Two-factor authentication and passkeys for small teams

Two-factor authentication, or 2FA, asks for a second proof on top of a password, such as a phone code or a security key. Passkeys go further and replace the password with a cryptographic key held on the device. Turn on the strongest option each account offers, starting with email.

Stolen and reused passwords are a common way into business accounts. A second factor means a leaked password alone is no longer enough, and it costs each person a few seconds at sign-in. This guide explains the options in plain terms and how to roll them out without locking anyone out.

2FA, MFA and passkeys: the terms

• Factors are kinds of proof: something you know (a password or PIN), something you have (a phone or a key) and something you are (a fingerprint or face).
• Two-factor authentication combines two different kinds. A password plus a code from your phone is 2FA; two passwords are not.
• Multi-factor authentication, or MFA, means two or more factors. 2FA is a form of MFA, and many people use the terms interchangeably.
• Passkeys are a newer sign-in method built on public-key cryptography. You confirm with the face, fingerprint or PIN you already use on your device, and there is no password to steal.

Second-factor methods compared

Method	How it works	Resists phishing?	Watch out for
Text message code	A code arrives by SMS	No	SIM swapping and intercepted messages
Authenticator app code	The phone shows a code that usually changes every 30 seconds	No	A fake sign-in page can relay the code in real time
Push approval	Tap Approve in a prompt on the phone	No	Repeated prompts that wear people down; number matching helps
Security key	Plug in or tap a small hardware key	Yes	Keys can be lost; register a spare
Passkey	Confirm with face, fingerprint or device PIN	Yes	Plan for a lost or replaced device

Any second factor is far better than none. A text message code still stops an attacker who has just a leaked password. But if a method can be typed into a look-alike page, it can be phished, which is why security keys and passkeys sit at the top of the list.

How passkeys work

When you create a passkey for a service, your device makes a pair of keys. The service stores the public key; the private key stays on your device, or syncs between your devices through your password manager. At sign-in, the service sends a challenge, your device signs it after you confirm with your face, fingerprint or PIN, and the service checks the signature.

Two properties make this strong. There is no shared secret on the server for an attacker to steal and reuse. And the passkey is tied to the real site's address, so a fake page on a different domain cannot ask for it. Passkeys are also easier for people to use than a password plus a code, which matters as much as the cryptography.

A rollout plan for a small team

1. List the accounts. Email, banking, accounting and invoicing, the CRM, file storage, the domain registrar and any admin consoles. Note who has admin rights on each.
2. Start with email. Email is the reset path for many other accounts, so whoever controls a mailbox can often take over everything else.
3. Then money and admin. Banking, payment and finance tools, and every administrator account, come next.
4. Pick the strongest method each service supports. Passkeys or security keys where offered, an authenticator app where not, text messages as a last resort.
5. Register two methods per person. A passkey on the laptop and the phone, or a security key and a spare. One lost device should never lock someone out.
6. Store recovery codes safely. Keep them in a password manager or printed in a locked drawer, not in a note on the same phone.
7. Make it the rule, then check. Where a service lets an administrator require 2FA for everyone, switch that on and review who has enrolled.

If your team signs in to many tools through one company identity, single sign-on lets you enforce strong sign-in in one place. The guide to single sign-on for a small business covers how that works.

Plan for lost phones and leavers

• Lost or replaced devices. Decide in advance who can verify a person and reset their second factor, and how. Attackers call help desks too, so require a check that a voice on the phone cannot fake.
• People who leave. Remove their access and their registered keys on the day they go, and rotate any shared credentials they knew.
• Shared devices. A second factor protects sign-in, not an unattended screen. Pair it with short idle timeouts; the guide to auto-logout policies for shared devices explains the trade-offs.

Questions to ask a business software vendor

• Which sign-in methods are supported: passkeys, security keys, authenticator apps, text messages?
• Can an administrator require a second factor for every member?
• Does it support single sign-on with your company's identity provider?
• How are passwords stored? The guide to how passwords should be stored explains what a good answer sounds like.
• What does account recovery look like, and how do you verify the person asking?

Sign-in is one part of a vendor review. Where your data is kept is another; see questions to ask vendors about where business data is stored.

Frequently asked questions

Is SMS two-factor authentication still safe?

It is much safer than a password alone, but it is the weakest second factor. Text messages can be intercepted or redirected through SIM swapping, and codes can be phished. Use an authenticator app, a security key or a passkey where the service offers one.

Are passkeys more secure than 2FA?

Passkeys resist phishing and leave no password on the server to steal, which makes them stronger than a password plus a typed code. A passkey also combines two factors in one step: the device you have and the face, fingerprint or PIN that confirms it.

What happens if someone loses their phone?

If they registered a second method or kept recovery codes, they sign in with that and remove the lost device. If not, an administrator or the service's recovery process has to verify them, which is slower. Registering two methods per person avoids many lockouts.

Does a small business need MFA?

Yes, for any account that holds customer data, money or admin rights. Attackers do not skip small businesses, and turning on a second factor is one of the cheapest defenses available.