Two-factor authentication and passkeys: switch them on everywhere in one afternoon

Two-factor authentication (2FA) means an account asks for a second proof after your password: a code from an app, a tap on your phone, a security key or a passkey. Someone who has stolen or guessed your password still cannot get in. This guide shows how to set up two-factor authentication on every account that matters in one afternoon, in the order that protects you most, then how to make it compulsory for your whole team.

Where a service offers passkeys, make one your main way in: they are stronger than codes and quicker to use. I will show you both.

Some of my clients called me in an emergency after their website had been hacked. Hacks have many possible causes, so I won’t claim a second factor would have prevented every one of them. But a stolen password is one of the doors it closes, and closing it costs you an afternoon.

This tutorial is one chapter of my cybersecurity guide for small teams. It works best with a password manager for the whole team, because that is where your backup codes will go.

Which 2FA method to choose: passkeys first, SMS last

Second factors are not equal. In 2026 the UK’s National Cyber Security Centre (NCSC) changed its advice: it now recommends passkeys wherever a service supports them, and 2-step verification only where it does not. Its technical assessment found that codes sent by SMS or email, codes from an app and push approvals can all be phished, because a fake login page can ask you for the code and use it straight away. Passkeys and security keys resist this: they only work on the real website.

What a passkey is, in plain words

A passkey replaces your password with a pair of cryptographic keys. The website keeps the public half; the private half stays with you, on your device or in your password manager, and is never sent to the website. When you sign in, you confirm with your fingerprint, your face or your device PIN, and there is nothing to type that a fake page could capture.

Google, Microsoft and Apple accounts support passkeys, and so do the team password managers Bitwarden, 1Password and Proton Pass. On a Google account, a passkey replaces the second step on its own, because it already proves you hold the device.

One caveat from the NCSC: a passkey synced through your Apple, Google or password manager account is only as safe as that account. Protect that account first, with two methods.

How to set up two-factor authentication in the right order

Start with the accounts that can reset or take over the others. Every “forgot your password” link lands in your inbox, so email comes first.

The password manager comes last for one reason only: you keep it open all afternoon to save codes. If it has no second factor yet, add one at the end, before you close it.

Before you start

• Your phone, with an authenticator app (Google Authenticator or Microsoft Authenticator) or your password manager’s code generator.
• Your password manager, with a folder or shared vault for backup codes, and the list above with the person who owns each account.
• Optional: two security keys for your main administrator account (super administrator in Google Workspace, Global Administrator in Microsoft 365), one to carry and a spare kept somewhere else.

Step 1: turn on 2-Step Verification on your Google account

Google’s name for 2FA is 2-Step Verification. On a personal account, or on your own Google Workspace account:

1. Open your Google Account and select Security & sign-in.
2. Under How you sign in to Google, select Turn on 2-Step Verification and follow the instructions.
3. Add a second step on your phone. Google recommends its prompts over typed codes, because tapping a prompt is easier than typing a code. Add an authenticator app as well.
4. Download or print your backup codes: ten 8-digit codes, each of which works once. Save them in your password manager.
5. If you want a phone number as a backup, add it now: Google says validating a number for this can take up to seven days.

On a work account where the option is missing or greyed out, your Workspace administrator controls it (Step 5 shows the admin side). Google’s help page has the current steps for each device. For a personal Microsoft account (Outlook.com, Hotmail), the option is in the Security section of account.microsoft.com.

Step 2: pair an authenticator app on your other accounts

An authenticator app covers the services without passkeys. Pairing works the same way almost everywhere:

1. Open the service’s security settings and choose the authenticator app option (it may be called authentication app, TOTP or 2-step verification).
2. A QR code appears. In your app, add an account and scan it.
3. Type the six-digit code the app shows, to prove the pairing worked.
4. Save the backup codes the service gives you, straight into your password manager.
5. Rename the entry in the app so you can tell accounts apart: “Stripe, company account” is clearer than an email address.

Microsoft 365 work accounts are the exception: once security defaults are on (Step 5), everyone registers Microsoft Authenticator with notifications. After that, it or another authenticator app can also provide codes.

Step 3: create a passkey and test it

Start with your Google or Microsoft account, then look for the word passkey in the sign-in or security settings of every other service on your list.

1. In the sign-in settings, choose to create a passkey.
2. Your device asks where to save it: on this device, in your Apple or Google account, or in your password manager. For a work account, pick a place that survives a lost phone: a synced account or your password manager.
3. Confirm with your fingerprint, your face or your device PIN.
4. Sign out, then sign back in with the passkey to check it works before you rely on it.

Step 4: work through the rest of the list

• Domain registrar. The setting is in your account’s security settings, not in the domain’s DNS. While you are there, check that the domain lock and auto-renew are on, and that the account belongs to the business, with an email address the business controls: getting a domain back from a former web designer takes far longer than protecting it today.
• Bank. Your bank already makes you confirm sign-ins and payments, usually in its app. Check which phone receives those approvals (yours, not a former employee’s) and, if your bank offers it, require a second person to approve new payees. It also helps against fake “new bank details” emails.
• Website. On Squarespace (the builder I give clients who edit their own site), Wix and WordPress.com, two-factor authentication is a setting of each person’s own account, so every contributor turns it on for their own login. A self-hosted WordPress site needs a plugin, such as Two Factor from the WordPress.org directory. Give designers and freelancers their own login rather than yours: regaining access when a former provider holds the keys is the long version of why.
• Payments. In Stripe and PayPal, pick an authenticator app or a passkey over SMS where the security settings offer it, and give each colleague their own user instead of the owner’s login.
• Accounting, invoicing and cloud storage. Xero, QuickBooks, FreeAgent, Dropbox, Box and the rest hold client data and bank details: look in your user profile or the account’s security settings.
• Social media and ad accounts. Facebook, Instagram, LinkedIn, TikTok and your ad accounts. In Meta Business Suite, Settings > Security Centre lets an admin require two-factor authentication for everyone who has access to the business portfolio. Google Ads uses your Google account, so Step 1 already covers it.
• The password manager. Turn on its second factor, then keep its recovery kit or recovery code on paper, somewhere safe, never inside the vault it opens.

Step 5: enforce two-factor authentication for the whole team

Switching it on for yourself protects you. Enforcing it protects the colleague who never gets round to it.

Google Workspace

You need a super administrator account. Google already enforces 2-Step Verification on administrator accounts itself, and applies it immediately when someone is made an admin.

1. Give the team a date, and ask everyone to turn on 2-Step Verification on their own account (Step 1).
2. In the Admin console, go to Menu > Security > Authentication > 2-step verification, pick the whole organisation or one organisational unit, and allow users to turn it on.
3. Check who has enrolled in the Security report among the user reports.
4. Switch Enforcement on, either straight away or from a date. Google warns that a date can take 24 to 48 hours to take effect, so choose immediate enforcement if the timing matters.
5. Set a new user enrolment period (one day to six months), during which new starters can sign in with just their password.
6. Under Methods, choose Any except verification codes via text, phone call once everyone has an app, a passkey or a security key.
7. Save. Google’s deployment guide covers the other options.

Microsoft 365

Security defaults are free and switch on multifactor authentication for the whole tenant in one go. They suit a team that does not use Conditional Access.

1. Tell the team the day and time, and check that everyone has Microsoft Authenticator on their phone.
2. Sign in to the Microsoft Entra admin centre (entra.microsoft.com) with a Global Administrator account and go to Entra ID > Overview > Properties.
3. Select Manage security defaults, set them to Enabled and save.
4. Microsoft recommends revoking existing sessions afterwards, so that everyone signs in again with the second factor.

Microsoft’s security defaults page lists exactly what they switch on. With Microsoft 365 Business Premium, Conditional Access (part of its Microsoft Entra ID P1 licence) allows finer rules, such as phishing-resistant methods for admins, once you have switched security defaults off. My guide to the Google Workspace and Microsoft 365 admin settings covers the rest of the console.

Backup codes, lost phones and leavers

Where to keep backup codes

Keep them in the password manager, in a vault that you and one other trusted person can open, never in a desktop file or your inbox; only the password manager’s own recovery kit stays on paper. When you generate a new set of Google backup codes, the old set stops working, so replace the copy in the vault straight away.

When a phone is lost or replaced

1. Sign in with your second method or a backup code.
2. In the account’s security settings, remove the lost phone and sign out any session you do not recognise.
3. Pair the authenticator app on the new phone, and turn on its backup or transfer option if it has one.
4. For a locked-out colleague, a Google Workspace admin can generate backup codes for them, and a Microsoft 365 admin can make them register their methods again.

When someone leaves

Remove their access, their registered devices and their security keys on their last day. The offboarding checklist lists every access to close.

Your one-afternoon checklist

• Email: 2-Step Verification on, a passkey, an authenticator app and backup codes saved.
• Registrar and bank: second factor on, domain lock and auto-renew checked, bank approvals going to a phone the business controls.
• Everything else on the list: second factor on, one login per person, the password manager’s recovery kit on paper.
• Team: enforcement on in Google Workspace, or security defaults on in Microsoft 365, and SMS ruled out once everyone has an app or a passkey.
• Every important account: two methods registered, backup codes in the shared vault.
• In six months: check which services have added passkeys, and switch to them.

If you have already lost access to an account, or a former provider still holds the phone that receives the codes, an afternoon will not fix it: that is a rescue job, and I answer those the same day or within 24 hours.