Multi-Factor Authentication Setup for Canadian Businesses
MFA is not finished when a sign-in prompt appears. A dependable rollout chooses strong methods, enrols every user, protects administrators, preserves emergency access, blocks legacy authentication, tests recovery, and produces evidence you can show an insurer or client.
What a business MFA setup should include.
Multi-factor authentication requires more than one kind of proof before an account is opened: something the user knows, has, or is. For a business, the control must cover the identity platform and the applications behind it, not just one mailbox or one administrator.
Every interactive user.
Include employees, contractors, administrators, shared operational accounts that cannot yet be removed, and remote users. Document service accounts separately because they need workload identities or other non-interactive controls, not a human phone prompt.
Phishing-resistant first.
Passkeys, FIDO2 security keys and Windows Hello for Business resist credential-proxy attacks. Authenticator number matching is a practical transition method. SMS and voice are fallback choices, not the target state.
One tested enforcement path.
Use Conditional Access in Microsoft Entra or organizational-unit and group enforcement in Google Workspace. Pilot first, measure registration, then expand. Avoid stacking old per-user MFA settings over a new policy without understanding the result.
The Canadian Centre for Cyber Security now recommends phishing-resistant MFA by default. Its analysis of more than 100 campaigns targeting Microsoft Entra ID accounts found that adversary-in-the-middle phishing can capture passwords, ordinary MFA responses and session tokens. Read the Cyber Centre's phishing-resistant MFA guidance before treating a basic push notification as the final control.
Choose the strongest method your workflow can support.
“MFA enabled” is not a useful security statement unless the allowed methods are named. An attacker will use the weakest method still available.
| Method | Phishing resistance | Best use | Operational note |
|---|---|---|---|
| Passkey or FIDO2 security key | Strong | Administrators, finance, executives, remote access | Issue a spare and document replacement; do not leave a weaker fallback on privileged accounts. |
| Windows Hello for Business | Strong | Managed Windows devices | Binds authentication to the device and works well with Intune compliance. |
| Authenticator with number matching | Better transition | Broad workforce rollout | Show application and location context, train users to deny unexpected prompts, and rate-limit repeated requests. |
| Time-based one-time code | Limited | Legacy applications and temporary compatibility | Can be phished in real time; record why it remains allowed. |
| SMS or voice | Weak | Short-lived recovery exception | Carrier interception and number changes make it unsuitable as the normal business standard. |
Microsoft's current method catalogue includes passkeys, FIDO2 keys, Windows Hello for Business, Microsoft Authenticator, certificate authentication, Temporary Access Pass and OATH methods. See the Microsoft Entra MFA overview. Google's administrator guidance likewise calls security keys its strongest 2-Step Verification method and discourages text messages.
Prepare the tenant before anyone can be locked out.
The safest rollout is boring: inventory, pilot, recovery, evidence, then expansion. Turning on a tenant-wide switch first creates helpdesk volume and exceptions that can survive for years.
Inventory identities and applications.
Export active users, privileged roles, guests, shared accounts, service accounts, mail protocols, VPN access and every application using single sign-on. Confirm who owns each exception.
Create controlled emergency access.
Maintain two cloud-only emergency administrator accounts with long random credentials, separate secure storage, alerting on every use, and a scheduled sign-in test. Exclude only those documented accounts from the main policy.
Choose and enable methods.
Enable the authentication methods users are expected to register. Give privileged users phishing-resistant methods first. Disable methods that the business will not accept after the migration window.
Run a representative pilot.
Include administrators, office staff, remote workers, mobile-only staff and users of older applications. Test a normal sign-in, a new device, password reset, a lost phone, offline work and emergency access.
Measure registration.
Do not enforce by hope. Track registered methods, users still relying on SMS, stale guests and applications attempting legacy authentication. Contact the remaining users directly before the deadline.
Communicate the support path.
Tell users what prompt to expect, what North Star or internal IT will never ask them to approve, how to report an unexpected prompt, and how identity will be verified during recovery.
Microsoft multi-factor authentication setup.
For Microsoft 365 Business Premium and Entra ID P1 environments, Conditional Access is the normal policy engine. Security defaults can be a sound baseline for smaller tenants that do not need custom exclusions or risk-based conditions.
Start in report-only mode.
Create a policy for all users and all resources, exclude only documented emergency accounts, require MFA, and begin in report-only mode. Review impact before turning it on. Microsoft's MFA tutorial recommends Conditional Access for granular enforcement.
Use the registration campaign.
Target the intended method and monitor completion. Microsoft-managed registration can nudge eligible users toward passkeys or Microsoft Authenticator, but an administrator should still verify the resulting scope and method policy.
Separate privileged access.
Create a stronger policy for administrative roles and sensitive workflows. Use authentication strengths to require phishing-resistant combinations, and remove SMS or voice fallbacks from privileged accounts.
Combine identity and compliance.
For sensitive SharePoint data, administration and remote access, require both a strong authentication method and a managed, compliant device where the business can support it.
Do not copy portal screenshots blindly: Microsoft changes labels and default behaviour. Review the current Microsoft-managed authentication settings and validate the live tenant before enforcement.
Google Workspace 2-Step Verification setup.
Google calls its control 2-Step Verification. The rollout principle is the same: allow enrolment, pilot, confirm recovery, then enforce by organizational unit or group.
Allow registration before enforcement.
Give users a defined enrolment period and clear instructions. Confirm that administrators and users with financial, HR or client data are registered first.
Apply policy by group or unit.
Start with the pilot population, then expand. Super administrators control domain-wide enforcement, so maintain more than one secured administrator and test recovery before the final wave.
Prefer security keys or passkeys.
Google recommends security keys as the strongest option, with Google Prompt or an authenticator app as practical alternatives. Its guidance discourages SMS because carrier networks can be intercepted.
Pre-issue recovery options.
Store backup codes securely, document identity verification, and test the process for a lost phone or departed administrator. Recovery must not become a password-only bypass.
Use Google's current 2-Step Verification deployment guidance when configuring the Admin console.
MFA is an operated control, not a one-time project.
After launch, the work moves from enrolment to drift control. The evidence below is what makes the difference during an insurance renewal, client security review or incident investigation.
Coverage report.
Active users, registered methods, privileged accounts, excluded identities, stale guests, failed registration and accounts still using weak methods.
Sign-in monitoring.
Alert on impossible travel, unfamiliar locations, repeated denials, emergency-account use, new authentication methods and risky administrative changes.
Recovery test.
Test a lost device, a replacement phone, a security key failure and emergency administration. Record the result, owner and remediation date.
What weakens an otherwise good MFA rollout.
Permanent user exclusions.
An exception created for one deadline becomes the attacker's preferred account. Give every exception an owner, reason, compensating control and expiry date.
Administrators on the weakest method.
Privileged accounts need the strongest method first, not last. A compromised administrator can change the policy for everyone else.
Unprotected legacy authentication.
Older mail and application protocols may bypass modern sign-in controls. Inventory and block them unless a documented technical dependency still exists.
Recovery based on caller confidence.
A convincing phone call is not identity proof. Require a defined verification process and log every method reset.
Multi-factor authentication questions.
What is multi-factor authentication?
Multi-factor authentication requires two or more independent kinds of proof before access is granted, such as a password plus a device-bound passkey or biometric. Two steps are not automatically two factors: two passwords are still one factor type.
What is the best MFA method for a business?
Passkeys, FIDO2 security keys and Windows Hello for Business are the preferred phishing-resistant methods. Authenticator number matching is a useful transition option. SMS and voice should be limited to short-lived recovery cases where stronger methods are not yet possible.
Does Microsoft 365 include MFA?
Yes. Microsoft Entra supports MFA methods and security defaults, while Microsoft 365 Business Premium includes Entra ID Plan 1 for Conditional Access. The licence does not configure the tenant, register users, test exclusions or operate recovery automatically.
Can MFA still be phished?
Traditional push prompts and one-time codes can be captured or approved through an adversary-in-the-middle phishing site. Phishing-resistant methods bind authentication to the legitimate service and are designed to stop that proxy workflow.
How long does a business MFA rollout take?
A small, modern cloud tenant can often be piloted and deployed in one to three weeks. Legacy applications, shared accounts, unmanaged devices and incomplete identity records extend the schedule because each exception must be resolved safely.
Can North Star deploy MFA remotely across Canada?
Yes. Discovery, tenant configuration, user enrolment, testing, reporting and support can be delivered remotely across Canada. North Star can dispatch from Prince George, BC and Grande Prairie, AB when an approved project requires on-site work.
Need MFA deployed without lockouts?
North Star audits the tenant, chooses the method standard, pilots the policy, enrols users, tests recovery and delivers the evidence package. Service is available remotely across Canada, with dispatch locations in Prince George and Grande Prairie.
Book a Free Assessment Talk to an Engineer