How to Roll Out 2FA Across a Small Business in 2026

Turn on the suite's second factor before buying another product. Microsoft 365 Business Basic is $7/user/mo, paid yearly, and security defaults require multifactor authentication at no extra charge. Google Workspace Business Starter matches that monthly rate on an annual plan. Cisco Duo Essentials is $3/user/mo, and a FIDO security key is $29, only for accounts an app code cannot protect.

Dupple data: of the five products priced for this rollout on 18 October 2026, two (Microsoft 365 and Google Workspace) include a second factor in the seat the company already pays for. The cheapest separate subscription that lists phishing-resistant MFA is Duo Essentials.

Two-factor authentication, also called multi-factor authentication, is a sign-in that asks for a second proof after the password: an app prompt, a one-time code, or a hardware key. Phishing-resistant MFA is the subset that will not answer a lookalike site, so reserve it for admins and for anyone who can move money. Prices below were read on 18 October 2026, and the 10-person totals are our arithmetic on those printed rates.

Path	Best for	What 2FA adds	The limit that matters
Microsoft 365 security defaults	A company already on Business Basic or Standard	No added software fee on top of the seat	You cannot require a phishing-resistant method
Microsoft 365 Business Premium	Requiring phishing-resistant sign-in	$22/user/mo, paid yearly, for the whole seat	The seat also buys device and threat protection
Google Workspace 2-Step Verification	A company already on Workspace	Included in the seat	New hires can still use a password during the window you set
Cisco Duo Free	10 or fewer users, basic prompts	$0/user/mo	Phishing-resistant MFA is not in this edition
Cisco Duo Essentials	Apps outside the email suite	$3/user/mo	Below 100 users, licenses sell in blocks of 10
Okta Workforce Identity Starter	A separate workforce identity platform	$6/user/mo, billed annually	$1,500 a year minimum, and Adaptive MFA is an add-on
Yubico Security Key NFC	Admins who need a hardware key	$29	FIDO only: it does not generate authenticator codes
YubiKey 5 NFC	Admins who also need codes from the key	$58	A tray of 50 is $2,900, the same unit price

What "2FA is on" actually means

On Microsoft 365, registration is not enforcement. Security defaults make every user register, make a list of admin roles complete MFA at every sign-in, and prompt ordinary users only when Microsoft decides the sign-in needs it. A company that flips the switch and then tells staff that every login asks for a code has described a stricter policy than the one they turned on.

That stricter policy is Conditional Access, and it needs Microsoft Entra ID P1. Microsoft's licensing page says Business Premium includes Entra ID P1 and that Conditional Access requires P1. Business Basic and Business Standard do not, so those seats cannot require a phishing-resistant method on a schedule you choose. The live Business Premium page is $22/user/mo, paid yearly, against $14/user/mo for Business Standard. The gap is the whole Premium suite, including Defender for Business, not a line item labeled "2FA."

Microsoft's write-up of security defaults says multifactor authentication plus blocking legacy authentication stops more than 99.9% of common identity attacks. That is the case for the baseline, not a hardware key for every employee. A code someone can read and retype on a fake page can still be relayed, which is the failure covered in our phishing controls guide.

Google draws the same line in the admin console. Deploying 2-Step Verification lets you allow it, then enforce it, and then pick the method: any method, any method except text and voice, or only a security key. Since passkeys were added, the security-key option accepts passkeys as well as keys, and Google says both have the same level of phishing protection.

Which accounts go first

Start with two emergency accounts before you enforce anything. Microsoft's security-defaults guidance says to keep two cloud-only emergency access accounts in the Global Administrator role, not tied to one employee, for the day every other admin is locked out. Exclude them from a phishing-resistant Conditional Access policy, and store the credentials offline rather than in the daily password vault.

Register the working admins before the policy is set to On. Microsoft's admin policy doc says to register a passkey (FIDO2), or to have a Temporary Access Pass ready, and to start the policy in report-only so you can see a lock before it is real. Turning on phishing-resistant MFA strength against admins who have only a password will lock the tenant.

After admins, enroll the people who can change a supplier's bank details or approve a payment, because that is who a payment fraud is written to reach. Everyone else comes third, on an app prompt at minimum. The owner is in the first group, not an exception, since an exception written for convenience is the account a phish is aimed at.

Tell people the date, whether the second factor is required, and which method you will accept, which is the first step in Google's deploy guide. Microsoft sends users to the Security info page on myprofile.microsoft.com so they can register before the prompt appears. For the daily incidents that show up while you are doing this, the Cyberpresso newsletter is the short brief.

How to turn it on in Microsoft 365

Use security defaults when the company is on Business Basic or Standard and nobody is ready to write Conditional Access policies. In the Microsoft Entra admin center, the path in Microsoft's doc is Entra ID, Overview, Properties, Manage security defaults, Enabled, Save. You need at least the Conditional Access Administrator role.

New tenants get a 24-hour grace period before those protections are enforced, so day one is for the emergency accounts and admin registration. Tenants created on or after 22 October 2019 may already have the setting on, so check it before you announce a rollout Microsoft already started.

Security defaults register people with the Microsoft Authenticator app's notification, and they may also use a code from that app or from another OATH TOTP app. Microsoft's licensing table does not list SMS as a second factor for security defaults applied to all users, so text is the wrong method to promise. Leave the methods enabled, because the same doc warns that disabling methods while security defaults are on can lock you out.

Security defaults also block older protocols, including Exchange ActiveSync basic authentication, because those protocols cannot do MFA. A scanner or an old phone on IMAP will stop the morning you enable the setting, so move it to a modern client first.

When you outgrow the baseline, disable security defaults only after a Conditional Access policy is ready to replace them. Microsoft's recommended admin policy targets the privileged roles, grants access only with phishing-resistant MFA strength, excludes the emergency accounts, and sits in report-only until you have read the impact. Business plans stop at 300 users, so a company heading past that cap needs an enterprise suite rather than another Business Premium seat.

Premium's endpoint tools, on the Microsoft 365 record, are a separate purchase from the sign-in policy, priced on our antivirus for business and EDR cost pages.

How to enforce it in Google Workspace

Enroll before you enforce. In the Admin console the path is Menu, Security, Authentication, 2-step verification, and you must be a super administrator. Check "Allow users to turn on 2-Step Verification," leave enforcement off while people enroll, and save. Accounts created before December 2016 already have 2SV on by default, so the window you manage is the newer accounts.

Enforcement can start immediately or on a date you name. The dated option begins within 24 to 48 hours of the date you pick, so use On if the start has to be exact. New users can be given an enrollment period from 1 day to 6 months, and during that period they sign in with a password alone. Keep that window short, and treat a group with enforcement off as a temporary bypass rather than a permanent home for people who missed the deadline.

For the method, "Any except verification codes via text, phone call" removes SMS and voice. Users still on those methods will be locked out on the enforcement date unless you have moved them first. "Only security key" is the phishing-resistant choice, and an admin has to issue backup codes in that mode because users cannot generate their own. There is a grace period, starting when you generate the code, so a lost key is recoverable without turning the policy off for everyone.

Google can let a user trust a device and skip 2SV until cookies are cleared. The deploy guide says to avoid that unless people constantly change devices, because a trusted browser on a shared front-desk PC drops the second factor.

Google's billing comparison, last updated 13 October 2026, prices Business Starter at $7/user/mo on the annual plan ($84 per user for the year) and $8.40/user/mo on the flexible plan. Business Standard is $14/user/mo on the annual plan, and Starter, Standard, and Plus cap at 300 users. The annual plan will not let you drop a license until renewal, so a seasonal hire is cheaper on the flexible plan even though the monthly rate is higher. Google sometimes discounts new customers, so budget the standard rates and read a first-year offer on the live pricing page.

Google Workspace is the directory record, and 2SV does not inspect the mailbox. If the problem you are actually buying for is forged invoices, pair the sign-in change with an email security control rather than expecting the prompt to catch a payment fraud.

When Duo or Okta is the product you are missing

The suite prompt covers Microsoft 365 or Google Workspace. It does not, by itself, put a second factor on the accounting app, the VPN, or the firewall admin page. That is the job of a dedicated MFA product, or of the app's own setting.

Cisco Duo prints four editions, and Free is $0/user/mo for 10 or fewer users, enough when a prompt will do inside that cap. Essentials is the first edition that lists phishing-resistant MFA, passwordless sign-in, single sign-on, and unlimited applications, so price it for apps the suite does not cover. Advantage sits between Essentials and Premier, and Premier is $9/user/mo and adds remote access to private resources without a VPN. There is a 30-day trial before the license block. Under 100 users, licenses sell in blocks of 10, so an 11th person means 20 licenses, $60 a month at the Essentials rate.

Okta's workforce pricing starts with Starter at $6/user/mo, billed annually, including single sign-on, MFA, Universal Directory, and five workflows. Adaptive MFA, which Okta describes as phishing-resistant, is an add-on on Starter, so the seat price is not the phishing-resistant price. Essentials, at $17/user/mo, lists Adaptive MFA in the suite. Professional and Enterprise are quote-only, with no public number for a budget. Every workforce suite has a $1,500 annual contract minimum. Okta's customer-identity platform is a different product, from $3,000 a month, and it is the wrong quote for employee sign-in.

Pick Duo when the email suite is already the directory. Pick Okta when you want the directory itself to move. If remote access is still a concentrator on the internet, read the small-business VPN and firewall comparisons beside the MFA edition.

What the hardware keys cost

A hardware key is the right second factor for the few people who can change tenants, move money, or reset everyone else's MFA. It is a poor default for a 10-person company that only needs an app prompt on email, because the suite already includes that prompt.

On 18 October 2026 the YubiKey 5 NFC page listed the USB-A key at $58, and a tray of 50 at $2,900, which is the same unit price. The Security Key series page listed the USB-A and USB-C NFC keys at $29 each. The Security Key is FIDO only: Yubico's spec says it does not generate one-time codes, and it is not serialized. A site that only offers an authenticator-app code will not accept it. Buy that key for Google and Microsoft passkey sign-in, and the 5 Series when a system still demands a six-digit code from the device.

Yubico's purchasing guide, updated for 1 January 2026, also sells keys as a subscription: Base at $15 per user per year (Security Key series), Advanced at $35 per user per year (YubiKey 5 series), and Compliance at $55 per user per year. A second key for the same person is 25% off, and each tier includes a 25% replacement allowance. The term renews for 3, 4, or 5 years unless you give 30 days' notice. A one-time purchase has no replacement keys in the price.

A 10-person bill, from the printed rates

These totals are our arithmetic, not a vendor quote. Ten Microsoft 365 Business Basic seats at the yearly rate are 10 × $7 × 12 = $840 a year, and security defaults add no second line. Ten Google Workspace Business Starter seats on the annual plan are 10 × $84 = $840 a year as well, using the yearly figure Google prints. The flexible Starter plan is priced at $100.80 per user for a year on that same billing page, so ten seats are $1,008, in exchange for being able to remove a user mid-year.

Duo Essentials for those ten people is 10 × $3 × 12 = $360 a year, on top of the suite, and only if you need MFA on apps the suite does not cover. Okta Starter for ten people is 10 × $6 × 12 = $720, which is under the annual minimum, so the contract is $1,500. That minimum is the number to put in the budget, not the per-user rate multiplied out.

Ten Security Keys bought outright are 10 × $29 = $290 once. Ten YubiKey 5 NFC keys are 10 × $58 = $580 once. YubiEnterprise Base for ten users is 10 × $15 = $150 a year, and two years of that subscription ($300) passes the one-time Security Key purchase. Advanced for the 5 Series is 10 × $35 = $350 a year, so year one favors the subscription and later years favor keys nobody loses, which is why a spare for each admin belongs in the order.

Microsoft's July 2026 packaging update raised Business Basic from $6, and existing customers stay on the earlier price until renewal. Entra Plan 1 on that same update is a separate SKU. Premium already includes Entra ID P1, so stacking the standalone plan on Basic buys Conditional Access without Premium's device and email protection. Compare those two quotes before stacking them on the same tenant.

Mistakes that leave a hole or lock the door

The admin roles Microsoft lists for MFA-at-every-sign-in include Global Administrator, User Administrator, Exchange Administrator, and Helpdesk Administrator. The owner who still uses a personal mailbox as the tenant admin is in that set, and exempting the owner leaves the account a phish wants outside the policy. Give them a separate admin account, register it, and keep daily mail on a normal user.

Google will lock out anyone whose only method is a text or a phone call if you switch the policy to "any except text and phone call" or to security keys. Move those people before you ban SMS, and track them with the login audit if you need a list, or the enforcement date becomes a lockout.

An authenticator entry inside the same vault as the password is not a second factor once that vault is open, because both proofs travel together. Keep the identity-provider prompt in an authenticator app or on a key. Our 2FA authenticator apps comparison is the phone-app decision, and 1Password vs Bitwarden covers why a vault code is a convenience feature. Pricing for the vault itself is on the Bitwarden pricing page and the password manager ranking, including the 1Password review.

A second factor is one of the controls a carrier asks about, and it is not a substitute for the rest of the application. The published premium picture is in how much cyber insurance costs.

FAQ

How do you set up 2FA for a small business in 2026?

Turn on the second factor in the suite you already pay for, register admins before you enforce, and add a hardware key or a separate MFA product only where an app code is not enough. Microsoft 365 Business Basic is $7/user/mo, paid yearly, with security defaults included. Duo Essentials, the cheapest edition on Duo's page that lists phishing-resistant MFA, is $3/user/mo.

How much does 2FA cost for a 10-person company?

If the company is already on Microsoft 365 Business Basic or Google Workspace Business Starter at the annual rate, our arithmetic is $840 a year for the ten seats and no added 2FA line. Duo Essentials for the same ten people is $360 a year on top. Okta Starter multiplies out below the contract floor, so the bill is the $1,500 annual minimum. Ten Security Key NFC devices are a one-time $290.

Is SMS 2FA enough for a small business?

It is enough to stop a reused password, and it is not enough against a live phishing proxy that asks the person to type the text into a fake page. Google's deploy guide lets you enforce any method except text and voice. Microsoft's security defaults for all users are built around the authenticator app, not SMS. Use a key or a passkey for admins and for anyone who can move money.

Does Microsoft 365 include multifactor authentication?

Yes. Every Business plan can use security defaults, which require registration and admin MFA without a separate MFA subscription. Requiring phishing-resistant MFA on a schedule you choose needs Conditional Access, which Microsoft includes with Business Premium at $22/user/mo, paid yearly. Basic and Standard do not include that control, so the tougher rule is a seat change rather than a toggle.

Should the company buy Duo if it already has Microsoft 365?

Buy Duo when something outside Microsoft 365 still accepts a password alone: the accounting system, a VPN, or an appliance admin page. Duo Free covers 10 or fewer users at $0/user/mo and does not include the phishing-resistant edition. Essentials does, and licenses under 100 users come in blocks of 10, so the 11th user doubles the block.

What if an employee loses a security key?

On Google, with "only security key" enforced, an admin generates a backup code and sets a grace period. Users cannot mint that code themselves, so an admin must issue the replacement. On a one-time Yubico purchase there is no replacement in the price, so a spare for each admin is part of the order. YubiEnterprise includes a 25% replacement allowance and prices a second key at 25% off.

Does an authenticator app replace a hardware key?

For ordinary mail and file accounts, an app prompt is the right default and it is already in the Microsoft and Google seats. It does not bind the login to the real site, so a proxy page can relay the code. A FIDO key or a passkey refuses the fake site. The cheaper Security Key will not produce six-digit codes, and the 5 Series will.

How we checked this page

We read the vendor pricing pages and the admin docs linked above on 18 October 2026, and we quote only figures those pages print. The 10-person totals, the tray-per-key division, and the Okta minimum comparison are our arithmetic. We did not run this rollout inside a customer tenant. Google's standard Workspace rates come from its billing comparison, last updated 13 October 2026. Microsoft's renewal caveat comes from its July 2026 packaging note: existing customers keep the earlier price until renewal.

Louis Corneloup, founder of Toolradar and Dupple, is the author. How products are described is on how we rate, and corrections sit in the editorial policy.

Cite this: Cyberpresso, "How to Roll Out 2FA Across a Small Business in 2026", October 2026.

For the security news behind these controls, subscribe to the Cyberpresso newsletter.

Some offers on this page may be paid placements or contain affiliate links.