A stolen Microsoft 365 password can give an attacker access to email, invoices, client records, shared files, and password reset messages in minutes. Multi-factor authentication adds a second check that can stop that intrusion, but only if employees can and will use it correctly. The challenge is to choose MFA methods that match the systems your business relies on, the risks you face, and the way your people actually work.
For a small or mid-sized business, MFA should not become another source of helpdesk tickets, workarounds, or locked-out employees. It should be a practical control that protects access without slowing down legitimate work.
Start With the Accounts That Matter Most
Not every account has the same risk. Begin with the systems that could cause the most business disruption or exposure if an attacker got in: email, cloud file storage, accounting platforms, payroll, remote access, customer relationship management systems, line-of-business applications, and administrator accounts.
Email usually comes first. It is the reset point for many other systems and a common target for phishing. A compromised executive or accounting mailbox can also be used to redirect payments, impersonate leadership, or collect sensitive information. Require MFA for every user with email access, not just managers or remote employees.
Administrator accounts deserve stricter treatment. These accounts can change security settings, create users, access backups, and affect every device in the environment. The MFA method that is acceptable for a general user may not be appropriate for someone with elevated access.
If your business handles protected health information, controlled unclassified information, financial data, legal records, or defense-related information, document which applications hold that data and what access controls are required. Compliance requirements may not dictate one specific MFA tool, but they do require you to show that access is controlled consistently.
Understand the Main MFA Options
MFA is not one product or one experience. The right choice depends on the type of factor, the device available to the user, and how resistant the method is to common attacks.
Authenticator app notifications and codes
Authenticator apps can send an approval prompt to a registered phone or generate a short, time-based code. For many businesses, an authenticator app is the best starting point because it is widely supported, low cost, and more secure than text messages.
Push notifications are convenient, but they need configuration. Attackers sometimes send repeated approval requests until a tired or distracted user accepts one. Use number matching or a similar verification step when your identity platform supports it. Employees should know that an unexpected approval request is a security event, not an inconvenience to dismiss.
Time-based codes are useful when notifications are unavailable, such as during travel or in areas with poor cellular service. They are not as easy to use as a prompt, but they provide a dependable backup option.
Security keys and passkeys
Hardware security keys and device-based passkeys offer stronger protection against phishing because they verify the legitimate website or application during sign-in. A fake login page cannot simply collect a usable code in the same way it can steal a password and a texted code.
These methods are a strong fit for IT administrators, finance personnel who approve payments, executives, and employees with access to highly sensitive data. They can also make sense for businesses with persistent phishing exposure or formal compliance obligations.
The trade-off is operational. Keys must be issued, tracked, replaced, and stored carefully. Users need a backup method in case a key is lost or left at home. Passkeys can reduce that burden when they are supported across the devices and applications your team uses, but adoption is still uneven in some older business systems.
Text messages and phone calls
SMS text messages and voice calls are better than password-only access, but they are not preferred for high-risk accounts. Phone numbers can be targeted through SIM-swapping fraud, messages can be intercepted under certain conditions, and employees may not receive codes while traveling or when their phone service is unavailable.
There are situations where SMS is a reasonable temporary option. A field employee with no company laptop, a legacy application with limited MFA support, or an employee transitioning to a new device may need it. Treat it as a fallback, not the standard for administrators, finance, or executive accounts.
Biometric checks
Fingerprint and facial recognition are often part of the sign-in experience on a phone or computer. They are convenient because the employee is verifying access locally on a device they already use. In most cases, however, biometrics are not a standalone business MFA strategy. They typically protect the device or approve a passkey rather than replace the need for a properly managed identity system.
How to Choose MFA Methods Without Creating Friction
Security controls fail when they ignore the workday. Before selecting a standard method, consider where employees sign in, what devices they use, and what happens when something goes wrong.
A receptionist using a shared workstation has different needs than a salesperson signing in from airports, a machinist accessing a production system on the floor, or an accountant processing payments from the office. Shared accounts should be eliminated wherever possible. MFA works best when each person has an individual identity and a clear record of access.
Ask practical questions before rollout:
- Can employees use personal phones for authentication, or does the company need to provide devices or security keys?
- Do critical applications support modern MFA, or do they require an alternate control because they are older or vendor-managed?
- Are employees routinely offline, in secure facilities, or unable to carry phones during parts of their shift?
- What is the approved recovery process when a phone is replaced, a key is lost, or an employee is locked out?
The recovery process matters as much as the sign-in process. If anyone can call the helpdesk, answer a few public questions, and reset MFA, an attacker may bypass the control through social engineering. Establish identity verification rules for resets and make sure the people handling those requests follow them every time.
Use Different Strengths for Different Roles
A single MFA policy is easier to administer, but it is not always the right answer. A layered approach usually provides better protection without forcing the most restrictive method on every employee.
For most staff, an authenticator app with number matching is a sensible baseline for Microsoft 365, cloud applications, and remote access. Keep time-based codes or another verified method available for recovery.
For administrators, executives, finance teams, and users who can access sensitive client or regulated data, require phishing-resistant MFA where possible. Security keys or passkeys are often the better choice. These users are more likely to be targeted, and the business impact of one compromised account is higher.
For external vendors, limit access by role, time, and system. MFA alone does not make broad vendor access safe. A vendor should not receive a permanent account with more permissions than necessary simply because they have enrolled in MFA.
Set the Policy, Then Support It
Technology does not replace a clear policy. Your MFA policy should state who must enroll, which methods are approved, which accounts require stronger methods, how backup factors are handled, and who can approve exceptions. It should also cover former employees, contractors, and dormant accounts.
Avoid letting employees register personal email addresses or unapproved phone numbers as easy recovery paths for sensitive accounts. Review registered authentication methods regularly, especially after a job change, device replacement, or termination.
Training should be brief and specific. Show employees what a legitimate sign-in request looks like, explain why they must never approve an unexpected prompt, and give them a direct way to report suspicious activity. A five-minute explanation during onboarding is useful, but periodic reminders are necessary because phishing tactics change.
Monitoring also matters. Review failed sign-ins, repeated MFA denials, impossible travel alerts, and new authentication-method registrations. These signals can reveal an attempted takeover before it becomes a larger incident.
Make MFA Part of a Managed Security Plan
MFA is one control in a broader access strategy. It works best alongside strong password practices, device management, security updates, endpoint protection, least-privilege access, tested backups, and employee security awareness. If a laptop is unmanaged or an employee has excessive permissions, MFA alone cannot solve the underlying exposure.
For businesses without a large internal IT team, the operational work can be the hardest part: enrolling users, configuring conditional access, documenting exceptions, monitoring alerts, and handling recovery without weakening security. Gravity Networks helps organizations put those controls into a supportable process, with local engineers who can explain the choices in plain English.
The best MFA method is not necessarily the most expensive or the most restrictive one. It is the method your business can enforce consistently, support when employees need help, and strengthen for the accounts where a compromise would hurt most.