MFA for small business means proving who you are with something beyond a password: a code, a prompt on your phone, or a hardware key. Every type beats a password alone, but they are not equal. Use an authenticator app with number matching as your floor, and passkeys or hardware keys for email, admin and finance accounts.
What is multi-factor authentication?
Multi-factor authentication (MFA) is a login that asks for two different kinds of proof. The first is usually something you know, the password. The second is something you have (a phone, a key) or something you are (a fingerprint, your face). A stolen password on its own is then not enough to get in, which matters because passwords get stolen constantly, through fake login pages, reused logins from other breaches and malware on home computers. CISA's multifactor authentication page puts the position plainly: some MFA types are better than others, and any MFA is better than none.
Which types of MFA are there, from weakest to strongest?
From weakest to strongest, the common types are SMS codes, voice calls, email codes, authenticator app codes, push notifications with number matching, and then hardware security keys and passkeys. The ordering comes from how each one holds up against the attacks criminals actually use, which CISA lays out in its fact sheet on implementing phishing-resistant MFA.
- SMS text codes. A six-digit code texted to your phone. It is the weakest: the code can be typed into a fake login page, and the phone number itself can be stolen through a SIM swap or intercepted through weaknesses in the carrier signaling network. CISA calls SMS and voice a last resort.
- Voice calls. The same idea with a robot reading the code aloud, and the same weaknesses.
- Email codes. A code sent to your inbox. If the account you are protecting is the inbox, this is circular. Treat it as a recovery method, not a factor.
- Authenticator app codes. Apps such as Microsoft Authenticator generate a code that changes every half minute, with nothing sent over the phone network. That removes the SIM-swap problem. The code can still be phished: a fake page asks for it and relays it to the real site before it expires.
- Push notifications with number matching. The app shows a prompt and asks you to type the two-digit number displayed on the login screen. The number stops "push bombing," where an attacker who already has your password sends approve requests until you tap one to make them stop. CISA names app codes and push with number matching as the best options for a small or medium business that cannot yet go phishing-resistant.
- Hardware security keys and passkeys. A USB or NFC security key, or a passkey stored on your phone or laptop and unlocked with its fingerprint reader or PIN. Both use the FIDO2/WebAuthn standard, which ties the login to the real website's address. A fake page cannot complete the handshake, so there is nothing for a phisher to steal. This is the only tier CISA's table marks as resistant to phishing.
What does "phishing-resistant" mean and why does it matter?
Phishing-resistant MFA cannot be captured and replayed by a fake login page. That is the whole definition, and it matters because the fake page is now the standard attack. The kits criminals use sit between the victim and the real site, forward the password and the one-time code in real time, and keep the signed-in session for themselves. Codes, texts and plain push prompts all fall to this. A security key or passkey does not, because the response it produces is bound to the domain it was registered on, and a lookalike domain gets a different answer.
The standards have moved accordingly. NIST's Digital Identity Guidelines, SP 800-63-4, finalized in July 2025, grade logins into three authenticator assurance levels: at AAL2 a service must offer at least one phishing-resistant option, and at AAL3 the authenticator itself must be phishing-resistant with a key that cannot be exported. CISA's fact sheet calls phishing-resistant MFA the gold standard and urges system administrators and other high-value targets to move to it first. On the Microsoft side, the Entra ID authentication methods documentation lists which methods count: Windows Hello for Business, FIDO2 security keys, passkeys (including passkeys in Microsoft Authenticator) and certificate-based authentication. SMS, voice and plain app codes are not on that list.
How do the MFA types compare?
| Type | Phishing-resistant | Cost | User friction | Defends against |
|---|---|---|---|---|
| SMS code | No | None beyond the phone | Low, but fails with no signal | Password reuse and password spraying; not SIM swap, carrier interception or phishing |
| Voice call | No | None | Low, slow | Same as SMS |
| Email code | No | None | Low | Little, if the email account is the thing being protected |
| Authenticator app code | No | Free apps | Medium: open the app, type the code | SIM swap, carrier interception, password theft; not real-time phishing |
| Push with number matching | No | Free apps | Low: tap, then type two digits | Push bombing and everything above; not real-time phishing |
| Hardware security key | Yes | One key per person, ideally two | Low once enrolled; has to be carried | Phishing, push bombing, SIM swap, credential replay |
| Passkey on a phone or laptop | Yes | Usually none | Lowest: fingerprint or face | Same as a hardware key; a synced passkey is only as safe as the account it syncs through |
Where should a small business turn on MFA first?
Start with the identity provider and email, because they unlock everything else, then work outward in this order:
- Microsoft 365 or Google Workspace. For most small businesses this is the identity provider, the mailbox and the file store in one. Turn MFA on for every account, not just the ones that seem important, and enforce it through policy rather than asking people to enroll themselves.
- Remote access. VPN, remote desktop, and the remote-control tool your IT provider uses. An open remote desktop port with only a password in front of it is still a common way ransomware starts.
- Banking, payroll and payment platforms. Use a hardware key or passkey here where the bank supports one, because these accounts move money.
- Admin accounts. Global admins in Microsoft 365, the domain registrar, DNS, the firewall, the backup console, and whatever account your IT provider uses. These should be phishing-resistant from day one, with a break-glass admin account whose key lives in a safe.
- Everything else with a login. Accounting software, the CRM, the practice management system, social media accounts.
CISA's fact sheet makes the same point from the other direction: hosted mail and single sign-on systems are the right place to begin, because the data is valuable and those vendors already support FIDO. Getting the rollout sequenced and enforced through policy rather than goodwill is the core of identity and access management work.
What do you do about the staff who refuse?
Give them a hardware key. Most refusals are really "I will not install a work app on my personal phone," and that is a fair position. A security key or a small hardware token costs the company a little and asks nothing of their phone. The second kind of refusal is the owner or a senior person who wants an exception. Do not grant one. Executives and finance staff are exactly who attackers impersonate and target, and an insurer will ask about them specifically. CISA's advice is that leadership should hear the risk and own the decision; it is a business risk, not an IT preference. If people are working around MFA because they do not understand what it prevents, that is a security awareness training problem, and a short session showing a real phished login page usually ends the argument.
What about shared mailboxes and service accounts?
Shared mailboxes should not have a password anyone types. In Microsoft 365, block sign-in on the shared mailbox and grant access through delegation from each person's own MFA-protected account. If a "shared" account exists because three people log in as info@ with the same password, convert it.
Service accounts, the logins a scanner, a backup job or an integration uses, cannot answer a phone prompt. Give them no interactive sign-in, a long random secret, conditional access that limits where they can sign in from, and a review date. Where the vendor offers an app registration or a certificate instead of a username and password, use that. Finally, keep one break-glass admin account with a hardware key in a safe, excluded from conditional access policies, so that a policy mistake cannot lock everyone out.
How does MFA affect cyber insurance?
Every cyber insurance application now asks about MFA, and the questions are specific: is it enforced on email, on remote access, on privileged accounts, on backups? "Partially" is the dangerous answer, because an insurer that finds MFA was not enforced on the mailbox that was compromised has grounds to dispute the claim. Answer the questionnaire from your tenant's enforcement report, not from memory, and keep the evidence. What else the questionnaire asks, and how to be able to answer yes honestly, is covered under cyber insurance readiness.
Frequently asked questions
Is SMS MFA better than nothing?
Yes. CISA's position is that any MFA is better than no MFA, and that SMS or voice should be a last resort or a temporary step while you move to an app or a key. If SMS is what a bank or vendor offers, use it and ask them for better.
Do passkeys replace passwords?
They can. A passkey is the "something you have," and the fingerprint or PIN that unlocks it supplies the second factor, so many services let you sign in with no password at all. Keep a second passkey or a hardware key registered so a lost phone is an inconvenience rather than a lockout.
What happens when someone loses their phone?
They use their backup method, which is why every account should have two registered. The help desk also needs a verification procedure that does not rely on the caller sounding like the employee, because talking a help desk into resetting MFA is a common way attackers get in.
Does MFA stop all phishing?
No. Only phishing-resistant MFA stops the credential-stealing kind, and no MFA stops the email that asks accounting to change a vendor's bank details, because no login is involved. MFA is one layer; the process controls around payments are another.
Do we need MFA on Microsoft 365 if we already have a spam filter?
Yes. Filters miss things, and one missed email that captures one password is enough. MFA is what limits the damage when the filter fails.