--- title: "Multi-factor authentication (MFA) on every account in 14 days" description: "Multi-factor authentication at work: where to enable it first, which methods to use, mistakes to avoid and a 14-day plan with no lockouts. No obligation." language: en url: https://www.dataroad-it.com/en/mfa-business-14-day-plan/ source: https://www.dataroad-it.com/en/mfa-business-14-day-plan/ publisher: DataRoad IT (DataRoad - IT Services and Consulting), Portugal --- > Multi-factor authentication at work: where to enable it first, which methods to use, mistakes to avoid and a 14-day plan with no lockouts. No obligation. # Multi-factor authentication (MFA) on every account in 14 days At a glance For decision-makers short on time. - 01 MFA stops most stolen-password attacks and almost never carries a licence cost. - 02 Start with Microsoft 365 or Google Workspace, then remote access and consoles. - 03 An app with number matching for the team; FIDO2 keys for management and administrators. - 04 A 14-day plan covers 100% of accounts without leaving anyone locked out of email. ### In this article **Most attacks on SMEs start with a stolen password, and most of those attacks stop at a simple confirmation prompt on a phone.** Multi-factor authentication (MFA) requires, on top of the password, approval in an app or with a physical key. For a business, it is the security measure with the highest return: as a rule it needs no additional licences and can be active on every account within two weeks. Even so, we still see 100-workstation companies where only the administrator uses it. Here, DataRoad - IT Services and Consulting sets out the sequence, the methods and a 14-day timetable that leaves nobody locked out of their email. ## What does multi-factor authentication protect against, and what not? **It protects** against the most frequent attack: the password was entered on a fake page, or reused on a service that suffered a data leak, and someone tries to get into email or the VPN. Without a second factor, they get in. With a second factor, they are left waiting for an approval only the victim's phone can give. **It does not protect** against malware already on the computer, or against people who approve prompts automatically. Even so, it closes the most used way in. ## Where should you start enabling MFA? - **Microsoft 365 or Google Workspace**: email, files and Teams are the company's identity and the favourite target. Administrators first, other users straight after. - **Remote access**: VPN, remote desktop, portals exposed to the internet. Anything that does not support a second factor is switched off or placed behind a service that does; more in [secure remote access when the VPN is no longer enough](https://www.dataroad-it.com/en/secure-remote-access-vpn-managed-firewall/). - **Banking, tax, social security and supplier portals**: most already enforce MFA; check that the methods are tied to company phones and not to former employees. - **Admin consoles**: firewall, switches, servers, domain, website hosting. Few people, maximum impact. - **Password vault**: with mandatory MFA, because it holds the keys to everything else. ## Which method should you choose for each person? | Method | Level of protection | For whom | | --- | --- | --- | | FIDO2 physical key | Maximum; phishing-resistant | Management, finance and system administrators | | App with notification and number matching (for example, Microsoft Authenticator) | High | The default for almost the whole team; the number prevents approving a request you did not make | | SMS | Weak, exposed to SIM swapping and interception | Only as an emergency fallback | | Code sent by email | Very weak | Do not use: if the email account is compromised, the second factor goes with it | ## Which mistakes make the team reject MFA? - **Asking for the second factor all the time** Once a day on each trusted device is enough. - **Ignoring those without a work phone** Tokens or physical keys solve that. - **Switching everything on at once, without warning** The helpdesk is buried in requests. - **Not planning for a lost phone** Without a recovery method, the person loses email in the middle of the working day. - **Forgetting MFA fatigue** The attacker fires off prompts in a row until someone accepts out of tiredness. Number matching and a rule repeated in training (never approve what you did not request) cut the problem. ## How do you cover 100% of accounts in 14 days? | Phase | What is done | | --- | --- | | Days 1 and 2 | All administrators on MFA. Policy finalised: mandatory, session remembered on trusted devices, SMS only as fallback. A one-page guide with screenshots. | | Days 3 to 5 | Pilot with one department: a 15-minute session, method registration, test. Adjustments to the guide. | | Days 6 to 10 | One department per day, with the helpdesk on standby. Anyone who has not registered is required to at their next sign-in, using Microsoft's grace period. | | Days 11 to 14 | Remote access and equipment consoles. Legacy methods disabled. Account-by-account check in the admin panel. | ## What does the business gain beyond security? - **GDPR** You now have a technical measure you can demonstrate. - **NIS2** The directive refers to multi-factor authentication explicitly. - **Cyber insurance** Insurers almost always ask about MFA and reflect it in the premium. - **Fewer support requests** Fewer calls from people who suspect someone has got into their email. ## How does MFA work under an IT Unlimited contract? Under [IT Unlimited](https://www.dataroad-it.com/en/managed-it-services/) contracts we configure the second factor on Microsoft 365, the VPN and admin consoles, as part of [Microsoft 365 administration](https://www.dataroad-it.com/en/microsoft-365-management/) and [managed cybersecurity for businesses](https://www.dataroad-it.com/en/managed-cybersecurity-services/). Conditional access ensures unmanaged devices can only get in through the browser. The monthly report shows the percentage of protected accounts; the target is always 100%. ## Frequently asked questions ### Does MFA cost anything? In most cases there is no licence cost, because it is included in Microsoft 365 and Google Workspace. Physical keys cost a few tens of euros per person and make sense for higher-risk roles. The real investment is the time for implementation and training. ### Will users have to confirm at every sign-in? No, with the right policy: confirmation happens once on each trusted device, with periodic renewal. On an unknown device the prompt always appears, and that is where the protection lies. ### What if someone does not want company apps on their personal phone? They use a physical key, a token or a work phone. It is never a reason to be exempt. ### With MFA, is a password manager still needed? Yes. MFA defends the account when the password is stolen; the manager stops the same password being reused on services without MFA. Find out more in [business password manager](https://www.dataroad-it.com/en/business-password-manager/). ## Are there accounts in your company without a second factor? We enable MFA on Microsoft 365, remote access and equipment consoles, with 15 minutes of training per team and nobody left locked out. Request a no-commitment proposal. **More than 10 workstations · support contract · remote, on-site and phone support.** Call +351 211 459 950 * or write to sales@dataroad.pt. **Call to a Portuguese landline.* Chosen by respected and international companies ★★★★★ 5,0 · 52 Google reviews ★★★★★ 5,0 · 52 Google reviews DataRoad ## Related articles [Managed IT and cybersecurityTeams on the move: securing laptops, phones and public Wi-FiThe real travel risk is an unencrypted lost laptop, not hotel Wi-Fi. With disk encryption, central management, MFA and a controlled connecti…12 October 2026 · 7 min read](https://www.dataroad-it.com/en/managed-cybersecurity-travelling-teams/)[Managed IT and cybersecurityExternal attack surface: what the internet sees of your companyAutomated attacks hunt for vulnerable versions, and company size is irrelevant. In 2025, CERT.PT recorded 3,864 incidents, 40% more than in …12 October 2026 · 5 min read](https://www.dataroad-it.com/en/external-attack-surface-managed-cybersecurity/)[Managed IT and cybersecurityNOC and managed cybersecurity: who watches your SME, and whenThe question is not whether you have a SOC: it is who receives the alert at 10 pm on a Saturday and what they do next. At DataRoad, nights, …12 October 2026 · 6 min read](https://www.dataroad-it.com/en/noc-managed-cybersecurity-sme/)[Managed IT and cybersecurityMicrosoft 365 security: the 10 controls that are yoursIn Microsoft 365, the platform is Microsoft's and the keys are yours. According to Microsoft, MFA and blocking legacy authentication stop mo…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/microsoft-365-managed-cybersecurity-shared-responsibility/)[Managed IT and cybersecurityGDPR and managed cybersecurity: 10 technical controls to proveWithout documented technical measures, a data breach turns from an IT incident into a problem with the regulator. Ten controls in three bloc…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/gdpr-managed-cybersecurity-10-technical-measures/)[Managed IT and cybersecurityExposed passwords: audit your domain and close the door in 5 daysThe risk is not the email appearing in a breach: it is the same password opening a work account. Change what is exposed, MFA on every accoun…12 October 2026 · 5 min read](https://www.dataroad-it.com/en/company-credentials-data-breach-check/)[Managed IT and cybersecurityAsset inventory: the basis of IT estate management and NIS2Without an asset inventory there is no planned renewal, no demonstrable security and no answer to CNCS. NIS2 entities must submit the list o…12 October 2026 · 7 min read](https://www.dataroad-it.com/en/it-asset-inventory-management-nis2/)[Managed IT and cybersecurityBreak-glass accounts in Microsoft 365: your company's insuranceA locked-out admin can leave email, Teams and files unmanaged for days. Break-glass accounts are the reserve administrator you only use when…12 October 2026 · 5 min read](https://www.dataroad-it.com/en/microsoft-365-break-glass-accounts/)[Managed IT and cybersecurityWindows 365 for business: when a cloud PC cuts costsA cloud PC pays off for consultants, seasonal staff, teams without an office and mixed Mac and Windows estates. For video, CAD or weak inter…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/windows-365-business-cloud-pc-costs/) Numbers you can verify **11** years in business **232** clients **< 10 min** average response time **15+** IT vendor certifications **10+** Countries with clients supported **5.0 ★** 52 Google reviews Transparency ## What many providers hide, we publish. [See plans and prices →](https://www.dataroad-it.com/it-unlimited/) - **Prices upfront** Essential from €395/month + VAT, Premium from €750 and Premium 365 from €1,200. - **No lock-in** Annual contract, no lock-in and no joining fees. - **Everything in writing** What is included, the scope and the price, before you sign. - **Support without counted hours** Remote and phone in every plan; on-site support from Premium. Partners and certifications DataRoad · Managed IT for business ## One StepAhead of IT. Technology that works quietly, so your team works without interruptions. Engineering precision in every request. - **11** years in business, since 2015 - **1** contract and one owner for everything - **0** DataRoad security incidents in 11 years We do **IT** right. DataRoad IT Unlimited ## Operational continuity is not luck. It is method and contract. IT Unlimited reduces risk and shows in writing what changed. [Request a proposal, no commitment →](https://www.dataroad-it.com/en/#contact)+351 211 459 950 **Call to a Portuguese landline · More than 10 workstations · support contract · remote, on-site and phone support[Not sure what you need? Talk to the assistant →](https://www.dataroad-it.com/en/#assistente) --- Versão HTML desta página: https://www.dataroad-it.com/en/mfa-business-14-day-plan/