HowyGuard

How do I turn on MFA for every email account?

Howy the walrus holding up a phone with a green check mark

Turn on two-step sign-in, also called MFA, for every email account the business uses, and make it required so nobody can skip it. Shared inboxes and accounts for people who left count too. Google Workspace and Microsoft 365 can require it for everyone at once; a personal Gmail or Outlook.com address is set up one by one.

MFA means signing in takes a second step after your password, like a tap on your phone or a code.

Check if you already have it

List every email account the business has: yours, each staff member's, shared inboxes like info@, accounts for people who've left, and any account a scanner or booking tool sends from. Then check each one.

  • Google Workspace: in admin.google.com, go to Security, Authentication, 2-Step Verification and look for Enforcement on. Then in Directory, Users, add the 2-step verification enrollment column. Everyone should be enrolled.
  • Microsoft 365: in entra.microsoft.com, open Entra ID, Overview, Properties, Manage security defaults. It should say Enabled.
  • Personal Gmail or Outlook.com: open the account's security page and check two-step sign-in is on.

If even one account can sign in with only a password, it isn't done yet.

How to set it up

Turn on two-step sign-in for a personal Gmail or Outlook.com address

Personal Gmail or Outlook.com, needs your email password and your phone

  1. For Gmail: go to myaccount.google.com, open Security, then click 2-Step Verification and follow the prompts.
  2. For Outlook.com or Hotmail: go to account.microsoft.com, open Security, then Manage how I sign in, and turn on Two-step verification.
  3. Choose your phone as the second step. Save the backup codes somewhere safe, away from the computer.
  4. Do this for every address the business uses for client email.

How to show it's true: Screenshot the security page showing two-step sign-in is on for each address.

If you get stuck:
  • You're not sure a personal address is good enough: it can still use two-step sign-in. Moving to a business account in Google Workspace or Microsoft 365 is a good next step.

Before you finish, close accounts for people who've left (after saving anything you need), and give each shared inbox one owner who has two-step sign-in.

How to show it's done

Keep a dated screenshot of the admin page showing it's required, and of the user list showing everyone enrolled. For personal addresses, one screenshot of each account's security page. File them in your proof folder.

Admin accounts and remote access are separate items: see how to secure admin accounts and remote access.

Common questions

Does a text message code count?

It's a second step. The Google prompt or the Microsoft Authenticator app is easier for staff and harder to trick, so use those where you can.

Is MFA the same as 2FA or 2-Step Verification?

Yes. They're different names for the same thing: a password plus a second step.

How often should I check?

Before each renewal, and whenever someone joins or leaves. New accounts start without it.

Sources

  1. Canadian Centre for Cyber Security: Secure your accounts and devices with multi-factor authentication (ITSAP.30.030)cyber.gc.ca
  2. Google Workspace Admin Help: Deploy 2-Step Verificationsupport.google.com
  3. Microsoft Learn: Security defaults in Microsoft Entra IDlearn.microsoft.com
  4. Google Account Help: Turn on 2-Step Verificationsupport.google.com

Related