Sooner or later, every password leaks somewhere: reused on a site that gets breached, typed into a fake login page, written on a sticky note next to the screen. Two-factor authentication (also called MFA, 2FA or two-step verification) means a stolen password is no longer enough to get in. On Safeonweb@work, the Centre for Cybersecurity Belgium (CCB) recommends making it mandatory for every employee who uses company applications such as email or accounting, for anyone who connects remotely, and for anyone with admin rights.
Switching it on takes minutes. The part that needs care is doing it for a whole team without the bookkeeper being locked out on a Monday morning or the scanner suddenly no longer emailing its PDFs. Here is the order I would follow in a business of five to thirty people.
1. List the accounts that matter
Before you touch a single setting, write down on one page the services where an intruder could do real damage. Most small businesses end up with the same list:
- email (Microsoft 365 or Google Workspace), which comes first because it is how nearly every other password gets reset;
- accounting, invoicing and the ERP, Odoo included;
- remote access: VPN, remote desktop;
- admin consoles: domain name and DNS, hosting, firewall, cloud services.
For each line, note who has an account and whether two-factor authentication is already on. If you are not sure who holds the admin access to your domain or your email, sort that out first; our article on domain names and admin accounts covers it.
2. Find what will break
Lockouts almost always come from the same places. Better to find them before you enable anything.
- Shared accounts. An info@ or accounts@ address that three people sign in to with the same password does not sit well with a second factor tied to one person's phone. The clean fix is a shared mailbox (Microsoft 365) or a collaborative inbox (Google Workspace) that everyone opens with their own account.
- Devices that send email on their own: a multifunction scanner, line-of-business software, an old script. If they sign in with just a username and password, they will stop working once legacy authentication is blocked. Microsoft explicitly warns about this before you turn on its security defaults.
- Old email clients: a very old version of Outlook, or a mailbox set up over IMAP or POP on a phone. They cannot ask for the second factor.
- Staff without a work smartphone. Decide before the day: an app on their personal phone, with their agreement, or a physical security key.
3. Pick the method
Not all methods are equal. The CCB describes codes sent by text message or phone call as the least secure option. For a team, the sensible choice is an authenticator app on the phone. With Microsoft 365 security defaults, users register with Microsoft Authenticator. Google Workspace and Odoo accept apps that generate time-based codes, such as Google Authenticator or Microsoft Authenticator.
For admin accounts, aim higher: a physical security key or a passkey. Microsoft recommends them for emergency access accounts, and Google Workspace lets you require security keys for a specific group of users.
4. Admins first, then the whole team
Start with the admin accounts. Since February 2025, Microsoft has been gradually requiring a second factor to sign in to the Microsoft 365 admin center, and Google enforces it for Workspace administrators. If an admin account elsewhere, at your hosting provider or in Odoo for instance, still gets in with a password alone, fix that one first. Also set up an emergency account that belongs to no one in particular, protected by a physical key kept somewhere safe: it is what gets you back in if your only admin loses their phone. Microsoft actually recommends having two.
Next, tell the team in writing a few days ahead: what is changing, why, from which date, and which app to install. That is exactly what Google suggests putting in this message. Then do the enrolment together, in a meeting room or on a video call. Everyone installs the app, scans the QR code (on Microsoft 365, from the security info section of myprofile.microsoft.com), then signs out and back in to check that it works. Safeonweb ends its procedure with that check, and it is the step people skip.
Where a service offers backup codes, have them printed or written down, and keep them somewhere other than the phone that acts as the second factor.
5. Make it mandatory
As long as it stays optional, part of the team will never turn it on. Once everyone has enrolled, enforce it:
- Microsoft 365: without a Business Premium or Entra ID P1 licence, use security defaults, under Properties in the Microsoft Entra admin center. They are on by default for tenants created since October 2019, so check that nobody has switched them off in the meantime. With Business Premium, you use Conditional Access instead.
- Google Workspace: Admin console, Security, Authentication, 2-Step Verification. You can set an enforcement date and give new starters a grace period to enrol.
- Odoo: in recent versions, Settings, Permissions section, the option that enforces two-factor authentication for employees. On some versions you first need to install the "2FA by mail" module.
The day a phone goes missing
It will happen. Decide now who can reset a colleague's second factor, and how to reach them. In Odoo, an administrator has to disable two-factor authentication on the account before the user can sign in again. In Microsoft 365, an admin can require the user to register again; in Google Workspace, an admin can generate backup codes for the user. Put that name and number on your printed emergency sheet.
Give the whole team one simple rule as well: if you get a sign-in request you did not trigger yourself, deny it and tell someone. It means somebody already knows the password, which then needs changing. This kind of repeated prompting is exactly why Microsoft Authenticator asks you to type a number shown on screen rather than just tap "Approve".
The slow part of this job is not switching it on; it is the inventory and the special cases. If you would rather do it with someone, or just have what is already in place checked, this is the kind of accounts-and-access work we do through an IT expertise hour pack: info@z80.be or +32 494 111 041.