MFA for tiny teams — how Australian small businesses turn on multi-factor authentication

Why MFA is non-negotiable in 2026

Multi-factor authentication (MFA) — needing more than just a password to sign in — is the single highest-impact security control a small business can turn on. The Australian Cyber Security Centre (ACSC) lists it as one of three "quick wins" in its Small Business Cyber Security Guide (current edition, updated late 2025). Australian cyber insurers in 2026 will not write new cover or renew existing cover without MFA on email and admin accounts. The Notifiable Data Breaches scheme determinations published by the Office of the Australian Information Commissioner in early 2026 cite missing MFA as evidence of inadequate security measures under Australian Privacy Principle 11 (OAIC — Australian Privacy Principles, accessed 16 June 2026).

This guide shows how to turn on MFA for the systems a tiny Australian team typically uses — Microsoft 365, Google Workspace, Xero, MYOB, and banking. It is written for owners and office managers; you do not need to understand the cryptography to follow it.

Pick your MFA method

There are four common MFA methods in Australian small business in 2026:

• Authenticator app prompt — Microsoft Authenticator, Google Authenticator, or Duo Mobile. Free, works on any phone, strong against the common attacks. Recommended default.
• Hardware passkey — YubiKey, Google Titan, or a built-in passkey in Windows Hello or Apple Face ID. Strongest option, recommended for the owner and any other admin account. About AUD 80 per key for YubiKey.
• SMS code — a text message with a six-digit code. Accepted by insurers but defeated by SIM-swap attacks. Use only as a fallback.
• Phone call — voice prompt asking you to press a key. Same weakness as SMS. Use only as a fallback.

The ACSC and most insurers prefer authenticator app or hardware passkey. Start staff on the authenticator app. Provide the owner and any admin with a hardware passkey as a second factor.

Microsoft 365 — Security Defaults

For most Australian small businesses on Microsoft 365 Business Standard, Business Premium, or Apps for Business, the simplest path is Security Defaults. This is a single toggle in the admin centre that enforces MFA for all users.

Step-by-step.

1. Sign in to the Microsoft 365 admin centre at admin.microsoft.com with a global administrator account.
2. Open the left menu, choose Show all, then Identity (or for older tenants, go to aad.portal.azure.com, navigate to Properties under Microsoft Entra ID).
3. Click Manage Security Defaults.
4. Toggle Security Defaults to Enabled, save.
5. Communicate to staff. Send a one-paragraph email explaining the change and pointing them at the Microsoft Authenticator app in their app store.

When each staff member next signs in, Microsoft prompts them to register the Authenticator app. The registration takes about five minutes per person.

If you have Microsoft 365 Business Premium, you can use Conditional Access instead of Security Defaults for finer control — for example, requiring number-match MFA only when signing in from outside Australia. Microsoft Learn (current 2026 guidance) documents Conditional Access policies in detail (Microsoft Learn — Conditional Access overview, accessed 16 June 2026). For most small businesses, Security Defaults is the right answer; switch to Conditional Access only if you have a specific requirement Security Defaults cannot meet.

Evidence to keep. A screenshot of Security Defaults set to Enabled, dated.

Google Workspace — Enforce 2-Step Verification

For Google Workspace customers (Business Starter, Standard, Plus, or Enterprise) the equivalent is the 2-Step Verification enforcement policy.

Step-by-step.

1. Sign in to the Google Workspace admin console at admin.google.com as a super-administrator.
2. Open Security → Authentication → 2-Step Verification.
3. Under Enforcement, choose On.
4. Optionally set an enrolment window of seven to fourteen days so staff have time to register.
5. Communicate the change to staff. Point them at the Google Authenticator app.

After the enrolment window closes, every Google Workspace sign-in requires a second factor. Default options include authenticator app, security key, and Google prompt.

Evidence to keep. Screenshot of the 2-Step Verification enforcement page, dated.

Xero — accounting access

Xero has required two-step authentication for new sign-ups since 2019 and now enforces it for most account types by default. Confirm it is active for everyone in your Xero organisation.

Step-by-step.

1. Sign in to Xero as the subscriber or an organisation administrator.
2. Open Settings → General Settings → Two-step authentication.
3. Confirm Two-step authentication required is enabled.
4. Review the user list and confirm every user has the green tick.
5. Any user without two-step active will be prompted to enrol on next sign-in.

Xero supports the Xero Verify app, Google Authenticator, and Microsoft Authenticator. Banking-feed access is particularly sensitive — confirm two-step is active on the owner and bookkeeper accounts at minimum.

Evidence to keep. Screenshot of the Xero two-step status page, dated.

MYOB — accounting access

MYOB Business, AccountRight Live, and Essentials all support MFA. Enable it under each user's My Account.

Step-by-step.

1. Sign in to MYOB at my.myob.com.
2. Open My account → Sign-in settings.
3. Enable Two-factor authentication, scan the QR code with Microsoft Authenticator or Google Authenticator.
4. Confirm the six-digit code, save.
5. Repeat for every user — MYOB does not currently enforce MFA at the organisation level, so each user must enable it individually.

Evidence to keep. A simple spreadsheet listing each MYOB user and the date MFA was confirmed enabled.

Banking and payments

Australian Big Four banks and most second-tier banks require MFA for business banking by default. Confirm:

• Every business banking user has the bank's authenticator app or hardware token registered and active.
• Cardholders for any business credit cards have card-present push approvals enabled.
• Any "remember this device" option is disabled on shared office devices.

For Stripe, Square, Tyro, and other payment platforms, enable MFA on the merchant account under Settings → Security. These accounts often hold material funds in transit and are common attack targets.

Practical patterns for tiny teams

A few patterns make MFA easier to live with in a one-to-twenty person business.

One authenticator app, multiple accounts. Microsoft Authenticator can hold dozens of accounts (Microsoft 365, Google, Xero, MYOB, bank). Staff do not need a separate app per service.

Lost-phone playbook. When a staff member loses or replaces a phone, an admin can reset their MFA registration so they can re-enrol on the new device. Document this in your one-page incident plan. The Microsoft 365 admin centre reset path is Users → user → Reset MFA contact methods.

Backup methods. Encourage every staff member to register at least two MFA methods — for example, the Authenticator app plus a phone number for SMS fallback. This avoids lockouts.

Owner uses a hardware key. The owner and any admin should have a YubiKey or equivalent registered in addition to the Authenticator app. About AUD 80 per key. Store one in the office safe as a backup.

Communicate before enforcement. Send a one-paragraph email three days before turning enforcement on. State the date, the reason (insurance, ACSC baseline), and what staff need to do. This reduces sign-in friction dramatically.

Where MFA fits in the broader baseline

MFA is one of three ACSC "quick wins" — alongside patching and backups — that align with the ACSC Essential Eight Maturity Model (accessed 16 June 2026) and make up the small business cyber baseline. It is also the first question on every Australian cyber insurance underwriting form in 2026 and is treated by the Office of the Australian Information Commissioner as a baseline expectation under Australian Privacy Principle 11.

If you want to see how MFA enrolment scores alongside the rest of your baseline, the free EDUC4TE Small Business Cyber Security Assessment includes MFA as a weighted question and produces an insurance-ready evidence list. If you would prefer a practitioner to deploy Microsoft 365 Security Defaults and the supporting Conditional Access policies for you, the practitioner-led assessment service includes that work in scope.

Sources

• Australian Cyber Security Centre, Small Business Cyber Security Guide, current edition late 2025. cyber.gov.au.
• Australian Cyber Security Centre, Essential Eight Maturity Model, November 2025 ISM revision. cyber.gov.au.
• Microsoft Learn, Security Defaults in Microsoft Entra ID, current 2026 guidance. learn.microsoft.com.
• Microsoft Learn, Plan a Conditional Access deployment, current 2026 guidance. learn.microsoft.com.
• Google Workspace Admin Help, Protect your business with 2-Step Verification, current 2026 guidance. support.google.com.
• Xero Central, Two-step authentication, accessed May 2026. central.xero.com.
• MYOB, Two-factor authentication, accessed May 2026. myob.com.
• Office of the Australian Information Commissioner, Australian Privacy Principles, APP 11. oaic.gov.au.
• business.gov.au, Cyber security for business, current edition 2026. business.gov.au.

Sources referenced in this article: OAIC Australian Privacy Principles, ACSC Essential Eight Maturity Model, Microsoft Learn Conditional Access, ACSC Small Business Cyber Security Guide, Google Workspace Admin Help, Xero Central, MYOB, business.gov.au, OAIC Notifiable Data Breaches determinations.