In this article
Multi-factor authentication (MFA) — asking, in addition to the password, for a confirmation on the phone or a physical key — is the security measure with the best return for an SME: it stops the vast majority of attacks that begin with stolen credentials, almost always at no licence cost, and can be rolled out in two weeks. Even so, we still find companies with 100 workstations where only the administrator has it enabled. This guide from DataRoad - IT Services and Consulting sets out the order, the methods and the timetable.
What MFA really covers
It protects in the most common scenario: the password was typed into a fake site or reused on a service that suffered a breach, and the attacker tries to get into the email or the VPN. Without MFA they get in; with MFA they need approval on the victim's phone.
It does not protect against malicious software already installed on the computer, nor against people who approve requests without looking. But it closes the door through which most attacks come in.
Order of activation
- Microsoft 365 or Google Workspace — email, files and Teams are the company's central identity and the number one target. Administrators first, then everyone.
- Remote access — VPN, remote desktop and published portals. Anything that does not support MFA should be switched off or placed behind something that does; see why a VPN is no longer enough.
- Banks, tax and social security portals and supplier portals — almost all already require it; check that the methods are linked to company phones and not those of former employees.
- Device administration — firewall, switches, servers, domain and website hosting: few people, enormous impact.
- Password manager — mandatory, because it holds everything else.
Methods compared
| Method | Security | When to use |
|---|---|---|
| App with notification and number matching (e.g. Microsoft Authenticator) | High | Default for most people; the number prevents approving something that was not requested |
| FIDO2 physical key | Very high, phishing-resistant | Administrators, management and finance |
| SMS | Low (SIM swap, interception) | Only as an emergency fallback |
| Code by email | Very low | Avoid: if the email falls, so does the second factor |
Five mistakes that create resistance
- Asking for MFA at every login Configure it once a day per trusted device.
- Forgetting people without a company phone Physical keys or tokens solve this.
- Switching everything on the same day, without warning The helpdesk drowns.
- Having no recovery for lost phones The person is left without email on a working day.
- Not talking about approval fatigue Attackers send dozens of requests until someone accepts out of tiredness. Number matching and a simple rule in training (never approve what you did not request) solve this.
DataRoad IT Unlimited
Talk to DataRoad. We assess your operation and propose the right plan.
14-day timetable
| Days | Actions |
|---|---|
| 1–2 | MFA for all administrators; policy defined (mandatory, session remembered per trusted device, SMS only as a fallback); one-page illustrated guide |
| 3–5 | Pilot in one department: 15-minute session, registration and testing; guide corrected |
| 6–10 | One department a day with the helpdesk available; anyone who has not registered is required to at their next login, using Microsoft's grace period |
| 11–14 | Remote access and devices; legacy methods blocked; account-by-account check in the dashboard |
Benefits beyond security
- GDPR A demonstrable technical measure.
- NIS2 The directive explicitly mentions multi-factor authentication.
- Cyber insurance Almost always asks about MFA and adjusts the premium.
- Helpdesk Fewer requests from people who think their email has been broken into.
MFA in IT Unlimited contracts
Under IT Unlimited contracts, MFA is configured in Microsoft 365, the VPN and administration devices, as part of Microsoft 365 management and managed cybersecurity, with conditional access so that unmanaged devices can only connect through the browser. The monthly report shows the percentage of accounts covered, which should be 100%.
Frequently asked questions
How much does MFA cost?
It is included in most Microsoft 365 and Google Workspace plans. Physical keys cost a few tens of euros per person and are justified for high-risk roles. The real cost is the time spent on implementation and training.
Will it be requested at every login?
No, with the right policy: once per trusted device, renewed periodically. On new devices it always asks — that is the protection.
What about people who refuse company apps on their personal phone?
A physical key, a hardware token or a company phone. It is no reason to exempt anyone.
With MFA, is a password manager still needed?
Yes. MFA protects the account when the password is stolen; the manager prevents reuse on services without MFA. See password managers in the company.
Are there still accounts without MFA?
We enable MFA in Microsoft 365, remote access and devices, with 15-minute training per team and without locking anyone out. No-commitment proposal.
More than 10 workstations · support contract · remote, on-site and telephone support
+351 211 459 950* · sales@dataroad.pt
*Call to a Portuguese landline.
