We've never turned on two-step login: how to set up two-factor authentication for your business
⏱ In about 9 minutes
Affiliate disclosure: Some links on this page may become affiliate links. If you buy, we may earn a commission at no extra cost to you. Commissions may influence which products we choose to cover, but not our assessment of them. Read the full disclosure.
In this article
The short answer
Short answer
Two-factor authentication (2FA, also called two-step verification or multi-factor authentication, MFA) means a stolen password alone can't get someone into your accounts. Turn it on today, starting with email, then banking, accounting, cloud storage, your website domain and social media.
Use an authenticator app, passkey or security key where you can, and SMS codes where that's all that's offered. It's free, and for most businesses the most important accounts can be done in about an hour. A password manager with a built-in authenticator, such as 1Password or Proton Pass, makes it easier for the whole team.
Why this is the highest-value hour you'll spend this year
- Passwords get stolen; 2FA stops them being enough. The ACSC calls MFA "one of the most effective ways to protect business accounts", because "a stolen password alone can't be used to gain access to an account." (ACSC)
- Stolen logins are a business. The ACSC's threat report says criminals are "purchasing stolen usernames and passwords from the dark web to access personal email, social media or financial accounts." (ACSC Annual Cyber Threat Report 2024–25)
- Your inbox is the master key. The UK NCSC says to use 2SV on email "as criminals with access to your inbox can use it to reset passwords on your other accounts." (NCSC)
- Any 2FA beats none. The NCSC says plainly: "Any 2-step verification is better than not having it at all." (NCSC)
Which accounts first
Do them in this order. Each one usually takes 5–10 minutes.
- Email (Microsoft 365, Google Workspace or similar), for every staff member, starting with the owner and admins.
- Banking and payment accounts.
- Accounting software.
- Cloud storage where your files live.
- Your domain name registrar and website admin. Whoever controls your domain controls your email and website. The ACSC tells businesses to "protect your domain names". (ACSC)
- Social media and advertising accounts.
- Your password manager itself.
The ACSC's own starting list is "email, banking, cloud storage, accounting software and social media." (ACSC)
App vs SMS vs passkeys: which to choose
| Method | How it works | Our take, based on official guidance |
|---|---|---|
| Passkey | Sign in with your device's fingerprint, face or PIN instead of a password | Strongest everyday option where offered. The ACSC says passkeys help "prevent cybercriminals tricking you to log in to a fake website." |
| Security key | A small physical key you plug in or tap | Very strong. Good for the owner, admins and finance. |
| Authenticator app | An app generates a new code every 30 seconds | Good default. The NCSC notes apps work without a mobile signal. |
| SMS or email code | A code is texted or emailed to you | Better than nothing, but the ACSC calls it "the least secure option due to the ease in which SMS and email accounts can be compromised." |
The US Cybersecurity and Infrastructure Security Agency (CISA) goes further for organisations: "phishing-resistant MFA is the standard all industry leaders should strive for, but any MFA is better than no MFA." (CISA) Passkeys are built on the FIDO standards CISA refers to. (FIDO Alliance)
Fix it: the rollout checklist
The time guides are rough, for a team of about 5–20 people.
Step 1: Do the owner's and admins' accounts yourself (about 1 hour)
Look under each account's security settings. CISA's tip: it "may be called two-factor authentication, two-step authentication or similar." (CISA) Choose an authenticator app or passkey if offered.
Step 2: Save backup codes somewhere safe (10 minutes)
Most services give you one-time backup codes. The NCSC says these are "really useful if you need to log on without a phone to hand" and that you'll "need to store the codes somewhere safe." (NCSC) A password manager's secure notes are a good place. Make sure at least two trusted people can recover critical accounts.
Step 3: Announce it yourself, then roll it out to staff (1 week)
CISA's advice to business leaders: "do not rely on the IT team to persuade busy staff that they must enable MFA. Instead, make the MFA announcement to the staff yourself and keep track of the progress." (CISA, Cyber guidance for small businesses) Give people a deadline and a 10-minute slot to do it together.
Step 4: Switch it from "optional" to "required" (30 minutes)
Most business email and password manager admin consoles let you enforce 2FA for everyone. CISA puts it bluntly: "Ensure MFA is mandated using technical controls, not faith." (CISA)
Step 5: Check monthly for gaps (10 minutes a month)
CISA notes "there are often MFA gaps for recently onboarded staff and for people who have migrated to a new phone." Add 2FA to your new starter checklist and re-check after anyone changes phone.
Quick pick
Quick pick: password managers with built-in 2FA codes (product details from official vendor pages, checked 18 Oct 2026. Not hands-on tested. No ratings. Confirm prices and features on the vendor's site.)
- Best for most small teams: 1Password. Can store and autofill one-time 2FA codes for your sites (1Password support), and its business pricing page lists support for passkeys and admin-enforced policies. Teams Starter Pack listed at US$24.95/month billed annually for 10 members. 14-day free trial. → See our password manager guide
If you're on a tight budget: Proton Pass. Pass Essentials includes a "built-in 2FA authenticator" and passkey support, listed at US$1.99 per user/month billed yearly (minimum 3 users) at a discounted rate. 14-day business trial. → See our password manager guide
Prefer a separate app? A standalone authenticator app is free and works well too. Compare password managers in our small team guide.
Honest limits
Free: the Small Business Password & Access Checklist
A 1–2 page checklist that turns this article into a to-do list: which accounts to protect first, how to set up shared access, and what to do when someone joins or leaves.
You only get emails if you tick the consent box. Unsubscribe any time. See our privacy policy.
Frequently asked questions
Do we have to enter a code every time we log in?
Usually not. The NCSC says you should "only be asked for it when you're doing something where it would really matter", such as logging in from a new device. (NCSC)
What if an important account doesn't offer 2FA?
Use a long, unique password from your password manager. The NCSC also suggests you "may even want to consider changing services to one that does offer 2-step verification."
Is a text message code really that bad?
It's much better than no 2FA. It's just the weakest kind. Upgrade to an app or passkey where you can.
What about staff who don't have a work phone?
Options include a security key, a passkey on their work computer, or an authenticator on their personal phone if they agree. Don't let it become a reason to skip 2FA.
Related guides
- Cybersecurity tools · Password managers
- My staff reuse passwords: how to fix it this week
- 10-step basic cybersecurity checklist
- Which password manager should my small team use? · Which email tool is easiest?
Sources
Government bodies first. All links checked and loading on 18 Oct 2026.
- Australian Cyber Security Centre: Securing accounts and identities · Common cyber threats to small businesses
- Australian Cyber Security Centre: Annual Cyber Threat Report 2024–25
- UK National Cyber Security Centre: Setting up 2-step verification (2SV)
- US Cybersecurity and Infrastructure Security Agency: Turn on MFA · More than a password (MFA) · Cyber guidance for small businesses
- FIDO Alliance: Passkeys
- Vendor pages (checked 18 Oct 2026): 1Password: use 1Password as an authenticator · 1Password business pricing · Proton Pass for business
About our review process
We pick products from official information and say clearly when we haven't tested something hands-on. Commissions may influence which products we choose to cover, but not our assessment of them. See how we work.