MFA in an afternoon: the simplest thing you can do this week

If you do one security thing this week, do this. Turn on multi-factor authentication (MFA) properly across Microsoft 365, your accounting system and your remote access. It's the single biggest security win for the smallest amount of effort, and it's in every managed client's baseline for exactly that reason.

Now — the usual objections.

"My team will hate it." Fair. And they're often right about the version they've been given. Push notifications every ten minutes, weird QR codes on someone else's phone, being locked out because a battery died. That's not MFA doing its job; that's MFA badly configured.

"We already turned it on." Great. Turned it on where? For which accounts? What happens when a mailbox rule quietly disables it for a shared inbox? Half the businesses we do a health check on have MFA "on" and half a dozen accounts where it isn't — usually the ones with the most access.

"SMS is fine, right?" Not really. SIM swaps and interception are common enough now that SMS codes are treated as legacy in most modern frameworks. Use an authenticator app or, better, a phishing-resistant method like passkeys.

Here's what a proper MFA rollout looks like when we do it

• We audit every account — including service accounts and shared inboxes — not just the ones that look like people.
• We enforce a phishing-resistant method wherever the platform supports it, and Authenticator app as the default fallback.
• We turn on Conditional Access so trusted, managed devices don't get hit with prompts constantly, and unusual sign-ins (new country, weird time) get hit with more of them.
• We give your team a short, plain-English walkthrough so day one isn't chaos.
• We test it — including what happens when someone loses their phone.

The whole thing usually takes an afternoon for a small team. The alternative is one credential-stuffing attack away from a very bad Monday.