Most hacked business accounts are not broken into with clever code. Someone simply gets the password: from a fake login page, a leaked list, or a sticky note. Two-step sign-in (also called two-factor authentication, 2FA or MFA) stops most of these, because a password alone is no longer enough.
This guide covers the three accounts a small business can least afford to lose: Google, Microsoft and Facebook. Menu names were checked on 11 October 2026.
What two-step sign-in means
After your password, you prove it is you a second way:
- An authenticator app on your phone (Google Authenticator, Microsoft Authenticator and others) that shows a 6-digit code or asks you to approve. Recommended.
- A passkey or security key, which is even stronger and faster.
- A text message code. Better than nothing, but SIM swaps and lost phones make it the weakest choice.
Google account (Gmail, Google Workspace)
- Go to myaccount.google.com.
- Open Security & sign-in.
- Under How you sign in to Google, choose 2-Step Verification and follow the steps.
- Add an authenticator app and print or save your backup codes.
- Optional: add a passkey. Signing in with a passkey skips the second step, because the passkey already counts as both.
For Google Workspace admins: you can require two-step sign-in for everyone in the Admin console, so no account is left without it.
Microsoft account
Personal Microsoft account (Outlook.com, Hotmail):
- Sign in at account.microsoft.com and open Security.
- Choose Advanced security options.
- Under Additional security, turn on Two-step verification.
Microsoft 365 for business:
- Microsoft's security defaults turn on multifactor sign-in for everyone in the company. Companies created since October 2019 may already have them on, but older ones may have them off.
- To check: Microsoft Entra admin center, Entra ID, Overview, Properties, Manage security defaults, set to Enabled.
- With security defaults on, every user must register for multifactor sign-in, admins must use it every time, and old sign-in methods that skip it are blocked.
- Microsoft also now requires multifactor sign-in for anyone who signs in to the Azure, Entra, Intune and Microsoft 365 admin portals.
Facebook and your business Page
Your business Page is only as safe as the personal Facebook accounts that manage it.
- In Facebook, open Settings and then Accounts Center.
- Go to Password and security, then Two-factor authentication.
- Choose the account, pick Authentication app, and save your recovery codes.
For the business: in Meta's business settings, an admin with full control can require two-factor authentication for admins or for everyone who works on the business portfolio. Turn it on for everyone.
Do these three things today
- Turn it on for the owner's accounts first: email, Facebook, domain and hosting, bank.
- Save backup codes somewhere safe and offline, or in your password manager. Losing your phone should not lock you out of the business.
- Turn it on for every staff account. One account without it is the weak point.
If someone gets a code they did not ask for
A sign-in prompt or code you did not request means someone has your password. Do not approve it. Change that password right away and check the account's recent sign-ins.
In short: a password alone is no longer enough. Ten minutes per account, an authenticator app and saved backup codes stop most account takeovers before they start.
Want to make sure every account in your office is covered? Book a free 30-minute consultation and we will go through them together. Want the next guide in your inbox? Use the newsletter box below.
Sources: Google 2-Step Verification · Google passkeys · Microsoft two-step verification · Microsoft Entra security defaults · Microsoft mandatory MFA · Facebook two-factor authentication. Checked 11 October 2026; updated 24 October 2026.