MFA and Passkey Rollout for a Small Team: A 30-Day Plan for Google Workspace and Microsoft 365

A company with fewer than 20 staff can complete a full MFA and passkey rollout in about 30 days, and the order is what decides whether it succeeds: secure the admin accounts first, enrol passkeys as the primary sign-in method second, retire SMS codes third, and close the quiet backdoors last. Most SME rollouts fail not because the technology is hard but because someone switched on enforcement for everybody on a Monday morning, locked out the one person who holds the billing account, and rolled the whole thing back by Tuesday. Done in sequence, this is a handful of evenings of work, and it is the single highest-value security change available to a small Singapore business before 2027.

What is the difference between MFA and a passkey, and why does it matter for a small team?

Multi-factor authentication means a password plus something else. A passkey replaces the password entirely with a cryptographic key stored on the device, unlocked by the staff member face, fingerprint or device PIN.

That distinction matters because the common forms of MFA are not equally strong. An SMS code can be read off a locked screen or intercepted after a SIM swap. A six-digit app code can be typed into a convincing fake login page by a tired employee at 7pm. A passkey cannot be phished in the same way, because it is bound to the real domain and never leaves the device as a reusable secret. For a small team with no security staff and no one monitoring logins, phishing resistance is not a nice-to-have. It is the difference between an incident and a non-event.

Both platforms support this today. Google Workspace lets passkeys serve as the sign-in method and lets administrators require two-step verification with an enrolment window. Microsoft 365 and Entra ID support FIDO2 passkeys and passwordless sign-in through Microsoft Authenticator, enforced through security defaults or Conditional Access.

Which accounts should you secure first?

Not everyone at once. Work outward from the accounts that can cause the most damage:

1. Super administrators. Whoever can create users, reset passwords and change billing. In most SMEs this is the owner and one IT-minded staff member.
2. Finance and payroll. The people who can move money, approve invoices or change bank details. Business email compromise targets this seat specifically.
3. Anyone holding customer personal data. Sales, HR, operations, clinic reception. This is where your PDPA protection obligation is most exposed.
4. Everyone else.
5. Shared logins and service accounts. The ones with no human owner. These need a different fix, covered below.

What does a 30-day rollout actually look like?

Week 1 — inventory and admin lockdown. List every account in the tenant, including ex-staff, test accounts and the shared info@ mailbox. Confirm how many super admins you have and remove the ones nobody can justify. Enrol the remaining admins on passkeys and register a hardware security key as backup. Buy two physical keys, store one off-site, and write down who holds it.

Week 2 — pilot with three people. One owner, one finance or HR person, one staff member who is openly impatient with technology. The third is the important one. If the sceptic can enrol a passkey on their own phone in four minutes with a one-page instruction sheet, your rollout will land. If they cannot, fix the instruction sheet before you touch the other fifteen people.

Week 3 — enrol everyone with a deadline. Set an enforcement date roughly two weeks out and announce it once in writing, with the reason. Both platforms let you require enrolment after a grace period rather than instantly. Run a fifteen-minute session at a team meeting and enrol people in the room. Do not send a link and hope.

Week 4 — enforce, then close the backdoors. Turn on enforcement. Then do the part everyone skips: remove the bypasses. Revoke Google app passwords, which allow a client to connect while ignoring two-step verification. Disable legacy authentication protocols where they are still permitted; Microsoft has already retired basic authentication for most Exchange Online protocols, but check what your own tenant allows. Review third-party apps holding OAuth tokens to your mail and Drive, and remove the ones nobody recognises. An enforced MFA policy with an open side door is theatre.

What breaks when you turn MFA on, and how do you avoid it?

Four things, predictably:

• Shared accounts. The reception login that four people use. MFA does not work on a seat with no owner. Convert it to a real mailbox with delegated access, or assign one owner and give the others delegation.
• Mail on old devices and copiers. Scan-to-email on a multi-function printer and ancient phone mail clients often rely on exactly the legacy paths you are closing. Identify them in Week 1, not on enforcement day.
• Integrations and scripts. Accounting sync, booking systems, anything connecting with a username and password. Move these to OAuth or a service account with scoped API credentials.
• The lost phone. Decide now who can reset a factor and how they will verify the person asking. Without this rule, your help desk process is a social-engineering vector. Two admins with hardware keys is the minimum workable answer.

How does this connect to Cyber Essentials, PDPA and your AI plans?

Access control with MFA on administrative and internet-facing accounts is part of what CSA expects under the Cyber Essentials mark, so this work is reusable if you later pursue the mark as a tender qualifier. Under the PDPA protection obligation you are required to make reasonable security arrangements for personal data in your possession, and in 2027 an organisation handling customer records on cloud email with passwords alone will have difficulty describing that as reasonable.

The AI connection is less obvious and more important. Every AI tool a small team adopts this year — a drafting assistant, a meeting summariser, an AI receptionist — is reached by signing in to an account. Identity is the control surface for all of it. Strong authentication plus clean offboarding is what makes AI adoption recoverable rather than reckless, because it means that when a staff member leaves, their access to the tools and the data behind them actually ends.

What does it cost?

Less than most owners expect. Passkeys and MFA are included in standard Google Workspace and Microsoft 365 business plans, so there is no licence uplift for the basic rollout. The real costs are two hardware security keys at roughly S$40 to S$90 each, perhaps six to ten hours of internal time across the month, and one awkward week while people build the habit. Against that, the cheapest compromised-email incident a Singapore SME can have still costs days of disruption, customer notifications and a difficult conversation about what was in the mailbox.

FAQ

Do passkeys mean we delete our passwords?
Not immediately. In practice most SMEs run passkey-first sign-in with the password still present but no longer the everyday method, then tighten further once enrolment is complete and backup factors are registered for everyone. Removing passwords outright before every staff member has two working factors is how you create a lockout.

What if a staff member refuses to put a work passkey on their personal phone?
It is a fair objection and you have options. A passkey does not give you control of their device, but you can avoid the argument entirely by issuing a hardware security key for that person, or by having them use a passkey stored on their work laptop. Budget for one or two spare keys for this reason.

Can we do this ourselves or do we need a vendor?
A 15-person tenant with no unusual integrations is genuinely a do-it-yourself project if someone internal is comfortable in the admin console and willing to follow the sequence above. Bring in help when you have shared logins across multiple sites, line-of-business software authenticating with stored passwords, or a Cyber Essentials submission attached to a tender deadline.