BitFlip Technologies
Get in touchContact
Menu
Security Notes

Turn on two-step login everywhere

By Travis Baldwin, Founder & Principal ConsultantLast reviewed 3 min read

The short version

  • Turn on two-step login for your email first. Whoever controls your inbox can reset almost every other password.
  • Next come banking and payroll, your Microsoft 365 or Google Workspace admin account, your domain and website host, and your accounting software.
  • Where you can, choose an authenticator app or a passkey over text-message codes.
  • Save your backup codes somewhere safe, and make two-step login required for everyone, not optional.

What two-step login is

Two-step login, often called multi-factor authentication or MFA, asks for something you have, such as a code on your phone, as well as something you know: your password. A stolen or guessed password on its own is no longer enough to get in.

Most break-ins at small businesses don't involve clever hacking. Someone gets hold of a password, often from a breach at an unrelated website where it was reused, and simply logs in. Two-step login stops that, which is why the U.S. Cybersecurity and Infrastructure Security Agency (CISA) recommends turning it on for every account that offers it.

Which accounts to protect first

If you can only do a few today, work down this list:

  1. Email. Password resets for nearly everything else land in your inbox, so email is the key to the rest.
  2. Banking, payroll and payment accounts. This is where the money moves.
  3. Microsoft 365 or Google Workspace admin accounts. An administrator can reset everyone else's password.
  4. Your domain registrar and website host. Whoever controls your domain controls your website and can redirect your email.
  5. Accounting and business software, such as QuickBooks or your practice-management system.
  6. Social media pages, which are slow and painful to recover once they're taken over.

Which kind of second step to choose

Any second step is far better than none, but they aren't equal:

  • Passkeys and security keys are the strongest. They resist phishing because they only work on the real website, and major services, including Microsoft and Google accounts, now support them.
  • Authenticator apps, such as Microsoft Authenticator or Google Authenticator, are a strong, free choice for most businesses. Apps that ask you to match a number shown on screen are harder to trick.
  • Text-message codes are better than nothing, but they can be intercepted if a criminal persuades your mobile carrier to move your number to their phone, known as a SIM swap. Use them where nothing else is offered.

Rolling it out to your team

  1. Start with administrators, including yourself. Admin accounts are the biggest prize.
  2. Pick one method for everyone, usually an authenticator app, so there's only one thing to explain.
  3. Set aside thirty minutes to enroll everyone together, so nobody gets locked out alone on a Monday morning.
  4. Make it required, not optional. In Microsoft 365, turning on Security Defaults requires two-step login for every user, and Google Workspace lets an administrator enforce 2-Step Verification for the whole organization. Larger setups may use more detailed policies instead.
  5. Plan for people leaving. When someone leaves, remove their account and enrolled devices the same day.

Backup codes and lost phones

When you turn on two-step login, most services offer a set of one-time backup codes. Save them in your password manager, or print them and keep them somewhere locked. They're how you get back in if a phone is lost or replaced.

Make sure at least two trusted people can administer your Microsoft 365 or Google Workspace account, so one lost phone can't lock the whole business out.

One rule for everyone

Never approve a sign-in request you didn't start. Criminals who already have a password sometimes send prompt after prompt, hoping someone taps Approve just to make them stop. If an unexpected request appears, deny it and change that account's password.

More Security Notes