How do we set up multi-factor authentication?

This is the single most valuable security change most small businesses can make, and it is included in the base agreement rather than sold as an upgrade.

How a rollout usually goes: we enable it for a pilot group, communicate a date to everyone, then enforce it tenant-wide with a short window for people to enroll. Most staff set it up in three minutes with the authenticator app on their phone.

Three decisions worth making properly:

• App prompts rather than text messages. SMS codes can be intercepted through SIM swapping, and app-based approval is both safer and faster for the user.
• No exceptions. The account exempted for convenience, usually an executive or a shared mailbox, becomes the way in. If someone genuinely cannot use a phone, there are hardware keys.
• Legacy authentication disabled. Multi factor can be bypassed entirely through older protocols if those are left enabled. Turning it on without this is a false sense of security, and it is the step most commonly missed.

Expect some grumbling for about a week, then nobody mentions it again. It is the cheapest insurance you will buy.