swapping attacks, so they’re a weaker fallback rather than a first choice.
Do I really need a hardware security key, or is an app enough?
An authenticator app is a strong improvement over passwords alone and is sufficient for most accounts. A hardware key adds phishing resistance because it checks the actual website address before authenticating, which makes it worth the small cost for your email, banking, domain registrar, and password manager.
What happens if an employee loses their phone or security key?
This is why backup codes and a second registered method (or a second admin) matter. Store recovery codes securely when 2FA is first set up, and for admin consoles like Google Workspace or Microsoft 365, make sure more than one person can access account recovery so the business isn’t locked out.
Build It With GTStudios
Need help with your website, app, or small-business tech? GTStudios builds web, apps, and software for small businesses. See how GTStudios can help.
Want dev news in your inbox? Subscribe to the free newsletter.
Photo by Dan Nelson on Unsplash.