What MFA setup makes sense for a small business?

If most of your work already runs through Microsoft 365, start by checking what MFA and sign-in policies your existing Microsoft plan supports. Keeping it in the same identity system can mean fewer apps for staff and less account administration. The right setup depends on your licensing and which services you need to protect.

For a mixed environment with lots of different services, a dedicated provider such as Duo may be worth evaluating. It can cover a wider range of systems, but check the cost and integration needs first. “Works with lots of things” does not automatically mean every login or device will be covered the way you expect.

Before choosing a product, pin down what you mean by MFA. Protecting email and cloud apps is a different project from adding a second factor to a computer’s local login. List the accounts, devices, and remote access you need to protect, then compare the available options against that list.

Security keys can be a good passwordless option for people who want quick sign-ins, but plan for spares, replacements, and users who lose or forget a key. I’d offer an approved backup method and make account recovery part of the rollout, not an afterthought.

If you’re considering MFA at the Mac login window, test the awkward cases before deploying it widely: offline access, FileVault, password changes, sleep and wake, and recovery when a user’s second factor is unavailable. A setup that works for cloud apps may behave differently at the local login screen.