Rolling out MFA in an SMB: the five-step guide

Multi-factor authentication (MFA) means requiring a second proof on top of the password: an approval on the phone, a temporary code or a hardware key. It is the security measure with the best effort-to-result ratio there is: a password stolen through phishing or reused from a data leak is no longer enough to get in. It is also the one companies postpone the most, for fear of annoying users.

The short answer: protect administrator accounts the same day, then all remote access, choose the method for each group of users, roll out in waves and check every month. Here is how we do it for our clients, in Morocco and elsewhere, without friction and without disrupting the business.

Why a password alone is no longer enough

The attacks we see in SMBs rarely start with a technical feat. They start with a login: a fake Microsoft 365 sign-in page received by email, a password reused on a hacked website, a guessed VPN account. With the password alone, the attacker reads the mailbox, prepares a payment fraud or drops ransomware. We describe these scenarios in our article on the phishing scams targeting Moroccan SMBs.

MFA does not make an account invulnerable, but a stolen password is no longer enough, on its own, to open it. That is why we check it on the first day of every IT audit.

1. Start with the accounts that open every door

Microsoft 365 or Google Workspace administrators, Active Directory domain administrators, access to the firewall, the phone system, the backup console, the domain name registrar and online banking. These accounts get MFA the same day, with an authenticator app or a hardware key, never SMS.

Two precautions at this stage:

• Separate accounts: administrators use an admin account distinct from their everyday mailbox.
• Plan an emergency account: one or two “break-glass” accounts with a long password kept in a sealed envelope, excluded from rules that could lock you out, and monitored at every sign-in.

2. Protect all remote access

VPN, remote desktop, webmail, business software portals, remote access for contractors. Remote access without MFA is the entry point ransomware looks for first. Fortinet and WatchGuard firewalls include MFA on their VPNs, and WatchGuard offers AuthPoint to extend the same app to Windows logins and web applications. We enable it before anything else.

A remote desktop published directly on the internet must go: it moves behind the VPN, which is itself protected by MFA.

3. Pick the right method for each group

Not all methods are equal. The table below sums up our approach.

Method	Protection level	For whom	Watch out for
Hardware key or passkey (FIDO2)	Highest, phishing-resistant	Administrators, executives, finance	Keep a second backup key
App approval with number matching	High	Most users	Reject any unsolicited request
App with temporary code (TOTP)	Good	Users without a managed smartphone, technical accounts	Code can be typed into a fake page
SMS or voice call	Low	Last resort only	SIM swapping, phishing
Backup codes	Emergency	Everyone, for emergencies	Kept offline, single use

Common apps are Microsoft Authenticator, Google Authenticator and WatchGuard AuthPoint. On personal phones, the app has no access to private data: explain this up front, as it is the first objection employees raise.

4. Roll out in waves, with support

A successful rollout is first and foremost a communication project.

1. Prepare: inventory of accounts, applications and protocols in use, choice of methods, a one-page guide with screenshots.
2. Pilot: a volunteer department goes first, to spot the applications that resist (old email clients, printers that send emails, scanners).
3. Announce: a message from management explaining why, when and how, with the switch-over date for each department.
4. Enrol: on-site or remote help on day one, so nobody is left locked out.
5. Generalise: department by department, then block legacy protocols that cannot ask for a second factor.

In Microsoft 365, security defaults enforce MFA at no extra cost. Conditional access, included in Microsoft 365 Business Premium, goes further: require MFA outside the office, relax it on managed devices, block sign-ins from countries where you have no activity. We compare the editions in Microsoft 365 Business Basic, Standard or Premium.

5. Verify and maintain

MFA is a state to maintain, not a project to close. Every month: a report of accounts without MFA, a review of registered methods, a check of refused or unusual sign-ins. At every departure: immediate revocation of the account, open sessions and authentication methods. At every arrival: enrolment on day one, before access to data.

Special cases to plan for

Some accounts and situations do not fit the general pattern. Better to handle them before the switch than when someone is locked out.

• Shared mailboxes (contact, accounting, orders): nobody signs in to them directly. Each user accesses them with their own protected account, which also shows who did what.
• Service accounts (copiers, software that sends emails, sync jobs): they cannot answer an MFA prompt. They get minimal rights, a long password, and are only allowed from the company network.
• Contractors and subcontractors: one named account per person, protected by MFA, with an end date. Never a generic account shared between several people.
• Employees without a work smartphone: a hardware key or a temporary-code app on the computer solves it, without imposing a personal phone.
• Areas without mobile coverage: authenticator apps generate codes offline, which SMS cannot do.

The mistakes we fix most often

• Protecting email but forgetting the VPN, or the reverse: the attacker walks through the door left open.
• Leaving legacy email protocols enabled that bypass MFA with a simple password.
• Accepting prompt floods: a tired user ends up approving a notification they did not trigger. Number matching solves this.
• Resetting MFA on a simple phone call: the favourite technique of fraudsters posing as an employee.
• “Temporarily” exempting an executive who finds it inconvenient: precisely the most targeted account.
• Forgetting shared and service accounts, with no owner and no control.

Rollout checklist

• Separate administrator accounts protected by hardware key or app.
• One or two documented and monitored emergency accounts.
• MFA active on VPN, webmail, remote desktop and business portals.
• Legacy email protocols blocked.
• Method chosen for each group, SMS as a last resort.
• Reset procedure with identity verification.
• One-page user guide and help desk on enrolment day.
• Monthly report of accounts without MFA and review of departures.

How we do it

We start with an assessment: which accounts exist, which are administrators, which access points are exposed, which applications still use legacy protocols. We then protect critical accounts the same day and roll out in waves with your team, handling enrolment and support. Once in place, tracking accounts without MFA and suspicious sign-ins is part of our 24/7 monitoring.

MFA is included in our managed cloud service, as a Microsoft partner, and in the fundamentals of our cybersecurity offer. It is also the first building block of a Zero Trust approach and one of the seven measures against ransomware. Browse our case studies, then request your free initial audit: we will show you which accounts are exposed today and where to start, with a reply within 24 business hours.