3 min read
Turn on MFA without locking out the office
A practical order for adding multi-factor authentication at a small company.
Multi-factor authentication fails in small companies when it is turned on for everyone at 5 p.m. on a Friday, with no recovery codes, and the owner is the only person who can approve a prompt.
Start with email for the owner and the person who pays bills. Email resets everything else. Then add the bank, payroll, and the domain host. Then the rest of the staff.
Use an authenticator app as the default. Text-message codes are better than nothing and weaker than an app, because the phone number can be moved. A hardware key is a good fit for the owner and for finance, not a requirement for the front desk on day one.
Print or store recovery codes before you close the laptop. If the only phone that can approve a prompt is in a lake, the codes are the way back in. Store them in the password manager or a locked drawer, not in the mailbox you are trying to protect.
Tell people what an unexpected prompt looks like. The correct tap is deny. Approving a prompt to make it stop is how an account is handed over on an otherwise quiet afternoon.
Plan the first week so someone who is locked out can reach the owner. A short slump in productivity is cheaper than a mailbox that forwards every invoice to a stranger.