How to turn on MFA for a small team in Microsoft 365 and Google Workspace

Stolen passwords are behind a large share of small business account takeovers, and multi-factor authentication (MFA) stops most of them. This guide shows a small team how to require MFA in Microsoft 365 and in Google Workspace, roll it out without locking anyone out, and check that everyone has enrolled. Pick the section for the service you use.

The Canadian Centre for Cyber Security (Cyber Centre) recommends MFA wherever possible to protect high-value business services, and it is one of the baseline controls in the federal CyberSecure Canada certification program. The Cyber Centre also warns about "MFA fatigue", where an attacker sends push prompts until someone taps approve, and recommends number matching and phishing-resistant options such as security keys and passkeys.

Step 1: Plan the rollout

1. List every account. Include shared mailboxes that people sign in to directly, former staff accounts that were never deleted and the accounts of outside bookkeepers or IT providers.
2. Pick a date and tell people. Google's deployment guide suggests explaining what MFA is, whether it is required, the deadline and the preferred method. A short email and a 15-minute walk-through at a staff meeting usually does it.
3. Choose methods. An authenticator app is the practical default. Security keys or passkeys are stronger and are worth it for the owner, anyone who approves payments and administrators. Avoid relying on text messages where you can.
4. Plan for lost phones. Decide who resets a staff member's MFA and how you will confirm the person's identity before doing so, for example a video call or in-person check, never just an email.

Step 2 (Microsoft 365): Turn on security defaults

Microsoft says tenants created after October 2019 usually have security defaults on already, but many older or reseller-created tenants do not. Security defaults are free with every Microsoft 365 plan. They require all users to register for MFA, require MFA for administrators every time they sign in, prompt other users when Microsoft judges it necessary, and block legacy sign-in protocols that cannot do MFA.

1. Sign in to the Microsoft Entra admin center with an account that has at least the Conditional Access Administrator or Security Administrator role.
2. Browse to Entra ID > Overview > Properties (older menus show Identity > Overview).
3. Scroll to the security defaults section. If it reads "Your organization is protected by security defaults", you are done with this step.
4. Otherwise select Manage security defaults, set Security defaults to Enabled and select Save.

Microsoft notes that the old 14-day grace period for users to register was removed in July 2024, so people will be asked to set up MFA at their next sign-in. Under security defaults, users register the Microsoft Authenticator app with notifications, which show a number they must type into the app. Codes from another authenticator app that supports the OATH TOTP standard also work.

Microsoft recommends revoking existing sign-in sessions after enabling security defaults so everyone is forced to register. You can do this per user in the Microsoft 365 admin center or with the Revoke-MgUserSignInSession command in Microsoft Graph PowerShell.

If you have Microsoft 365 Business Premium

Business Premium includes Microsoft Entra ID P1, which allows Conditional Access policies for finer control, such as requiring phishing-resistant MFA for admins. Security defaults and Conditional Access cannot run at the same time. Microsoft's documented path is:

1. Create at least two emergency access ("break glass") admin accounts that are not tied to a person, with long random passwords stored offline.
2. Turn off security defaults, choosing My organization is planning to use Conditional Access as the reason.
3. Go to Conditional Access > Policies, select New policy from template, and on the Secure foundation tab create the templates that recreate security defaults: Require multifactor authentication for all users, Require MFA for administrators (or the phishing-resistant version), Block legacy authentication and Require MFA for Azure management.
4. Set each policy state to On and exclude only the emergency access accounts.

Do not leave a gap between turning off security defaults and turning on the policies. If you do not need the extra control, stay on security defaults.

Step 3 (Google Workspace): Allow, then enforce, 2-Step Verification

Google calls MFA 2-Step Verification (2SV). Google is already enforcing 2SV for administrator accounts. You must be signed in as a super administrator for these settings.

1. In the Google Admin console, go to Menu > Security > Authentication > 2-step verification.
2. Check Allow users to turn on 2-Step Verification, leave Enforcement set to Off for now and click Save.
3. Ask staff to enrol from their own Google Account under Security, choosing a security key, passkey, Google prompt or the Google Authenticator app, and to save backup codes somewhere safe.
4. Track progress under Menu > Reporting > User Reports > Security, which shows each user's 2SV enrolment and enforcement status.
5. When everyone is enrolled, return to the 2-step verification page. Under Enforcement, choose On to start immediately, or Turn on enforcement from date. Google says date-based enforcement begins within 24 to 48 hours of the chosen date.
6. Set a New user enrollment period (one day to six months) so new hires can sign in long enough to enrol.
7. Under Methods, pick Any, Any except verification codes via text, phone call or Only security key. Google says the last option now accepts passkeys too. If you block text and call codes, move users off them first or they will be locked out.
8. Leave Allow user to trust the device unchecked unless staff move between many devices. Click Save.

To give one person more time, Google suggests temporarily placing them in a group where 2SV is not enforced, but it advises against doing that routinely.

Step 4: Help staff enrol

• Microsoft users can add or change methods on their Security info page at mysignins.microsoft.com/security-info.
• Ask everyone to register a second method, such as a second phone or a security key, so one lost device does not mean a help call.
• Tell staff plainly: if an MFA prompt appears when you are not signing in, deny it and tell the owner or IT contact right away. Someone has your password.

Step 5: Check and maintain

1. One week after the deadline, check the enrolment reports again and follow up with anyone missing.
2. Remove accounts for people who have left. A dormant account without MFA is an easy target.
3. Review admin roles. Keep the number of global or super administrators to two or three, each with phishing-resistant MFA.
4. Repeat the check every quarter and whenever you hire.

What to do if an account is taken over

Reset the password, revoke sessions, reset the user's MFA methods and check mailbox forwarding and inbox rules, which attackers often add to hide replies. If client personal information may have been exposed, assess whether the breach must be reported to the Office of the Privacy Commissioner of Canada under PIPEDA (or to the Commission d'accès à l'information in Quebec). Report fraud to the Canadian Anti-Fraud Centre at reportcyberandfraud.canada.ca, and report cyber incidents to the Cyber Centre.

Sources

• Microsoft Learn: Security defaults in Microsoft Entra ID
• Microsoft Learn: Set up multifactor authentication for Microsoft 365
• Google Workspace Admin Help: Deploy 2-Step Verification
• Canadian Centre for Cyber Security: Secure your accounts and devices with multi-factor authentication (ITSAP.30.030)