2FA for businesses: two-factor authentication and secure administrator accounts

When we review a Microsoft 365 or Google Workspace environment in a small business, we often find that the owner reads email from an account with full administrator rights over the whole organisation. The same address is used to sign in to the domain panel, online banking and the online shop. The second sign-in factor is a text message to a private phone, or there is none at all. A single successful phishing attempt is enough for an attacker to take over everything at once.

Two-factor authentication, or 2FA for short, is now the foundation of securing company accounts. Simply switching 2FA on, however, is only half the job. The other half is choosing a method that withstands phishing and putting the accounts with administrator rights in order.

Why a password alone is not enough

Passwords leak in many ways: through a fake sign-in page, malware, reuse on another service or a plain mistake. The US agency CISA describes multi-factor authentication (MFA, of which 2FA is the most common form) as a requirement to present at least two different factors: something the user knows, has or is. If the password is stolen, an attacker without the second factor still cannot sign in to the account.

CISA recommends MFA for all users and all services, including email, file sharing and access to financial accounts. The order of rollout matters, though, because accounts differ in importance. An administrator account can change settings for the whole organisation, turn off protection for other users and delete data. That is where we start.

Not all 2FA is equally strong

In the same document, CISA ranks MFA methods from strongest to weakest and describes the attacks they are vulnerable to:

Method	Example	Vulnerable to
Phishing-resistant	FIDO2 hardware key, passkey, certificate-based authentication	Phishing, push bombing and SIM swap do not apply
App with a one-time code or a push notification with number matching	Authenticator app on the phone	Phishing
App with a push notification without number matching	An “Approve” button in the app	Phishing, push bombing
SMS and voice call	Code in a text message	Phishing, SIM swap, weaknesses in the telephone network

Two of the attacks in this table are worth knowing by name. Notification flooding (push bombing) means sending the user one sign-in approval request after another until, worn down, they click “Approve”. Number hijacking (SIM swap) means persuading the mobile operator to move the victim's number to the attacker's SIM card, after which the attacker receives the SMS codes.

FIDO2 keys and passkeys (passkey) are based on the WebAuthn standard, developed by the FIDO Alliance and published by the W3C. CISA states that this is the only widely available phishing-resistant method supported by popular browsers, operating systems and smartphones. The authenticator can be a separate key connected via USB or NFC, or it can be built into a laptop or phone, and a PIN or biometrics can be added to possession of the device.

The user does not type in any code, so there is nothing to enter on a fake sign-in page. CISA calls this kind of MFA the gold standard and strongly recommends that system administrators and other high-value targets adopt it or plan a migration. For small and medium-sized businesses that cannot move to phishing-resistant methods straight away, CISA points to an app with a code or a push notification with number matching as a reasonable option.

Administrator accounts kept apart from everyday work

An administrator should not read email or browse websites from an account with rights over the whole organisation. Clicking a malicious attachment on an ordinary account is an incident. The same click on a global administrator account means access to everything.

Both major office suite providers agree on this. In its recommendations for Google Workspace, Google advises that every top-level administrator (super admin) should have two accounts: a dedicated administrative account and a separate one for everyday work, signing in to the administrative account only for a specific task and not staying signed in. In its documentation on Entra ID security defaults, Microsoft also recommends separate accounts for administration and for ordinary work.

On top of that come three housekeeping rules:

• Named accounts instead of a shared login. Google points out that when several people use one administrator account, the audit log cannot show who made a change.
• More than one administrator. Google recommends at least two top-level administrator accounts, each run by a different person, so that losing one does not lock the company out.
• Least privilege. The person who creates mailboxes does not need the global administrator role. Both suites have narrower administrative roles.

Microsoft 365: from security defaults to Conditional Access

In Microsoft 365, the starting point is the the default security settings (security defaults) in Entra ID. Microsoft provides them at no extra cost. They require all users to register for MFA, require MFA from administrators at every sign-in and block legacy authentication protocols, such as older email clients using IMAP, POP3 or SMTP. That last point matters a great deal because, as Microsoft states, legacy protocols do not support MFA and allow it to be bypassed even when MFA is switched on.

If you need more control, you use conditional access rules (Conditional Access), which according to Microsoft requires at least a Microsoft Entra ID P1 licence. You can then enforce the “phishing-resistant MFA” authentication strength for administrative roles, which means signing in only with a hardware key or a passkey. Microsoft warns that administrators should register suitable methods before enabling such a policy, otherwise the company may lock itself out of its own organisation. A new policy is first run in report-only mode, which shows its effects without blocking sign-ins.

Google Workspace: security keys for administrators

Google describes security keys as small hardware devices used as a second factor that help fend off phishing and are the most secure form of 2-Step Verification. Its recommendations for top-level administrator accounts are specific:

• 2-Step Verification, with a security key wherever possible,
• at least two keys registered to each administrator account and kept in a safe place, so that losing one does not cut off access,
• printed backup codes kept in a safe place,
• account recovery details, that is a phone number and email address, filled in in advance.

We set up both suites, including roles and sign-in policies, as part of our service Google Workspace and Microsoft 365.

An emergency account that works when everything else fails

An emergency account (break-glass) is an administrator account for situations where the regular administrative accounts are unavailable: lost keys, an MFA service outage, the departure of the only person with the rights or a misconfigured sign-in policy. Microsoft describes these accounts in detail. It recommends:

• at least two emergency accounts, cloud-only, in Microsoft's technical domain, independent of synchronisation with an on-premises server,
• sign-in with a phishing-resistant method, with Microsoft recommending a FIDO2 passkey, and a different one from that used by the regular administrator accounts,
• excluding these accounts from Conditional Access policies that block or restrict sign-in,
• storing the credentials in secure, fireproof safes in separate locations,
• an alert every time the account is used and a review of the circumstances after each use,
• checking that the accounts work at least once every 90 days and after every change in the IT team.

In a small business this translates into a simple procedure. The two keys for the emergency account are kept in two different places, for example in the office safe and with the owner. Who has access to them is recorded. Every sign-in to this account triggers an alert to management. Once a quarter, a designated person checks that sign-in works.

Other privileged accounts in the company

Office suite administrator accounts are not the only powerful accounts. The same category includes the domain registrar and DNS panel, online banking, the router and firewall panel, the NAS server holding backups, website hosting, the ERP administrator account and the password manager itself. Taking over the DNS panel lets an attacker redirect the whole company's email, and taking over the backup system account lets them delete the backups.

For each of these accounts, it is worth assigning an owner, enabling 2FA with the strongest method available and storing the credentials in a shared vault with access control, which we write about in our post on a password manager for business. When you change IT provider, these accounts have to be taken over first, as we describe in our article on taking over administration.

Rolling out 2FA without bringing the company to a halt

A rollout that goes smoothly usually follows a fixed order:

1. An inventory of accounts and services with their owners and current sign-in methods. CISA advises starting with services that already support FIDO, pointing to cloud email and single sign-on systems as a good place to begin.
2. Administrators first: separate administrative accounts, two FIDO2 keys per person, emergency accounts.
3. People with access to finance, management email and customer data.
4. All other users: an authenticator app with number matching or a passkey on the phone.
5. Blocking legacy protocols and a list of exceptions with a deadline for removing them.

CISA also notes that it is worth limiting the first stage to a group that is easy to train and support, such as administrators and helpdesk staff, and extending later stages based on what was learned earlier. The decision to cover the whole company with phishing-resistant methods should be taken by management, because they can lead the communication and deal with resistance from the team.

Your team should know where the extra step comes from and what to do with an unexpected sign-in approval request: reject it and report it, because it is a typical sign of push bombing.

The result can be checked. After the rollout, the company has a list of systems covered by 2FA, a list of administrators with their sign-in methods, a description of the emergency accounts with the date of the last test and a list of exceptions with deadlines. We check these items during a cybersecurity audit for a small business, and we carry out their implementation as part of our service cybersecurity.

Sources

• CISA, Implementing Phishing-Resistant MFA, October 2022, https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf (accessed 02/10/2026)
• Microsoft Learn, Manage emergency access admin accounts. Microsoft Entra ID, updated 04/06/2026, https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/security-emergency-access (accessed 02/10/2026)
• Microsoft Learn, Configure Security Defaults for Microsoft Entra ID, https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults (accessed 02/10/2026)
• Microsoft Learn, Require phishing-resistant multifactor authentication for Microsoft Entra administrator roles, updated 24/03/2026, https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-admin-phish-resistant-mfa (accessed 02/10/2026)
• Google Workspace Admin Help, Security best practices for administrator accounts, https://knowledge.workspace.google.com/admin/users/security-best-practices-for-administrator-accounts (accessed 02/10/2026)

As of 2 October 2026.