# Rolling Out Two-Step Verification to Staff at a Small Business

> A practical plan to enforce MFA across a small business: announce, enrol, track, then enforce, with the exact Microsoft 365 and Google Workspace admin steps.

Source: https://www.epifive.com/blog/small-business-mfa-rollout-staff-checklist · Published 2026-10-28 · EpiFive

## Key takeaways

- A smooth MFA rollout follows a fixed order of announce, enrol, track, enforce and support, rather than switching it on without warning.
- Microsoft Entra security defaults give small businesses free MFA for all users plus blocking of legacy authentication and device code flow.
- Google Workspace lets you allow 2-Step Verification first, track enrolment in reports, and enforce later from a set date.
- Admin accounts need the strongest protection and a tested recovery plan, including two emergency access accounts in Microsoft Entra.
- Check for legacy apps, scanners and shared accounts before enforcement because they are the most common cause of surprise lockouts.

To roll out two-step verification at a small business without disruption, follow a fixed order: tell staff what is changing and why, let them enrol while it is still optional, track who has enrolled, then enforce it and support whoever is left. In Microsoft 365 the lowest-effort route is Microsoft Entra security defaults. In Google Workspace you allow 2-Step Verification first and enforce it later. This article gives the steps for both and a staff communication plan.

## Who this is for and what you will have

This is for owners and the person who looks after IT at a business with a handful to a few dozen staff, using Microsoft 365 or Google Workspace. By the end you will have an inventory of accounts to protect, a timeline, the admin settings to turn on, and a support routine for lockouts. For a larger Microsoft 365 programme that uses Conditional Access in phases, see [/blog/microsoft-365-mfa-rollout-plan](https://www.epifive.com/blog/microsoft-365-mfa-rollout-plan).

## Step 1: Take stock before you change anything

List what staff sign in to and who has admin rights. A short sheet is enough.

| Item | What to record |
| --- | --- |
| Accounts | Every staff mailbox, plus shared or generic accounts |
| Admins | Who holds admin roles in Microsoft 365 or Google Workspace |
| Old apps and devices | Scanners, printers and apps that send email, and old mail clients |
| Phones | Which staff have a smartphone for an authenticator app, and who does not |
| Recovery | Who can reset someone's sign-in methods |

The old apps and devices line matters most. Microsoft explains that legacy authentication, used by clients that do not support modern authentication and by older mail protocols such as IMAP, SMTP and POP3, does not support multifactor authentication, which is why security defaults block it. A scanner that emails documents using basic sign-in is a typical thing that breaks. Microsoft publishes guidance on setting up a multifunction device or application to send email using Microsoft 365, and you should work through that before enforcement.

Also decide how staff without a smartphone will sign in, for example a hardware security key or a code generator app on a spare device, rather than discovering the gap on the day.

## Step 2: Choose the enforcement approach

### Microsoft 365: security defaults or Conditional Access

Microsoft describes security defaults as preconfigured settings for organisations that want better security but do not know where to start, and for organisations on the free tier of Entra ID licensing. They:

- require all users to register for multifactor authentication;
- require administrators to do multifactor authentication;
- require users to do multifactor authentication when necessary;
- block legacy authentication protocols;
- block device code flow;
- protect privileged activities such as access to the Azure portal.

Microsoft says that if you have Microsoft Entra ID P1 or P2 licences, security defaults are probably not right for you, and that Conditional Access is the route for complex requirements. Security defaults are on or off with no customisation. Tenants created on or after 22 October 2019 may already have them enabled, so check before you plan.

### Google Workspace: 2-Step Verification

Google lets you allow 2-Step Verification (2SV) first, have users enrol, and enforce afterwards. Google enforces 2SV for administrator accounts.

## Step 3: Tell staff what is happening

Microsoft stresses that it is critical to inform users about upcoming changes, registration requirements and the actions they need to take, and provides communication templates at aka.ms/mfatemplates and user documentation. Google's own guidance begins in the same place: tell users what 2SV is and why you are using it, whether it is optional or required, the deadline, and which method is required or recommended.

Send one clear message covering:

- the date enrolment opens and the date it becomes mandatory;
- what they will be asked to do, with a link to the right page;
- how long it takes, which is a few minutes;
- who to ask for help, and when that person is available;
- a warning that a new or changed phone needs the helper's involvement.

For Microsoft 365, staff register at https://myprofile.microsoft.com by selecting the Security Info link. Microsoft's documentation says users who sign in under security defaults register for MFA with the Microsoft Authenticator app using notifications, may use verification codes from the app, and can use any OATH TOTP app to generate codes.

## Step 4: Turn it on

### Microsoft 365: enable security defaults

1. Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator.
2. Browse to Entra ID, then Overview, then Properties.
3. Select Manage security defaults.
4. Set Security defaults to Enabled and select Save.

Two points from Microsoft's page are worth acting on. Ensure all your admins sign in after enabling so they can register authentication methods, and keep separate accounts for administration and everyday work, which reduces how often admins are prompted. Also, do not disable authentication methods while using security defaults, since that can lock you out of your tenant. Microsoft recommends two cloud-only emergency access accounts assigned the Global Administrator role, held for break-glass situations and created following its emergency access guidance.

Microsoft notes that the 14-day grace period for registration was removed for new and existing tenants starting 29 July 2024, so users are asked to register at sign-in rather than later. Plan your announcement accordingly: turning security defaults on is effectively the enforcement date.

### Google Workspace: allow, enrol, then enforce

1. As a super administrator, open Menu, then Security, then Authentication, then 2-step verification. Optionally select an organisational unit or configuration group.
2. Check Allow users to turn on 2-Step Verification and leave Enforcement set to Off. Click Save.
3. Ask users to enrol. The methods Google lists are security keys, Google prompt, text or phone call, Google Authenticator, and backup codes.
4. Track enrolment under Reporting, then User Reports, then Security, and through Security center, Security health, where you can search for the two-step verification checks for users and admins.
5. When most users are enrolled, return to the same page and set Enforcement. Choose On to start immediately, or Turn on enforcement from date, which shows users enrolment reminders at sign-in and begins within 24 to 48 hours of the chosen date.
6. Set the New user enrollment period, from 1 day to 6 months, during which new accounts can sign in with only a password.
7. Choose the allowed methods and the frequency settings, then click Save.

Google's notes warn that choosing any method except verification codes by text or phone will lock out users who rely on them, so tell them first, and that choosing Only security key means users cannot generate their own backup codes, so admins must provide them. Groups override organisational units, so check which setting applies to each person.

## Step 5: Pilot with a small group

Before the full switch, run the process with two or three people in different roles, such as an office worker, someone who travels, and someone who uses shared equipment. Ask them to enrol, sign in on every device they use, and report what confused them. Fix the wording of your message and the instructions based on what they say.

## Step 6: Support and recovery

Staff will lose or replace phones. Write down, before enforcement:

- who can reset a person's sign-in methods or issue backup codes;
- how that person verifies the identity of the requester, for example a call back on a known number, rather than accepting an email request that an attacker could send;
- how long a reset takes;
- where emergency admin credentials are stored.

Microsoft's guidance on tenants includes emergency access accounts for the case where all administrators are accidentally locked out. Google notes that if users miss a deadline you can temporarily place them in a group where enforcement is not applied, although it does not recommend this as standard practice.

## Verification

- In Microsoft 365, sign in with a test user in a private browser window and confirm you are asked to register or approve a sign-in.
- Under security defaults the per-user MFA status page may show users as Disabled, which Microsoft says is the appropriate status for people covered by security defaults or Conditional Access.
- In Google Workspace, check the user report for enrolment and sign in as a test user to confirm the prompt.
- Test that scanners and apps that send mail still work, or have been moved to a supported method.

## Troubleshooting

- **A scanner or old app stopped sending mail.** It is probably using legacy authentication, which security defaults block. Reconfigure it following Microsoft's guidance for multifunction devices.
- **An app that uses device code flow cannot sign in.** Security defaults block device code flow. Conditional Access allows granular exceptions, but it needs the appropriate licence.
- **A user cannot register because they changed phones.** Use your recovery process to reset their methods, and have them register again.
- **Locked out of the admin account.** Use the emergency access account you set up. This is why you create them before enforcement, not after.
- **Google users locked out after choosing a strict method.** Revisit the methods setting, provide backup codes or temporarily adjust enforcement for the affected group.

## Checklist

- Accounts, admins, old apps and phone availability documented.
- Approach chosen: security defaults or Conditional Access for Microsoft 365, 2SV settings for Google Workspace.
- Announcement sent with dates, instructions and a named helper.
- Pilot group completed and instructions updated.
- Admin accounts enrolled first, with two emergency access accounts in Microsoft Entra.
- Enrolment tracked and stragglers contacted individually.
- Enforcement turned on and legacy devices re-tested.
- Recovery procedure written and tested.

## References

- [Security defaults in Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults)
- [Combined security information registration (Microsoft Entra)](https://learn.microsoft.com/en-us/entra/identity/authentication/howto-registration-mfa-sspr-combined)
- [Deploy 2-Step Verification (Google Workspace Admin help)](https://knowledge.workspace.google.com/admin/security/deploy-2-step-verification)

## Frequently asked questions

### What is the simplest way to enforce MFA in Microsoft 365 for a small business?

Turn on security defaults in the Microsoft Entra admin center. They require all users to register for MFA, require admins to use MFA, block legacy authentication and block device code flow, at no extra licence cost. Businesses with Entra ID P1 or P2 licences are usually better served by Conditional Access.

### How do I enforce 2-Step Verification in Google Workspace?

As a super administrator, go to Security, Authentication, 2-step verification, check Allow users to turn on 2-Step Verification, let users enrol, track enrolment in reports, and then set Enforcement to On or to start from a chosen date. You can also set a new user enrollment period and restrict the methods.

### What should staff do if they lose the phone that holds their authenticator?

They need a second method or a recovery route registered in advance, such as a backup method, backup codes in Google Workspace, or help from an administrator who can reset their sign-in methods. Decide and publish this process before you enforce MFA.

### Will MFA break shared mailboxes, printers or old apps?

It can. Legacy authentication does not support MFA, and Microsoft's security defaults block it, so scanners, old mail clients and some apps that use IMAP, POP3 or SMTP basic sign-in may stop working. Find these before enforcement and move them to modern authentication.