Two-factor authentication adds a second check at sign-in, so a stolen password alone is not enough to access your firm's data. It takes a few minutes to set up and is one of the most effective security measures available.
What two-factor authentication does
Normally you sign in with something you know, your password. Two-factor authentication adds something you have, usually a short code from an app on your phone. Even if a password leaks, an attacker still cannot get in without that second factor. For a firm holding client information, this is well worth the small amount of effort.
Set it up for yourself
- Open your account settings. Look for the security section of your own profile, where sign-in options live.
- Choose to enable two-factor authentication. The most common and reliable method is an authenticator app such as Google Authenticator, Microsoft Authenticator, or a password manager that supports codes.
- Scan the code. Point your authenticator app at the code shown on screen to link your account to the app.
- Confirm with a code. Enter the current code from the app to prove the link worked before you finish.
- Save your recovery details. If backup or recovery codes are offered, store them somewhere safe and separate from your phone.
An authenticator app is more reliable than text-message codes, which can be delayed or intercepted. If you can choose, choose the app.
Rolling it out to the team
Turning it on for yourself protects one account. The real benefit comes when everyone uses it. A calm, well-supported rollout works far better than a surprise requirement.
- Enable it on your own account first, so you can walk colleagues through the exact steps.
- Give the team a short window to set it up, and offer to sit with anyone who is unsure.
- Make sure each person saves their recovery codes at the same time, since that is the step people most often skip.
- If your plan lets administrators require two-factor authentication for everyone, consider turning that on once the team is comfortable.
If someone gets locked out
People change phones, and codes get lost. If a colleague cannot sign in because they no longer have their authenticator, an administrator can reset their two-factor setup so they can enrol a new device. Confirm the person's identity through a trusted channel before you reset anything, because this same step could be misused by an impostor.
Recovery codes are the safety net for a lost phone. Encourage everyone to store theirs in a password manager the moment they turn two-factor authentication on, not later.