Multi-factor authentication: methods ranked and setup

Multi-factor authentication (MFA) asks for a second proof of identity at sign-in, so a stolen password alone does not open the account. Not all methods are equal. Passkeys and security keys are the strongest because they cannot be tricked by a fake sign-in page. Authenticator apps come next, and text message codes are the weakest option that is still far better than nothing. Microsoft 365 and Google Workspace both include MFA at no extra cost, and the steps to turn it on are below.

What is MFA, and how much does it help?

MFA means signing in with two or more different kinds of proof: something you know (a password or PIN), something you have (a phone or security key), or something you are (a fingerprint or face). You may also see it called two-step verification or 2FA.

Microsoft’s research found that MFA can block more than 99.2% of account compromise attacks. The FBI lists enabling MFA, especially for webmail and remote access, among its core recommendations against ransomware. Email matters most, because whoever controls a mailbox can reset the passwords of most other accounts and send convincing payment requests. See business email compromise.

MFA methods ranked from strongest to weakest

This order follows CISA’s fact sheet, which lists forms of MFA from strongest to weakest.

Rank	Method	Stops a fake sign-in page?	Main weakness	Good for
1	Passkeys and FIDO2 security keys (also Windows Hello for Business)	Yes	Needs setup per person. Hardware keys cost money and can be lost	Admins, owners, anyone who handles money. Ideally everyone
2	Authenticator app with number matching, or app-generated six digit codes	No	A convincing fake page can still collect the code or approval	The practical default for most staff
3	Authenticator app push with a plain Approve button	No	Also open to “push bombing”: repeated prompts until someone taps Approve	Upgrade to number matching
4	Text message or voice call codes	No	Also open to SIM swapping, where a criminal takes over the phone number	A last resort, or a temporary step

Passkeys and security keys

A passkey is a sign-in credential stored on your phone, computer, or a small USB or NFC security key, unlocked with your fingerprint, face, or a PIN. It is tied to the real website’s address, so it will not respond to a lookalike site, however convincing. CISA calls this kind of phishing-resistant MFA the gold standard and notes that FIDO is the only widely available form of it.

Microsoft’s list of phishing-resistant methods includes Windows Hello for Business, FIDO2 security keys, passkeys in the Microsoft Authenticator app, and synced passkeys. Passkeys come in two kinds:

• Device-bound: the passkey lives on one security key or one phone and never leaves it. Best for administrators.
• Synced: the passkey is stored in Apple’s, Google’s, or a password manager’s passkey service and is available on your other devices. Easier to live with, and it survives a lost phone.

Authenticator apps

Apps such as Microsoft Authenticator and Google Authenticator either show a short one-time code that keeps changing or send a prompt to approve. With number matching, the sign-in screen shows a number that you type into the app, which defeats push bombing. CISA describes app codes and push with number matching as the best options for small and medium businesses that cannot immediately adopt phishing-resistant MFA.

The limit is that these can still be phished. NIST’s current digital identity guidelines state plainly that one-time codes and out-of-band approvals are not phishing-resistant, because a person can be talked into entering them on the wrong page.

Text message and voice codes

CISA says text and voice MFA should only be used as a last resort, and NIST classifies phone-network delivery as restricted. The same fact sheet is equally clear that any form of MFA is better than none. If a text code is all a particular service offers, turn it on.

How to turn on MFA in Microsoft 365

Microsoft’s sign-in system is called Microsoft Entra ID. There are two supported ways to require MFA, and you use one or the other.

Option 1: Security defaults (any plan, no extra license)

Security defaults is a single switch that requires everyone to register for MFA, requires administrators to use it at every sign-in, prompts other users when Microsoft judges it necessary, and blocks older sign-in protocols that cannot do MFA. Tenants created since October 2019 may already have it on.

Per Microsoft’s instructions:

1. Sign in to the Microsoft Entra admin center (entra.microsoft.com) as an administrator.
2. Go to Entra ID > Overview > Properties.
3. Select Manage security defaults.
4. Set Security defaults to Enabled, then Save.

What to expect:

• Users register with the Microsoft Authenticator app using notifications, which include number matching. They can also use another authenticator app that generates standard codes.
• There is no longer a 14-day grace period. Microsoft removed it in July 2024, so users are asked to register at their next sign-in.
• Legacy authentication is blocked. Before switching on, check anything that signs in with a plain username and password over IMAP, POP, or SMTP: an old copier that scans to email, an accounting program that sends invoices, a very old version of Outlook. These will stop working and need a supported method.
• Microsoft warns not to disable authentication methods while using security defaults, since that can lock you out.

Option 2: Conditional Access (Business Premium and up)

Conditional Access lets you write your own rules, such as requiring MFA for everyone, requiring stronger methods for administrators, or blocking sign-ins from outside the countries you work in. It needs a Microsoft Entra ID P1 license, which is included in Microsoft 365 Business Premium. Microsoft says organizations with P1 or P2 licenses are usually better served by Conditional Access, and that security defaults must be turned off to use it. If you switch, put the replacement policies in place immediately so there is no gap.

Our guide to Conditional Access for small business covers the starter policies, and Microsoft Entra ID explained covers the basics.

Add passkeys

Passkeys are available in every edition of Microsoft Entra ID, including the free tier.

1. In the Entra admin center, go to Entra ID > Security > Authentication methods > Policies.
2. Select Passkey (FIDO2), enable it, and choose who it applies to. Microsoft now manages this through passkey profiles, where you choose device-bound, synced, or both.
3. Users add a passkey at mysignins.microsoft.com/security-info.

If you use security defaults, add passkeys alongside the existing methods and leave the other methods enabled. Requiring passkeys only, for example for administrators, is done with a Conditional Access authentication strength.

Two more things to know

• Administrators already need MFA. Microsoft has required MFA to sign in to the Microsoft 365 admin center since February 2025, and for the Entra and Intune admin centers since late 2024. This does not cover regular staff opening Outlook or Teams, so you still need one of the options above.
• Keep emergency access. Microsoft recommends two cloud-only emergency administrator accounts, protected with a passkey or security key and stored safely, so a lost phone cannot lock you out of your own tenant.

How to turn on 2-Step Verification in Google Workspace

Google calls MFA 2-Step Verification (2SV). Per Google’s deployment guide, the recommended order is to tell users, let them enroll, check enrollment, then enforce.

1. Sign in to the Google Admin console (admin.google.com) as an administrator.
2. Go to Menu > Security > Authentication > 2-step verification.
3. Check Allow users to turn on 2-Step Verification and save. Ask everyone to enroll.
4. Track who has enrolled in the Admin console’s security reports.
5. When enrollment is complete, set Enforcement to On, or choose Turn on enforcement from date to give a deadline.
6. Set a New user enrollment period (from 1 day to 6 months) so new hires can sign in and enroll before enforcement applies to them.
7. Under Methods, choose Any except verification codes via text, phone call to rule out the weakest option. Only security key is the strictest choice and suits administrator accounts.

Google notes in the same guide that it is enforcing 2SV for administrator accounts. Users on managed Google accounts can also create passkeys and sign in with a phone, computer screen lock, or security key.

A rollout plan that avoids lockouts

1. Start with administrators and owners. Use passkeys or security keys for these accounts.
2. Tell staff a week ahead what will happen, which app to install, and who to ask. Microsoft publishes communication templates linked from its security defaults page.
3. Have each person register two methods, for example the authenticator app plus a passkey or security key. One method on one phone is how lockouts happen.
4. Register together. Ten minutes per person at their desk avoids most problems.
5. Decide the new-phone procedure now. Set up the new phone before wiping the old one. Know who can reset a user’s methods, and how that person will confirm the request is genuine.
6. Turn on enforcement, then check the sign-in or enrollment report a week later for stragglers.
7. Extend to everything else that matters: banking, payroll, accounting software, your domain registrar, your password manager, and remote access.

Limits and trade-offs

MFA is not a complete defense. App codes and approvals can be captured by a convincing fake sign-in page, which is why the ranking above matters and why the phishing checklist still applies. MFA also does nothing about a fraudulent invoice sent from someone else’s mailbox.

There is some friction. Expect a prompt on new devices and periodically afterward, and an occasional lockout when someone changes phones. Some staff will not want a work app on a personal phone. A hardware security key is a good answer for them, since it needs no phone at all.

You do not need to buy hardware keys for every employee on day one. For most small offices, an authenticator app with number matching for everyone, plus passkeys or security keys for administrators and the people who move money, is a sound starting point. Move others to passkeys as devices allow.

Common mistakes

• Protecting staff accounts but exempting the owner or a shared mailbox.
• Leaving text message codes as the only method on administrator accounts.
• Registering a single method per person.
• Turning on security defaults without checking the copier, scanner, or older apps that send email.
• Approving a sign-in prompt you did not start. An unexpected prompt means someone has your password: deny it, change the password, and report it.
• Stopping at email and leaving the bank, payroll, and domain registrar on passwords alone.

Common questions

Is text message MFA still worth using?

Yes, when nothing better is offered. CISA ranks it weakest because codes can be phished and phone numbers can be hijacked by SIM swapping, and it recommends using it only as a temporary or last-resort option. For Microsoft 365 and Google Workspace, better methods are included at no cost, so use those.

What is the difference between a passkey and an authenticator app?

An authenticator app gives you a code or prompt that you pass along during sign-in, and a fake page can collect it. A passkey signs in directly with the real site using a cryptographic key on your device, unlocked by your fingerprint, face, or PIN. There is nothing to type and nothing a lookalike site can capture.

What happens when an employee loses or replaces their phone?

If they registered a second method, they sign in with it and add the new phone themselves. If not, an administrator has to verify who they are and reset their sign-in methods. Decide that procedure ahead of time, because an urgent “I lost my phone, please reset my MFA” request is also a known trick.

Does MFA cost extra in Microsoft 365 or Google Workspace?

No. Microsoft’s security defaults require no additional license, passkeys are available in every Entra ID edition, and Google includes 2-Step Verification in Workspace. Conditional Access needs Entra ID P1, which is part of Business Premium. The only optional purchase is hardware security keys.

How we can help

Coastal Growth Co. sets up MFA for small businesses in Orange County: choosing between security defaults and Conditional Access, checking for older devices that would break, registering passkeys for administrators, enrolling staff in person, and documenting the lost-phone procedure. See our cloud and email services and Microsoft 365 support, or get in touch. Scope and price are agreed before any paid work begins.