Turn on MFA for Microsoft 365 and Google Workspace

A company mailbox is not only mail. It holds invoices, customer files, and the reset links for everything else. It is also where a fake “sign this document” message goes to work. Microsoft 365 and Google Workspace will open that mailbox for anyone with the password. People reuse passwords, and they type them into pages that look right. A password on its own is a weak door.

Multi-factor authentication, MFA for short, asks for a second proof: a code, or a prompt, on a phone the person is holding. Turn it on for every account that can reach company mail and files, including the director who only reads mail on the phone and the shared login used from three PCs. The account you leave out is the one that gets used.

Both products include this. Switching it on is a settings change. The work is sitting with each person while they enrol. We treat it as part of company email, not an optional extra.

Prefer an authenticator app. Microsoft Authenticator, Google Authenticator, or another well-known app makes the code on the phone, or asks the person to tap Approve. The code is not sent over the mobile network. Text messages can be intercepted, and a SIM can be moved to another phone by someone who has talked a telco into it. SMS is better than a password alone. Use it for someone who truly cannot run an app, not as the setting for the whole office.

Enrol one person at a time and watch the next login succeed. Keep the recovery codes, or the admin reset, somewhere the company controls. When a phone is lost, someone must be able to reset the authenticator after checking who is asking. That is a short job when the process exists, and a locked office when it does not.

“Remember this browser” and old app passwords are how MFA gets quietly switched off. Use them only for a specific old app that cannot sign in any other way, and write down which one.

If MFA is still off, or only one person has it, that is the place to start. We turn it on and sit with each person while they enrol. WhatsApp us, or use the contact page, and say whether the company is on Microsoft 365 or Google Workspace.