What the standard says
CISA describes MFA as a layered approach that requires two or more ways of proving who you are before you get into an account [1]. Not all second steps are equal. CISA ranks them from weakest to strongest: a code by text message or email, an authenticator app, a push prompt, and FIDO, which uses a security key or your device’s fingerprint or face check [1]. It calls text messages the weakest form and says to use them only when nothing else is offered [1]. Google’s Workspace guidance agrees and discourages text messages because they can be intercepted [5].
NIST’s current authentication guidance treats codes sent over the phone network as restricted, and says one-time codes typed into a login page are not phishing-resistant [6]. Phishing-resistant MFA, like security keys and passkeys, won’t hand a login to a fake website even if you’re fooled [2][6].
Both major email platforms build MFA in at no extra cost:
Microsoft 365: “security defaults” are free and require every user to register for MFA and administrators to use it on every sign-in. They also block older sign-in methods that skip MFA [3]. Since 2024 and 2025, Microsoft also requires MFA to sign in to its admin portals, including the Microsoft 365 admin center [4].
Google Workspace: 2-Step Verification can be made optional or required, and Google enforces it for administrator accounts [5].
CISA suggests starting with the accounts that can do the most damage: administrators and IT staff [2].
What you’ll hear
“Turn on MFA and you can’t be hacked.”
MFA blocks most password-based break-ins, and it’s one of the most effective single steps a business can take. It isn’t a force field, though. Text-message codes can be stolen through SIM swaps, and any typed code can be captured by a convincing fake login page [2]. Push prompts can be abused by sending approval requests until someone taps “Approve” to make them stop [2]. CISA’s answer to that is number matching, where you type a number shown on the screen into your phone [2].
The fair version: MFA isn’t optional anymore, and the type you use matters, especially for administrators.
What the numbers say
99.22%: how much MFA reduced the risk of account compromise in a Microsoft study of Azure Active Directory accounts with suspicious activity, April to September 2022 [7]. For about 128,000 accounts whose passwords had already leaked, the reduction was 98.56% [7].
Microsoft’s own documentation repeats it: MFA can block “more than 99.2% of account compromise attacks” [4].
Publisher: Microsoft researchers, posted as a preprint in May 2023 [7]. Sample: commercial Microsoft accounts, not broken out by business size. Funder: Microsoft, which sells MFA and identity products. Fit for a small business: reasonable, since most small businesses sign in through Microsoft 365 or Google Workspace. The figure measures account takeover only, not every kind of attack, and it doesn’t separate weak methods like text messages from strong ones.
What we’ve seen
We haven’t run into this yet.[1]. Not all second steps are equal. CISA ranks them from weakest to strongest: a code by text message or email, an authenticator app, a push prompt, and FIDO, which uses a security key or your device’s fingerprint or face check [1]. It calls text messages the weakest form and says to use them only when nothing else is offered [1]. Google’s Workspace guidance agrees and discourages text messages because they can be intercepted [5].
Putting it together
MFA closes the most common way into a business: a password someone stole, guessed or found in an old breach. It’s free on the platforms most businesses already use. The work is in the details: covering every account (including shared mailboxes, your website host and your domain registrar), getting everyone enrolled, and using stronger methods for anyone with admin access.
What good looks like
MFA required for every user, not just available.
Administrators on phishing-resistant MFA, like security keys or passkeys.
An authenticator app or passkey for everyone else, with text messages only as a last resort.
Number matching turned on if you use push prompts.
Older sign-in methods that skip MFA turned off.
MFA on the accounts outside email too: your domain registrar, DNS, website host, banking and any software with client data.
Questions for your IT resource
Is MFA required for every account, or only turned on for some?
Which method do our administrators use?
Are older sign-in methods that skip MFA blocked?
Which accounts outside Microsoft 365 or Google Workspace still sign in with just a password?
If we carry cyber insurance, does our setup match what we told the insurer about MFA?
Related learning
What is DMARC?
DMARC is a DNS record that tells other mail servers what to do with email that claims to come from your domain but can’t prove it.
How we put together your Free Security Assessment
The Free Security Assessment is a review of what’s already public about your business: your email setup, domain, website, phone listings and anything left open to the internet. We make one ordinary visit to your home page and never scan, log into or test anything.
Related services
Sources
CISA, Multi-Factor Authentication. (checked 2026-10-07)
CISA, Implementing Phishing-Resistant MFA, October 2022. (checked 2026-10-07)
Microsoft, Security defaults in Microsoft Entra ID, Microsoft Learn, updated June 2026. (checked 2026-10-07)
Microsoft, Plan for mandatory Microsoft Entra multifactor authentication, Microsoft Learn, updated April 2026. (checked 2026-10-07)
Google, Protect your business with 2-Step Verification, Google Workspace Help. (checked 2026-10-07)
NIST, SP 800-63B-4: Digital Identity Guidelines, Authentication and Authenticator Management, August 2025. (checked 2026-10-07)
Meyer et al., Microsoft, How effective is multifactor authentication at deterring cyberattacks?, May 2023. (checked 2026-10-07)
How we rate these. Our judgment from real setups, applied the same way on every page. Cost: $ = no new spend or under $25/month · $$ = a modest monthly tool or a short project · $$$ = new hardware, licensing, or a larger project. Effort: Light = one sitting · Moderate = setup plus follow-up over days or weeks · Heavy = planning, testing and staff changes. Outlined marks show how far it can go for some businesses. N/A = doesn’t apply to this topic. Time to fix: how long the first useful step takes, then how long until it’s fully done. Ratings are typical averages, not quotes. Time to fix: the filled dot is when the first useful step lands, the hollow dot is when it’s fully done. Who can do it: highlighted chips are who can reasonably handle it.