Two-Step Sign-In for Your Team: Microsoft 365 and Google Workspace

If your team keeps its business email, files and meetings in cloud services, breaching a single account is enough for an attacker to walk right into emails, documents and correspondence with customers. The most common route is a stolen password: a fake sign-in page, a phishing email, or a password leaked from another service. That is why two-step sign-in (MFA, or 2SV in Google's terminology) is one of the most practical protections for small and medium-sized businesses.

The idea is simple: besides the password, the system asks for a second confirmation. This can be a notification on your phone, a code from an app, a physical security key, or a so-called passkey. If someone knows the password, they still cannot get into the account without the second step.

Microsoft 365: what is already turned on

According to Microsoft's documentation, all Microsoft 365 Business plans include the basic version of Microsoft Entra ID, which has a feature called Security defaults. It is enabled by default, so MFA is active by default in Microsoft 365 Business organizations. However, if your environment is old or someone turned this setting off at some point, it is worth checking.

To check:

• Sign in to the Microsoft Entra admin center with an administrator account;
• Open Identity > Overview, then Properties, and below you will find the Security defaults section;
• Make sure the setting is enabled, or that Conditional Access policies are configured in its place.

The strength of Security defaults is its simplicity: it requires MFA and blocks legacy authentication protocols that bypassed the second step. Its drawback is a lack of flexibility: it works the same way for everyone, and you cannot tailor it by location, device or risk. For finer control you use Conditional Access, which requires a Microsoft Entra ID P1 or P2 license. According to Microsoft's documentation, Microsoft 365 Business Premium includes Entra ID P1. Microsoft also does not recommend the old per-user MFA mode and states that it must be turned off in order to use Security defaults or Conditional Access.

Among the methods, Microsoft Entra ID supports Microsoft Authenticator, passkeys (FIDO2), Windows Hello for Business, SMS and phone calls. Not all of them are equally resilient, so if you have a choice, give preference to the app or a passkey.

Google Workspace: turning it on and enforcing it

In Google Workspace there is one detail to keep in mind: an administrator can require two-step sign-in at the organization level, but for an individual user only the user can turn it on. So merely "allowing it to be turned on" is not enough; you need the enforcement mode.

The path in the Admin console is: Security > Authentication > 2-Step Verification. There you can:

• Allow users to turn on 2SV;
• Choose the enforcement mode and give the team a reasonable enrollment period;
• Roll it out gradually by organizational units or groups;
• Define the allowed methods: any, any except codes received by SMS/call, or only a security key.

Google recommends that you definitely require 2SV for administrators and for employees who work with the business's most important information. In addition, Google is gradually tightening the requirement for administrator accounts as well and warns them in advance, so you will need the second step for these accounts anyway. With a passkey, a user can sign in with a phone, a security key, or the computer's screen lock.

Which second step to choose

The US cybersecurity agency CISA states directly that any form of MFA is better than nothing and reduces risk. However, CISA considers authentication based on the FIDO/WebAuthn standard (security keys, passkeys) the most resistant to phishing. The reason is that such a method does not work on a fake site: a code that an employee might be tricked into entering on a fake page is something nobody can steal here.

A practical order of priorities for a small team:

• For administrators and people who work with finances, use a passkey or a security key;
• For everyone else, use an authenticator app or a phone notification;
• If you use push notifications and cannot yet move to a more resilient option, CISA recommends number matching (entering a number shown on the screen), so that an employee does not approve a notification without thinking;
• Keep SMS and call codes only as a backup, or turn them off entirely if that is convenient for your team.

How to avoid lockouts

The most common problem when introducing MFA is a lost or replaced phone. So prepare these steps in advance:

• Warn the team in good time about what to expect and when the requirement takes effect;
• Allow an enrollment period and roll it out gradually, first to administrators and a small group;
• Advise everyone to register at least two methods, for example an app and a backup;
• In Google Workspace, an administrator can retrieve a backup code for a locked-out user; decide who verifies the user's identity, and how, before issuing such a code;
• Write down the incident resolution procedure and share it among the administrators.

Also keep in mind that old programs that connect to email using only a password (old IMAP/SMTP clients, scanners, legacy apps) may stop working after MFA is turned on. Microsoft's Security defaults deliberately block such protocols, while in Google Workspace app passwords are sometimes needed. So before turning it on, write down which device and service uses email and how.

The most important part is people. CISA advises us to explain to employees why this is necessary: one extra quick step protects them, the company and its customers. It is good to also encourage people to turn on MFA for their personal accounts.

A short checklist to get started:

• Check whether MFA is turned on for all accounts, especially administrators;
• Choose a passkey or a security key for administrators;
• Give everyone else an enrollment period and clear instructions;
• Prepare a recovery procedure;
• Check old devices and programs.

If going through these steps on your own is difficult, Appy.ge, a Georgian IT company and an official Microsoft CSP partner that also helps with Google Workspace setup, will help you review your account security and roll out two-step sign-in in an orderly way.

Sources:
• Microsoft 365 for business security overview - Microsoft 365 admin - https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/m365b-security-overview?view=o365-worldwide
• Set up multifactor authentication for users - Microsoft 365 admin - https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/set-up-multi-factor-authentication?view=o365-worldwide
• Protect your business with 2-Step Verification - Google Workspace Help - https://knowledge.workspace.google.com/admin/security/protect-your-business-with-2-step-verification
• Manage a user's security settings - Google Workspace Help - https://knowledge.workspace.google.com/admin/security/manage-a-users-security-settings
• Require Multifactor Authentication - CISA - https://www.cisa.gov/audiences/small-and-medium-businesses/secure-your-business/require-multifactor-authentication