MFA for Every Employee: A Step-by-Step Setup Guide (M365 and Google)

Multi-factor authentication (cybersecurity essentials for small businesses) blocks 99.9% of automated credential attacks and is now mandatory for all Microsoft 365 admin accounts as of February 2026. For Microsoft 365 businesses, Conditional Access policies are the recommended enforcement method; for Google Workspace, 2-Step Verification is enforced through the Admin console. This guide covers both platforms step-by-step, including a PowerShell audit script for M365 tenants.

Multi-factor authentication stops over 99.9% of automated account compromise attacks. Microsoft has published this statistic repeatedly, Google has confirmed similar numbers, and every major how to tell your IT provider is keeping you secure framework in 2026 lists MFA as a non-negotiable baseline control. You already know you need it. The question is not whether to enable MFA — it is how to deploy it across your entire team without causing a mutiny.

Because here is the reality: MFA deployment in a small business is 10% technology and 90% change management. The technical setup takes thirty minutes. Getting fifteen employees to actually complete their enrollment, stop complaining about the extra step, and not lock themselves out of their accounts on a Friday afternoon — that takes planning. If this resonates, our post on How to Run a Security Audit on Your Own Business (Free Checklist) goes deeper into the specifics.

Multi-factor authentication (MFA) requires users to verify their identity with two or more factors: something they know (password), something they have (phone or security key), or something they are (fingerprint or face). For Microsoft 365 businesses, MFA is now mandatory for all admin accounts as of February 2026, and Conditional Access policies are the recommended enforcement method. For Google Workspace, 2-Step Verification can be enforced organization-wide through the Admin console. This guide walks through both platforms step-by-step, including a PowerShell script to audit and enforce MFA across your M365 tenant.

Why MFA Is No Longer Optional

Let me be blunt about the timeline here. Microsoft began enforcing mandatory MFA for all admin center sign-ins on February 9, 2026. If your admin accounts do not have MFA enabled, your administrators are already being locked out of the portal that manages your users, licenses, security settings, and company data.

But mandatory admin MFA is just the beginning. Microsoft’s Conditional Access enforcement rollout continues through June 2026, expanding MFA requirements beyond admin accounts. Organizations that have not proactively deployed MFA will find themselves reacting to lockouts instead of managing a controlled rollout.

And even without the mandates, the math is clear:

• 80% of breaches involve stolen credentials
• MFA blocks 99.9% of automated credential attacks
• 22% of breaches in the 2025 Verizon DBIR used stolen credentials as the initial access vector
• $254,445 is the average cost of a cyberattack on a small business

MFA is the single highest-ROI security investment any business can make. It costs nothing on most platforms. It takes minutes per user to configure. And it eliminates the most common attack vector against small businesses.

Microsoft 365 MFA: The Complete Setup

Option 1: Security Defaults (Fastest)

If you want MFA on immediately with minimal configuration, Security Defaults is the one-click option. It forces MFA registration for all users and prompts for MFA when sign-in risk is detected.

1. Sign into the Microsoft Entra admin center (entra.microsoft.com)
2. Go to Identity > Overview > Properties
3. Click Manage security defaults
4. Set the toggle to Enabled
5. Click Save

That is it. Every user in your tenant will be prompted to register for MFA at their next login. They get a 14-day grace period to complete registration.

When Security Defaults work: Small businesses with fewer than 25 users, no complex access requirements, and no need for granular control over who gets prompted when.

When Security Defaults do not work: If you need different MFA policies for different groups, if you have service accounts that cannot handle MFA prompts, or if you need to exclude specific apps or locations. In those cases, use Conditional Access.

Option 2: Conditional Access (Recommended)

Conditional Access gives you granular control. You decide who gets prompted for MFA, when, and under what conditions. This requires Microsoft Entra ID P1 or P2 licensing (included in Microsoft 365 Business Premium and Enterprise plans).

Step 1: Create the MFA policy.

1. Sign into entra.microsoft.com
2. Go to Protection > Conditional Access > Policies
3. Click New policy
4. Name it: “Require MFA – All Users”

Step 2: Configure assignments.

• Users: Include > All users
• Exclude: Create a break-glass admin account and exclude it (this is your emergency access if MFA fails)
• Target resources: Include > All cloud apps

Step 3: Set conditions (optional but recommended).

• Sign-in risk: Not configured (for simplicity) or Medium and High (if you have Entra ID P2)
• Device platforms: All platforms
• Locations: Not configured (enforce MFA everywhere) or exclude your office IP if you want MFA only for remote access

Step 4: Set the grant control.

• Grant: Require multi-factor authentication
• Click Select

Step 5: Enable the policy.

• Set Enable policy to On
• Click Create

Important: Before enabling for all users, set the policy to Report-only mode first. This shows you which sign-ins would trigger MFA without actually blocking anyone. Run in report-only for a week, review the sign-in logs, identify any service accounts or workflows that would break, and then switch to enforcement.

The PowerShell MFA Enforcement and Audit Script

Here is a comprehensive script that checks MFA status across your M365 tenant, identifies users without MFA, and generates an actionable report:

<#
.SYNOPSIS
    Microsoft 365 MFA Enforcement Audit & Report
.DESCRIPTION
    Connects to Microsoft Graph, checks MFA registration status
    for all users, identifies enforcement method per user, and
    generates a comprehensive compliance report.
.NOTES
    Requires: Microsoft.Graph PowerShell SDK
    Install: Install-Module Microsoft.Graph -Scope CurrentUser
    Permissions: UserAuthenticationMethod.Read.All, User.Read.All,
                 Policy.Read.All
    Version: 1.0 | PowerShell 5.1+
#>

# Install/update module if needed
$requiredModule = "Microsoft.Graph"
if (-not (Get-Module -ListAvailable -Name $requiredModule)) {
    Write-Host "Installing Microsoft.Graph module..." -ForegroundColor Yellow
    Install-Module $requiredModule -Scope CurrentUser -Force -AllowClobber
}

# Connect with required scopes
$scopes = @(
    "UserAuthenticationMethod.Read.All",
    "User.Read.All",
    "Policy.Read.All"
)
Connect-MgGraph -Scopes $scopes

Write-Host "`n==========================================" -ForegroundColor Green
Write-Host "  M365 MFA Compliance Audit Report" -ForegroundColor Green
Write-Host "==========================================`n" -ForegroundColor Green

# Get all active users
$users = Get-MgUser -All -Property `
    DisplayName, UserPrincipalName, AccountEnabled, `
    UserType, CreatedDateTime, Department |
    Where-Object { $_.AccountEnabled -eq $true -and $_.UserType -eq "Member" }

Write-Host "Scanning $($users.Count) active users...`n" -ForegroundColor Cyan

$report = @()
$noMFA = @()
$hasMFA = @()

foreach ($user in $users) {
    # Get authentication methods for this user
    $methods = Get-MgUserAuthenticationMethod -UserId $user.Id -ErrorAction SilentlyContinue

    # Separate password from MFA methods
    $mfaMethods = $methods | Where-Object {
        $_.AdditionalProperties.'@odata.type' -ne '#microsoft.graph.passwordAuthenticationMethod'
    }

    # Categorize each MFA method
    $methodDetails = @()
    foreach ($method in $mfaMethods) {
        $type = switch ($method.AdditionalProperties.'@odata.type') {
            '#microsoft.graph.microsoftAuthenticatorAuthenticationMethod' { 'Microsoft Authenticator' }
            '#microsoft.graph.phoneAuthenticationMethod' { 'Phone (SMS/Call)' }
            '#microsoft.graph.fido2AuthenticationMethod' { 'FIDO2 Security Key' }
            '#microsoft.graph.windowsHelloForBusinessAuthenticationMethod' { 'Windows Hello' }
            '#microsoft.graph.softwareOathAuthenticationMethod' { 'TOTP App' }
            '#microsoft.graph.temporaryAccessPassAuthenticationMethod' { 'Temporary Access Pass' }
            '#microsoft.graph.emailAuthenticationMethod' { 'Email' }
            default { 'Other' }
        }
        $methodDetails += $type
    }

    $mfaStatus = if ($mfaMethods.Count -gt 0) { "ENROLLED" } else { "NOT ENROLLED" }
    $strongMethod = $methodDetails | Where-Object {
        $_ -in @('Microsoft Authenticator', 'FIDO2 Security Key', 'Windows Hello', 'TOTP App')
    }

    $entry = [PSCustomObject]@{
        User           = $user.DisplayName
        Email          = $user.UserPrincipalName
        Department     = $user.Department
        MFA_Status     = $mfaStatus
        Method_Count   = $mfaMethods.Count
        Methods        = ($methodDetails -join ", ")
        Strong_Method  = if ($strongMethod) { "YES" } else { "NO" }
        Created        = $user.CreatedDateTime
    }

    $report += $entry

    if ($mfaStatus -eq "NOT ENROLLED") {
        $noMFA += $entry
    } else {
        $hasMFA += $entry
    }
}

# Display summary
$totalUsers   = $report.Count
$enrolledPct  = if ($totalUsers -gt 0) { [math]::Round(($hasMFA.Count / $totalUsers) * 100, 1) } else { 0 }
$strongPct    = if ($totalUsers -gt 0) {
    $strongCount = ($report | Where-Object { $_.Strong_Method -eq "YES" }).Count
    [math]::Round(($strongCount / $totalUsers) * 100, 1)
} else { 0 }

Write-Host "============ SUMMARY ============" -ForegroundColor Cyan
Write-Host "Total Active Users:    $totalUsers"
Write-Host "MFA Enrolled:          $($hasMFA.Count) ($enrolledPct%)" -ForegroundColor $(if ($enrolledPct -ge 95) { 'Green' } elseif ($enrolledPct -ge 75) { 'Yellow' } else { 'Red' })
Write-Host "NOT Enrolled:          $($noMFA.Count)" -ForegroundColor $(if ($noMFA.Count -eq 0) { 'Green' } else { 'Red' })
Write-Host "Strong MFA Method:     $strongPct%" -ForegroundColor $(if ($strongPct -ge 80) { 'Green' } else { 'Yellow' })
Write-Host "================================`n"

# Show users without MFA
if ($noMFA.Count -gt 0) {
    Write-Host "USERS WITHOUT MFA (ACTION REQUIRED):" -ForegroundColor Red
    $noMFA | Format-Table User, Email, Department, Created -AutoSize
}

# Show method distribution
Write-Host "`nMFA METHOD DISTRIBUTION:" -ForegroundColor Cyan
$allMethods = $report | Where-Object { $_.Methods -ne "" } |
    ForEach-Object { $_.Methods -split ", " } |
    Group-Object | Sort-Object Count -Descending
$allMethods | Format-Table @{L='Method';E={$_.Name}}, Count -AutoSize

# Check for SMS-only users (weaker MFA)
$smsOnly = $report | Where-Object {
    $_.MFA_Status -eq "ENROLLED" -and
    $_.Methods -match "Phone" -and
    $_.Strong_Method -eq "NO"
}
if ($smsOnly.Count -gt 0) {
    Write-Host "`nUSERS WITH SMS-ONLY MFA (upgrade recommended):" -ForegroundColor Yellow
    $smsOnly | Format-Table User, Email, Methods -AutoSize
}

# Export reports
$report | Export-Csv ".MFA-Full-Report-$(Get-Date -Format 'yyyy-MM-dd').csv" -NoTypeInformation
$noMFA | Export-Csv ".MFA-Not-Enrolled-$(Get-Date -Format 'yyyy-MM-dd').csv" -NoTypeInformation
Write-Host "`nReports saved to current directory." -ForegroundColor Green

# Disconnect
Disconnect-MgGraph | Out-Null

Let me walk you through what this script reveals and why each section matters:

MFA enrollment status — The primary output: which users have MFA configured and which do not. Every user in the “NOT ENROLLED” list is a single stolen password away from a breach. These are your immediate action items.

Strong MFA method detection — Not all MFA is created equal. SMS-based MFA (text message codes) is better than nothing but vulnerable to SIM-swapping attacks. The script identifies users who only have SMS and flags them for upgrade to a stronger method like Microsoft Authenticator or a FIDO2 security key.

Method distribution — Shows you the breakdown of MFA methods across your organization. If 80% of your team is using Microsoft Authenticator and 20% is using SMS, you know where to focus your upgrade efforts.

Department-level visibility — The report includes department data so you can identify if specific teams have lower adoption rates. If the sales team has 40% enrollment while engineering is at 100%, that tells you where to focus your rollout efforts.

Google Workspace MFA: The Complete Setup

Google Workspace makes MFA enforcement relatively straightforward through the Admin console.

Step 1: Enable 2-Step Verification Organization-Wide

1. Sign into admin.google.com
2. Go to Security > Authentication > 2-step verification
3. Check Allow users to turn on 2-Step Verification
4. Under Enforcement, select Turn on enforcement from [date]
5. Set the enforcement date to give employees a grace period (2 weeks recommended)
6. Choose New user enrollment period: 1 week (new hires must enroll within a week)
7. Under Methods, select allowed methods:
8. Security key (strongest)
9. Google Authenticator / TOTP app
10. Google Prompt (phone notification)
11. Phone number (SMS — allow but encourage upgrade)
12. Click Save

Step 2: Enforce by Organizational Unit (Phased Rollout)

If you want to roll out gradually:

1. In the same 2-Step Verification settings
2. On the left sidebar, select a specific Organizational Unit (e.g., “IT Department”)
3. Enable enforcement for that OU first
4. After one week with no issues, expand to additional OUs
5. Finally, enforce at the top-level organization

Step 3: Monitor Enrollment

1. Go to Reporting > User reports > 2-step verification enrollment
2. This shows you which users have enrolled and which have not
3. Export the report monthly and track progress
4. Users who have not enrolled by the enforcement date will be locked out on their next sign-in

Google Workspace Security Keys (Recommended for Admins)

For admin accounts and employees handling sensitive data, hardware security keys provide the strongest MFA available:

1. Purchase FIDO2-compatible security keys (Yubico YubiKey 5 series recommended, ~$50 each)
2. In admin.google.com > Security > Authentication > 2-step verification
3. Under Methods, you can restrict admins to security keys only
4. Have each admin register at least two keys (one primary, one backup stored securely)

The $50 per key is trivial insurance for accounts that control your entire organization.

The Employee Rollout Playbook

This is where most MFA deployments succeed or fail. The technology works. The humans need help.

Pre-Deployment (1 Week Before)

Send a clear, non-technical announcement:

Subject: Changes to how you log in (starts [date])

Hi team,

Starting [date], we are adding an extra security step to our email and business app logins. When you sign in, you will be asked to confirm your identity using your phone — similar to how your bank sends you a code when you log in.

This protects your account even if someone steals your password. It takes about 5 seconds per login and is something most of us already do for banking and personal email.

[IT person] will walk everyone through the setup during the week of [date]. It takes about 5 minutes. You just need your phone.

If you have questions, ask [IT person] directly.

Key elements of this communication: explain the why (protect your account), acknowledge the inconvenience (5 seconds), compare to something familiar (banking), and provide a human point of contact.

Enrollment Week

Option A: Group session (teams of 5-10)

• Book a 30-minute slot per group
• Walk through the enrollment process live
• Have everyone complete it in the room
• Troubleshoot issues on the spot

Option B: Individual support (for resistant or non-technical employees)

• Schedule 15-minute one-on-one sessions
• Sit with them and walk through step by step
• Set up their authenticator app while they watch
• Verify it works before they leave

Option C: Self-service with documentation (for technical teams)

• Send a step-by-step guide with screenshots
• Include a “verify your enrollment” link they can test
• Follow up with anyone who has not completed within 3 business days

Post-Deployment (First 2 Weeks)

Expect and plan for these issues:

“I got a new phone and cannot log in.” This is the number one MFA support request. Before enforcement, have every user add a backup method — a second phone number, backup codes, or a second authenticator device. For M365, ensure the organization admin can reset MFA methods. For Google, admin can turn off 2SV temporarily for locked-out users.

“The authenticator app shows the wrong code.” Time sync issue. On the phone, go to the authenticator app settings and sync the clock. On Android: Settings > Time correction for codes. On iOS: this is handled automatically.

“I do not have a smartphone.” Options: SMS to a basic phone (less secure but functional), a hardware security key ($25-50), or a desk phone that can receive calls with a verification code.

“This is too complicated.” Sit with the employee and watch them log in three times with MFA. After the third time, they will realize it adds five seconds and is not complicated at all. The resistance is to the idea of change, not the actual process.

Ongoing Management

Monthly: Run the MFA audit script (M365) or check the enrollment report (Google). Address any gaps.

Quarterly: Review MFA methods. Encourage users still on SMS to upgrade to an authenticator app. Consider requiring phishing-resistant MFA (security keys or passkeys) for admin accounts.

When employees leave: Disable the account immediately. Our guide on employee offboarding security covers the complete process.

When employees get new devices: Have a documented process for MFA migration. For Microsoft Authenticator, the app supports backup and restore. For Google Authenticator, the app supports account transfer between devices.

Advanced: Phishing-Resistant MFA

Standard MFA (authenticator app codes, SMS codes) protects against credential stuffing and brute force attacks. But sophisticated attackers can bypass it using real-time phishing proxies that capture both the password and the MFA code as the user enters them.

Phishing-resistant MFA — specifically FIDO2 security keys and passkeys — eliminates this risk. These methods use cryptographic authentication tied to the specific website, meaning a phishing site cannot intercept the authentication because the key will not respond to the wrong domain. For related strategies, check out Ransomware Protection for Small Businesses: The $0 Defense Stack.

For most small businesses, standard MFA is sufficient. But if you handle high-value financial transactions, sensitive personal data, or if your industry has been specifically targeted by sophisticated phishing campaigns, consider deploying FIDO2 security keys for all users — or at minimum for admin accounts and employees with access to financial systems.

Measuring Success

After 30 days of enforcement, you should see:

• 100% MFA enrollment (this is the minimum acceptable target — every active account has MFA)
• Under 5 support tickets per week related to MFA (decreasing week over week)
• Zero accounts using only SMS-based MFA for admin-level access
• Backup methods configured for at least 90% of users

Track these metrics monthly using the PowerShell script or Google Admin reports. They become part of your security posture baseline.

For businesses in Deltona and across Volusia County, our security services include managed MFA deployment, ongoing automated compliance reporting monitoring, and employee support. We also offer IT consulting in Deltona for businesses that need comprehensive security assistance.

The Bottom Line

The right technology setup saves time, reduces costs, and lets you focus on running your business instead of troubleshooting IT problems. Start with the fundamentals, implement them properly, and build from there.

Frequently Asked Questions

Is MFA mandatory for Microsoft 365 in 2026?

Yes. Microsoft enforced mandatory MFA for all admin center access starting February 9, 2026. Conditional Access enforcement is rolling out through March-June 2026, expanding MFA requirements to additional scenarios. If you have not deployed MFA yet, you are already behind.

Which MFA method is most secure?

FIDO2 security keys and passkeys are the most secure because they are phishing-resistant — they use cryptographic authentication tied to the specific website. Microsoft Authenticator with number matching is the next best. SMS-based MFA is the weakest but still dramatically better than no MFA.

How do I handle service accounts that cannot do MFA?

Create a Conditional Access policy exclusion group for service accounts. Then secure those accounts with extremely strong passwords (30+ characters), restrict their sign-in to specific IP addresses, and monitor their activity closely. Document each exclusion and review it quarterly.

What if an employee loses their phone?

Immediately have an admin reset their MFA registration. The employee re-enrolls with their new device. This is why backup methods are critical — if they have backup codes stored securely, they can access their account while their primary method is being reset.

Does MFA slow down productivity?

The authentication prompt adds approximately 5-10 seconds per login. With modern authenticator apps using push notifications, the user taps “Approve” and continues working. After the first week, most employees report not even noticing the extra step. The productivity cost of a breach — weeks of disruption, forensic investigations, customer notification — dwarfs any MFA friction.

Can I enforce MFA for some users but not others?

Yes. In Microsoft 365, Conditional Access policies let you target specific user groups, exclude service accounts, and set different requirements based on location, device, or risk level. In Google Workspace, you can enforce 2-Step Verification per organizational unit. This enables phased rollouts.

---