Security & Privacy
Setting up multi-factor authentication step by step
A practical guide for anyone rolling out multi-factor authentication: decide who needs it first, choose the factors that fit their work, and plan recovery before turning enforcement on.
01
Step one: map accounts by risk
Start by listing every account that can change money, data or permissions, then rank them by damage if taken over. Administrator accounts, email, billing and code repositories usually come first. Worked example: a ten-person agency lists its email admin, accounting tool, cloud console and shared password vault as the top four. Enforcing a second factor there protects the most while affecting the fewest daily tasks. Lower-risk tools can follow in a later wave. This ranking also gives you a simple message for staff: here is what changes this week, why it matters, and which accounts come next.
02
Step two: choose factors people will use
Pick the strongest factor your people will actually keep using. Authenticator apps and hardware security keys resist phishing better than text messages, though text codes may be a reasonable fallback for occasional users. Continuing the agency example, the owner issues hardware keys to the four administrators and asks everyone else to install an authenticator app on their phone. Write a one-page instruction with screenshots, and offer a short setup session. Test the process yourself on a spare account first, so you can answer questions about scanning codes, naming devices and what to do with a new phone.
03
Step three: plan recovery, then enforce
Before requiring the second factor, decide how locked-out people will get back in. Generate backup codes, store them in a protected place, and name who can verify identity and reset a factor. In the agency example, the office manager holds sealed backup codes for the administrators, and resets require a video call with the owner. Announce an enforcement date, give a grace week, then switch the policy on. Afterward, review sign-in reports for repeated failures, retire lost devices promptly, and revisit the plan each quarter as staff and tools change.