Multi-factor login (MFA), explained

If you only do one thing to protect your business accounts, make it this. Since April 2026 it's also an automatic-fail item in Cyber Essentials if it's missing on cloud services.

What it is

Multi-factor authentication, also called MFA or two-step verification, means logging in with two things: something you know (your password) and something you have (usually your phone or a security key). A criminal who steals your password still can't get in without the second part.

The main types, from good to best

• Text message codes: much better than nothing, but codes can be intercepted or phished.
• Authenticator apps such as Microsoft Authenticator or Google Authenticator, which show a code or ask you to approve the login. A good default for most businesses.
• Security keys and passkeys: the strongest option, and very hard to phish. The NCSC now recommends passkeys wherever a service supports them.

Where to turn it on first

1. Email: Microsoft 365 or Google Workspace. If someone gets into your email, they can reset almost everything else.
2. Admin accounts for anything: your domain, website, cloud services and IT tools.
3. Banking, payroll and accounting software.
4. Remote access such as a VPN or remote desktop.
5. Everything else that offers it, including social media accounts that hold your business pages.

In Microsoft 365 and Google Workspace, the admin can make MFA required for everyone from the admin console, so it isn't left to each person.

Tips that save headaches

• Save the backup codes somewhere safe, such as a password manager, in case a phone is lost.
• Never approve a login prompt you didn't start. Attackers sometimes send repeated prompts hoping someone taps "yes" to make them stop.
• Remove access promptly when staff leave.

How this connects to Cyber Essentials

Under the Danzell rules in force since 27 April 2026, cloud services can't be left out of scope, and failing to use MFA where it's available is an automatic fail. Getting MFA right is one of the biggest steps towards passing. Read more in our guide to the April 2026 changes.