Two-factor authentication: protect accounts without locking out your team

Adding account protection is useful. Staff must also be able to sign in the next morning and know what to do when a phone changes. In a small business, introducing it benefits from the same preparation as a small system rollout.

Start with important accounts

Cybermalveillance.gouv.fr recommends two-factor authentication wherever available. It adds a check beyond the password, for example through an app or security key depending on the service. It strengthens protection without eliminating every phishing risk.

Make an initial list: business email, administration tools and accounts holding sensitive documents. Assign a rollout owner for each and check the methods supported by the provider.

Try it with a small group

Consider a fictional example: two sales staff try the new sign-in process before the rest of the team. They use their usual devices and check the mobile applications they rely on too.

• Explain the change and the screens users should expect.
• Enrol the selected method through the official service.
• Test a fresh sign-in without prematurely closing all existing access.
• Record difficulties and the support contact.

The instruction should be simple: never approve a sign-in request you did not start or give someone a code they ask for.

Plan account recovery

Check the procedure for a lost or replaced device with the administrator. If the service supplies recovery codes, keep them in a protected location appropriate for your organisation. Recovery should not depend solely on the phone it is meant to replace.

The person providing help must be able to verify the requester’s identity before resetting access. Document who can intervene and how to reach them.

The acceptance test

A pilot user signs in normally, then explains how they would request help without their phone. The administrator checks the recovery procedure using a test account. The expected outcome is protected access with a controlled fallback.

Our IT assessment can help identify priority accounts and organise the rollout.