Clear Path step · Business · Accounts you know and control

Put phishing-resistant sign-in on email and every admin account

Set onceAbout 90 minNowWith your team

Email and every admin account need a passkey or code that can't be relayed, so one stolen password can't open the business.

Why it matters: Whoever controls your email or admin console can reset everything and impersonate you to clients. Phishing kits now relay codes in real time, so the accounts that matter most need sign-in that can't be relayed.

Best after: Name an owner and map what you'd lose

Do it

  1. Enforce MFA for all users from the Microsoft 365 or Google Workspace admin console.
  2. Give admins and anyone who approves payments passkeys or hardware security keys.
  3. Create separate admin accounts used only for admin work, not for email or browsing.
  4. Create one emergency admin account with a hardware key, store its credentials offline, and don't use it day to day.
  5. Turn on MFA for the bank, payroll, accounting and domain registrar for every user.

Say this: If a sign-in prompt appears that I didn't start, I deny it and tell whoever owns security.

Check it worked: Everyone signs in to email with MFA enforced from the admin console, admins and money-movers use passkeys or security keys, admin accounts are separate from daily accounts, and an emergency 'break-glass' admin exists offline.

If an outside IT company handles your IT, send them this:

Hi, could you please enforce MFA for every user from our Microsoft 365 (or Google Workspace) admin console? We'd like passkeys or hardware keys for admins, your technicians' accounts and anyone who approves payments, plus separate admin-only accounts. Please also create one emergency admin account with a hardware key and give its credentials to [owner] to store offline. Please confirm and list any exempted accounts.

Simply put

Admin accounts are the master keys to the building, and email is the front desk that can reissue every key. Sign-in that can't be relayed means a perfect fake page still gets nothing usable.

In detail

CISA recommends phishing-resistant MFA for small and medium businesses. The break-glass account matters because enforcement mistakes and lost keys are a common way owners lock themselves out mid-incident.

As a story

Monday morning, an email that looks exactly like your Microsoft 365 sign-in page says your office manager's password expires today. Between calls, she clicks the link and types her password.

The page asks for a code next, the way the real one would. But her account doesn't use codes anymore. It uses a passkey, and her laptop won't offer it to a site that isn't the real one. Nothing appears.

She pauses, closes the tab and reports the email. Your IT provider changes her password, signs her out of other sessions and checks her recent sign-ins. By mid-morning she's back on the phones, and nothing left the building.

If this is new to you: Worried about locking everyone out? That's what the emergency admin account is for: kept offline, with its own hardware key. Set it up before you turn on enforcement.

Points toward the Long View: every account that matters signing in without anything a phishing kit can relay.

Read more