Passkeys and MFA for Small Business Security

Minimum, not a compliance program

A ten-person office in Mays Landing does not need a security program with a steering committee. It needs MFA on the accounts that matter, and it needs to stop sharing one password for “the office Microsoft.” Passkeys are a good next step when the phones and the apps actually support them. They are not a reason to delay turning on MFA this week. Stolen passwords are still how most of the ugly weeks start.

We are not selling a certification, an audit badge, or a stack of controls we do not operate. We are telling you the lock that is missing. If a vendor leads with a framework acronym before they ask whether MFA is on, they are selling the binder.

MFA on Microsoft 365 and the firewall admin

Those two logins are the ones that pay. Mail and files live in Microsoft 365. The firewall is the front door of the building network. If either can be opened with a password that was in a breach dump, the rest of the stack is decoration. Turn on MFA for every user with a mailbox. Turn it on for global admin. Turn it on for firewall admin if the device can do it, and stop publishing that admin page to the world.

For the tenant, that sits in Microsoft 365 support. For the box in the rack, it sits in firewall work. Same team in Mays Landing either way. Seasonal staff should not inherit the owner’s login “just for the summer.” Create them, disable them in September.

Passkeys when the phones are ready

Passkeys (phone or hardware key as the login, not a typed password) cut the phishing path. They only help if the owner and the bookkeeper will use them, and if the apps you live in accept them. We will enable them where they stick. We will not pretend a shop that still shares a front-desk Windows login is ready for a passwordless poster.

Call 609-415-0011. Izzo Network, Mays Landing, NJ. If you already had a mailbox popped, say that first. The checklist is still MFA, admin roles, and whether the firewall is on default — then passkeys where they will actually get used.

Do not wait for a “security project” calendar slot. MFA is a setting and a conversation with the people who sign in, not a quarter-long program. The owner who travels, the bookkeeper who signs in from home, the counter PC that stays logged in as “Office” — those three are the work. We will sit with them in Mays Landing or on a remote session and finish the enrollments, then turn off the exception you were going to leave “just for a week.”