I help Sydney businesses implement multi-factor authentication across the accounts they depend on. That includes Microsoft 365 and Google Workspace, but also the domain registrar, password manager or hosting account that can unlock everything else.
The service suits small teams without a dedicated security team: owners, staff and contractors using a growing collection of cloud services with inconsistent MFA. Hardware security keys and passkeys are useful options within that work, alongside authentication policies, recovery planning and staff setup.
What does MFA implementation involve?
Enabling MFA is one step. A workable deployment also needs to establish who controls each account, which login methods the service supports and how the business will recover access if a device is lost or an administrator leaves.
For a professional services firm, the scope might start with email and cloud files, then extend to DNS, hosting and WordPress administration. Cloud accounting, CRMs and booking platforms may have separate logins and recovery processes. I check those dependencies before changing access.
A typical engagement follows this sequence:
- Identify important accounts, their owners and anyone with administrator or privileged access.
- Review existing MFA, authentication policies, recovery contacts and service compatibility.
- Select suitable methods and arrange backup authentication and emergency access before enforcement.
- Configure and test a pilot where the platform allows it, including normal work and recovery scenarios.
- Help users register, then enforce the agreed settings in stages where supported.
- Remove weaker methods where appropriate after replacements and recovery have been tested.
- Document the configuration, staff instructions, onboarding, offboarding and who can authorise recovery.
You receive a record of what changed, any remaining gaps and the steps needed to maintain access. Staff instruction can include registering keys, recognising legitimate prompts and reporting unexpected approval requests.
Book an MFA implementation consultation
Microsoft 365 MFA implementation
Microsoft 365 authentication is managed through Microsoft Entra ID. I review user and administrator accounts, existing MFA settings and the applications or devices that might be affected by enforcement. Separate administrative accounts deserve particular attention because they can change other users' access.
Security Defaults can provide a baseline without an additional Entra licence. It is a tenant-wide setting with limited customisation, so users and dependent applications need preparation before it is enabled. It should not be treated as a tool for selectively enforcing MFA on a pilot group. See Microsoft's Security Defaults guidance.
Conditional Access offers more control where the environment and licensing justify it; it requires at least Microsoft Entra ID P1 for users in scope. The review establishes which approach is appropriate before changes are agreed. Passkeys and FIDO2 security keys can be considered for supported sign-in scenarios, with authentication method policies and device compatibility checked first.
Legacy authentication and older integrations need review because they may not support MFA. Emergency or break-glass access also needs deliberate design, independent recovery dependencies and testing against the tenant's actual policies. A permanently unprotected administrator account is not a sound default recovery plan.
Google Workspace MFA and 2-Step Verification
For Google Workspace, I review 2-Step Verification enrolment and enforcement, starting with administrators and the people who handle sensitive business accounts. The work can include passkeys or security keys, checking staff devices and helping users register backup access.
Enforcement needs to account for existing users and new starters. Recovery arrangements should avoid leaving the business dependent on one person's phone or one super administrator. I check the available policy controls and prepare staff before enforcement, following Google's deployment guidance.
Choosing passkeys, authenticator apps and hardware keys
The right method depends on the account and the people using it. Authenticator apps can be a practical improvement over password-only access. Codes and push approvals can still be phished or abused, and SMS adds risks such as phone-number takeover.
Passkeys and FIDO2 hardware security keys bind authentication to the legitimate site or service, providing phishing resistance. A passkey may be held on a device, synchronised through a supported credential manager or stored on a hardware key. Those choices have different recovery and ownership implications.
YubiKey implementation includes checking the key model and the service's supported mode, registering keys and arranging spares. A hardware key's one-time-code mode should not be confused with its phishing-resistant FIDO2 mode. For the threat background, read the authentication attacks and stronger MFA guide.
MFA does not prevent every account compromise. A compromised device, stolen session or weak recovery process can still undermine it. ASD's implementation guidance explains the value of phishing-resistant authentication. Solway can help businesses move towards authentication practices consistent with Australian cyber security guidance; this service is not a formal Essential Eight assessment or certification.
Recovery, lost devices and staff changes
Recovery should be planned while everyone still has access. That means registered backup factors where supported, securely stored recovery information, a named person authorised to approve resets and a way to verify the user independently of the account they cannot access.
When a phone or key is lost, the documented process should cover removing its credentials, checking for signs of misuse where relevant and registering a replacement. Staff departures also require access removal across connected services. Disabling a mailbox alone may leave a separate hosting or accounting login active.
Why work with Solway?
My work spans cybersecurity, networking and web systems, including the DNS, hosting and email services that sit behind business accounts. You can read about my professional experience and technical capabilities.
That breadth matters when an email address can reset a registrar password, the registrar controls DNS and DNS controls mail delivery. I look at the recovery chain as well as the login screen. Where mailbox settings and domain authentication need attention, the related email security review covers that work.
Onsite rollout and training are available in Sydney CBD and surrounding areas where appropriate. Remote work may suit teams that can register and test with guidance. The same account and recovery work can support executive home offices and private clients, with scope agreed around their systems.
Frequently asked questions
What does an MFA consultant actually do?
I review important accounts, select suitable authentication methods, configure and test the setup, help staff register and document recovery. The scope can cover one platform or the connected services your business relies on.
Can you implement MFA for Microsoft 365 and Google Workspace?
Yes. I can review Microsoft Entra ID authentication or Google Workspace 2-Step Verification and help implement appropriate settings. Available methods and enforcement options depend on the platform, licences, devices and existing configuration.
Should we use SMS, an authenticator app, passkeys or hardware keys?
Passkeys and FIDO2 security keys offer phishing resistance on supported services. Authenticator apps can be practical where those options are unavailable. SMS is generally better than a password alone but has limitations. The choice also needs to account for staff devices, accessibility and recovery.
Can you migrate us from SMS MFA?
Yes, where the service supports a suitable replacement. Register and test the new method and backup access before removing SMS, then check that the remaining recovery options do not undermine the change.
What happens if someone loses their phone or security key?
Use a previously registered backup method or the documented administrator recovery process after verifying the person's identity. Remove the lost factor and register its replacement. Backup keys and controlled recovery access should be arranged before enforcement.
Can MFA be rolled out without locking staff out?
Preparation and testing reduce the risk, but no rollout can promise zero disruption. I check compatibility, help users register and test recovery before enforcement. Some platforms allow a pilot group; tenant-wide settings such as Security Defaults require a different rollout plan.
Do you provide onsite MFA setup in Sydney?
Yes. Onsite setup and staff training are available in Sydney where appropriate. Remote implementation may also be practical, depending on the systems, access and support the team needs.
How much does an MFA implementation cost?
Cost depends on user numbers, the services involved, existing authentication, recovery requirements and onsite support. Any hardware keys or licence changes are identified when agreeing the scope. Contact me with your platforms and approximate team size to discuss the work.
Discuss your MFA setup
Tell me which platforms you use, roughly how many people need access and what prompted the review. We can establish the scope, including any hardware, licensing or onsite training requirements.