Turn On MFA and Passkeys

Turn On MFA and Passkeys

Add a second lock to your logins so a stolen password isn't enough to get in - starting with the account that matters most.

When to use

Setting up a new account or business tool, after any password scare, when a staff member joins or leaves, or whenever you want to "secure my logins", "turn on two-factor / 2FA", "set up an authenticator app", or "use passkeys".

Steps

1. List your most important accounts and do email first - your email is the master key that can reset everything else. Then banking, accounting (e.g. Xero or MYOB), payroll, your domain and website host, and social media. 2. In each account's security settings, turn on multi-factor authentication (also called 2FA, two-step verification, or MFA). 3. Choose the strongest method offered. A passkey or an authenticator app is stronger than an SMS code; use SMS only when it's the only option. 4. Set up passkeys where they're offered - they use your device's fingerprint, face or PIN, can't be phished, and leave nothing to steal or reuse. 5. Save your backup or recovery codes somewhere safe (your password manager) so you aren't locked out if you lose your phone. 6. Add a second factor or device where you can - a backup phone or security key - so one lost phone doesn't lock the whole business out. 7. Roll it out to the team, most sensitive accounts first, and make turning on MFA a standard step when onboarding new staff.

When to call a professional

If you get locked out of a critical account, or you want to enforce MFA for every staff member across Microsoft 365 or Google Workspace (tenant-wide or conditional-access rules), ask your IT provider or MSP to set it up.

ACSC reference: Essential Eight - Multi-factor authentication; also in the ACSC Small Business Cyber Security Guide (cyber.gov.au/smallbusiness).