How to Set Up an MFA Authenticator App and Why It Matters for Your Business

One of the most consistent conversations Gennix has with businesses across the Lower Mainland is about multi-factor authentication. Most businesses have heard they need it. A growing number have it switched on. Far fewer understand what type they are using, whether it would actually hold up against a modern attack, or whether the accounts it protects have been configured correctly. Multi-factor authentication is one of the most effective security controls available to a small or mid-sized business, but its effectiveness depends entirely on how it is implemented. Not all MFA is equal, and the difference between a well-configured MFA environment and a poorly configured one can be the difference between a secure business and a compromised one. 

This post covers how to set up an MFA authenticator app, why the method matters, what phishing-resistant MFA means, and how Gennix approaches MFA setup and management for businesses across the Lower Mainland. 

What Is Multi-Factor Authentication and Why Does Every Business Need It? 

Multi-factor authentication is the practice of requiring more than one form of verification to access an account. The most familiar example is a password combined with a code sent to your phone, but MFA encompasses a wide range of methods with very different security properties. The underlying principle is that even if an attacker obtains one factor, typically the password, they still cannot access the account without the second. 

Passwords are consistently the weakest point in business security. They get reused, shared, phished, or leaked in data breaches. For any business with accounts accessible from the internet, compromised passwords are a matter of when, not if. MFA does not fix the underlying problem with passwords, but it means a compromised password alone is no longer sufficient for an attacker to gain access. 

Gennix strongly recommends MFA for every business account where it is available. This includes Microsoft 365 accounts, banking and financial platforms, cloud storage, line-of-business applications, and any third-party service that holds client data or business-critical information. The recommendation is consistent regardless of business size. A medical clinic in Langley, a law firm in Surrey, and a manufacturing company in Abbotsford all face the same credential risks, and MFA addresses them in the same way. 

The regulatory and insurance dimension has also made MFA non-negotiable for many businesses. Cyber security insurance underwriters now routinely ask whether MFA is enabled on all accounts as a condition of coverage. Businesses that cannot confirm MFA is in place may face higher premiums, reduced coverage, or denied claims in the event of a breach. This has moved MFA from a best practice to a business requirement in a very short period of time. 

What Is an MFA Authenticator App and How Does It Work? 

An MFA authenticator app is a smartphone application that generates time-based one-time passwords (TOTP) for use as the second factor when logging into accounts. The code is typically six digits, refreshes every thirty seconds, and is generated by an algorithm running locally on the device using a shared secret established during setup. Because the code is generated on the device itself rather than transmitted over a carrier network, it is significantly harder to intercept than an SMS code. 

The setup process links your account to the authenticator app by sharing a secret key, typically done by scanning a QR code displayed in the account's security settings. Once linked, the app and the account's authentication server both generate the same codes at the same time using the same algorithm. When you enter the code from your app at login, the server confirms it matches what it expects for that moment and grants access. An attacker without your device cannot generate the correct code. 

Gennix recommends three authenticator apps for business use: Microsoft Authenticator, Google Authenticator, and Duo. All three are well-established, regularly updated, and supported across the major platforms businesses use. For clients running Microsoft 365 managed services, Microsoft Authenticator is the natural recommendation because it integrates directly with the Microsoft ecosystem. It supports push notifications in addition to time-based codes, which makes the login process faster for users, and it includes number matching, a feature Gennix specifically configures to prevent MFA fatigue attacks. Google Authenticator is a straightforward and reliable option for businesses with a broader mix of platforms. Duo is particularly well-suited to environments where the IT team needs more administrative visibility and control over authentication events across the organization. 

One important practical consideration Gennix raises with all clients is backup access. If an employee loses or replaces their phone and has not backed up their authenticator app, they can be locked out of their accounts. Gennix addresses this during setup by ensuring backup codes are saved securely and that there is a documented process for recovering access that does not rely on an employee's personal device being available. 

How to Set Up an MFA Authenticator App for Your Business Accounts 

The general setup process for linking an authenticator app to a business account follows a consistent pattern across most platforms. Download the authenticator app on your smartphone. Navigate to the security or account settings of the service you want to protect. Look for the option to add a new authentication method and select authenticator app. The platform will display a QR code. Open the authenticator app, add a new account, and scan the QR code. The app will generate a six-digit code. Enter this code into the platform to confirm the link is working correctly. Save the backup codes the platform provides in a secure location such as a password manager. 

For Microsoft 365 specifically, the setup is managed through the Microsoft 365 admin centre rather than account by account. An administrator configures a conditional access policy that requires MFA for all users, selects the permitted authentication methods, and sets the enforcement rules. Users are then prompted to register their MFA method the next time they log in. This centralized approach is how Gennix configures MFA for clients, because it ensures the policy is applied consistently across the entire organization rather than relying on each employee to set it up correctly on their own. 

The Gennix MFA rollout process for a client goes through several stages. First, the MFA policies are configured and tested by the Gennix team on a subset of accounts before being rolled out to everyone. This testing phase catches any configuration issues, including conditional access conflicts, application compatibility problems, or licensing gaps, before they affect the whole team. Once the policy is confirmed working, Gennix provides the client with clear written documentation explaining what MFA is, why it is being enabled, and exactly how staff should complete their own enrollment. For any staff member who needs additional help, Gennix is available at the client site to walk them through the process in person. This on-site availability is a meaningful part of how Gennix handles these rollouts, because the failure point for MFA implementations is often not the technical configuration but the human element: staff who do not understand what is being asked of them or who get stuck at a step and give up. 

→ Need MFA properly configured across your team's Microsoft 365 environment? Talk to Gennix about getting it set up correctly from the start.

Authenticator App vs SMS MFA: Why the Method You Choose Matters 

Many businesses have MFA enabled but are using SMS as the delivery method because it was the easiest option to turn on. SMS MFA is meaningfully better than no MFA, and Gennix will not discourage a business from having it in place. However, SMS is not the recommended standard for business use, and understanding why matters for any business that takes account security seriously. 

SMS-based MFA sends a one-time code to a phone number via text message. This introduces vulnerabilities that authenticator apps avoid. The first is SIM swapping, an attack in which an attacker contacts a mobile carrier and convinces them to transfer a victim's phone number to a SIM card under the attacker's control. The technical barriers to this attack are low. It often requires nothing more than basic personal information available from social media or a previous data breach, and once successful, all SMS messages intended for the victim, including MFA codes, are redirected to the attacker. SIM swapping attacks have been used against businesses of all sizes and are a well-documented risk. 

The second vulnerability is real-time phishing. A sophisticated phishing attack can direct a user to a fake login page that proxies their credentials to the real site in real time. When the real site sends an SMS code, the fake page captures it as the user enters it and forwards it instantly, gaining access before the code expires. This type of attack has become more common as attackers have developed automated toolkits to execute it at scale. 

Authenticator apps address both of these vulnerabilities because the code is generated on the device using a local algorithm rather than transmitted over the carrier network. A SIM swap does not give an attacker access to the codes because those codes never pass through the carrier. A real-time phishing proxy can capture a code, but because TOTP codes expire every thirty seconds and the legitimate login is not completed, the attacker's window to use it is extremely narrow. In practice, authenticator apps raise the bar substantially above what SMS provides. 

Gennix configures authenticator app MFA as the standard for Microsoft 365 accounts and recommends it for all other business platforms that support it. When SMS is the only option a platform offers, it is better than nothing, but Gennix flags this as an elevated risk and factors it into the overall security assessment for that client. 

What Is an MFA Fatigue Attack and How Does Gennix Prevent It? 

As authenticator app MFA has become more common, attackers have adapted. One of the most effective adaptations is the MFA fatigue attack, also called MFA bombing or push spam. This attack targets the push notification feature of authenticator apps like Microsoft Authenticator, where a login attempt triggers an approval prompt on the user's phone rather than requiring them to enter a code. 

In an MFA fatigue attack, the attacker already has the user's password, usually obtained through a phishing attack or a previous data breach. They use it to trigger repeated login attempts, each of which sends a push notification to the user's phone asking them to approve the sign-in. If the user receives enough of these prompts and does not understand what they mean, they may eventually tap approve simply to stop the notifications. At that point, the attacker has full access to the account. 

This attack has been used successfully against organizations of all sizes. It exploits the fact that push notification MFA, while more convenient than entering codes, removes the cognitive step of reading and entering a code. A user who receives a push notification at an unexpected moment may approve it without thinking. 

Gennix addresses this by enabling number matching in Microsoft Authenticator for all Microsoft 365 clients. Number matching requires the user to enter a two-digit number displayed on the login screen into the authenticator app before approving the request. An attacker triggering a push notification cannot tell the user what number to enter because they do not know what number the system has generated for that specific request. This breaks the MFA fatigue attack entirely. Combined with cybersecurity awareness training that teaches staff to recognize unexpected MFA prompts as a sign that someone may have their password, number matching is one of the most effective defences Gennix deploys for Microsoft 365 clients. 

What Is Phishing-Resistant MFA and When Does Your Business Need It? 

Phishing-resistant MFA describes authentication methods that are secure against phishing attacks by design, not just in practice. Standard authenticator app MFA, while significantly more secure than SMS, is not fully phishing-resistant because a sufficiently sophisticated real-time attack can capture and relay a TOTP code before it expires. Phishing-resistant methods eliminate this possibility at a technical level. 

Passkeys are the most accessible phishing-resistant MFA option for most businesses. A passkey is a cryptographic credential pair generated for a specific website or application. The private key lives on the user's device and never leaves it. The public key is registered with the service. When logging in, the device uses the private key to sign a cryptographic challenge from the server. The signed response proves the user's identity without transmitting any secret. Because the passkey is cryptographically bound to the legitimate domain, it simply cannot be used on a fake phishing site. The challenge would come from a different domain and the passkey would not respond to it. An attacker cannot intercept a passkey because nothing that could be used to impersonate the user is ever transmitted. 

Hardware security keys like YubiKey and smartcards operate on similar principles. A YubiKey is a physical device that plugs into a USB port or taps to an NFC reader. It performs a cryptographic operation that proves identity without transmitting any secret that could be captured. Like passkeys, hardware keys are bound to specific registered services and will not respond to authentication requests from fake sites. 

Gennix recommends phishing-resistant MFA options to clients in higher-risk situations. This includes businesses handling highly sensitive personal or financial data, those operating in regulated industries like healthcare and legal where a compromise has significant consequences, and those that have been identified through penetration testing as having elevated account compromise risk. For these clients, the combination of passkeys where the platform supports them and hardware keys for the most sensitive accounts provides the strongest protection currently available. 

The honest assessment Gennix shares with clients is that platform adoption is not yet universal. Major platforms like Microsoft, Google, and Apple support passkeys, but many business applications do not. The practical approach is passkeys or hardware keys where supported and authenticator apps with number matching everywhere else. 

→ Wondering whether your business should be using phishing-resistant MFA? Gennix can assess your current accounts and recommend the right approach for your risk profile.

Password Managers and MFA: How Gennix Approaches Both Together 

MFA addresses the authentication layer, but the credential underneath it still matters. A strong, unique password combined with authenticator app MFA is a fundamentally more secure posture than a weak or reused password with the same MFA. Managing unique, strong passwords across the many accounts a business needs is impractical without a password manager, which is why Gennix treats password management and MFA as two parts of the same credential security conversation rather than separate topics. 

Gennix recommends Bitwarden as the business password manager of choice for clients across the Lower Mainland. Bitwarden is an open-source platform with a strong security track record, business features that make it practical for teams rather than just individuals, and built-in MFA functionality. For a business, this means the Bitwarden account itself is protected by MFA, which is the right approach given that a compromised password manager is a significant event. 

The feature Gennix most frequently highlights to business clients is secure credential sharing. Bitwarden allows businesses to share passwords with staff members without those staff members ever seeing or knowing the underlying password. An employee can log into a shared account using Bitwarden's autofill without having access to the credential in a form they could copy or share. When an employee leaves, the password can be changed and the Bitwarden entry updated without the departing employee retaining access to any credentials they were using. 

Combined with MFA configured on the Bitwarden account and on every underlying business account it manages, this creates a credential security framework that is genuinely strong and practical for a team to use. Gennix helps clients set up Bitwarden for their organization, configure appropriate sharing policies, and integrate it with the broader managed IT services environment so credential management is a maintained practice rather than a one-time project. 

MFA as Part of a Layered Security Strategy 

MFA is one of the most effective single security controls available to a business, but it is not a complete security strategy. 

MFA protects against unauthorized account access using stolen or compromised credentials. It does not protect against malware on a device that captures credentials or session tokens directly. A device infected with a keylogger or an information stealer can capture credentials and session data in ways that bypass MFA entirely. This is why endpoint protection, keeping software patched and current, and controlling which applications can run on business devices all matter alongside MFA rather than being replaced by it. 

MFA also does not protect against session hijacking after a successful login. Conditional access policies that limit which devices and locations can access business accounts reduce this risk and are part of what Gennix configures in the Microsoft 365 managed services environment. 

The broader point is that network security, endpoint protection, MFA, password management, cybersecurity awareness training, and regular penetration testing all work together as a layered strategy. Each layer addresses threats the others do not. Gennix's approach to security for businesses across the Lower Mainland is built on this understanding. No single control is sufficient, and the strength of the overall posture comes from the combination rather than any individual component. 

How Gennix Sets Up and Manages MFA for Lower Mainland Businesses 

Gennix provides MFA setup and ongoing management for businesses across Vancouver, Surrey, Langley, Burnaby, Chilliwack, White Rock, Richmond, Coquitlam, Delta, New Westminster, Maple Ridge, and Abbotsford. The starting point for any new client is a review of what accounts exist, which platforms they use, and what MFA options those platforms support. This assessment determines which accounts should be prioritized for MFA enrollment, which MFA method is appropriate for each platform, and whether there are any accounts where MFA is not currently available that represent an elevated risk. 

For Microsoft 365 accounts, Gennix configures MFA through the Microsoft 365 admin centre using conditional access policies. This includes selecting the permitted authentication methods, enabling number matching for push notifications, setting enforcement conditions, and testing the configuration before rolling it out organization-wide. 

The rollout process begins with policy configuration and testing by the Gennix team. Once confirmed, Gennix provides the client with written documentation explaining what is changing, what staff need to do to complete their MFA enrollment, and who to contact if they need help. Gennix is available at the client site during the initial rollout period to assist any staff member who needs hands-on guidance. This on-site availability is a deliberate part of the process because MFA rollouts are often where user experience problems surface. A staff member who gets stuck and cannot access their account creates an urgent IT situation that is much easier to handle in person than remotely. 

For accounts outside Microsoft 365, Gennix works with clients to identify which services support authenticator app MFA and walks through setup for each platform. For clients in higher-risk situations, Gennix advises on and assists with YubiKey hardware keys or passkeys where supported. 

After the initial setup, MFA management becomes part of the ongoing managed IT services relationship. This includes managing new employee account setups with MFA included from day one, handling access recovery when staff change devices, reviewing and updating MFA policies as the business changes, and advising on new authentication options as platform support for passkeys and phishing-resistant methods continues to expand. The goal is a credential security environment that stays current and well-maintained rather than one that was set up once and left to drift. 

→ Ready to get MFA properly configured and managed across your business? Contact Gennix to start the conversation.

→ Follow Gennix on LinkedIn and Facebook for more cybersecurity guidance for businesses across the Lower Mainland. 

Frequently Asked Questions 

What is the best MFA authenticator app for business? 

Gennix recommends Microsoft Authenticator, Google Authenticator, or Duo for business use. All three generate time-based codes locally on the device without transmitting over a carrier network, making them significantly more secure than SMS-based MFA. For Microsoft 365 managed services environments specifically, Microsoft Authenticator integrates directly with the platform and supports number matching to prevent MFA fatigue attacks. 

Is SMS MFA good enough for business use? 

SMS MFA is better than no MFA, but it is not the recommended standard for business use. SMS codes can be intercepted through SIM swapping attacks or captured in real time by phishing pages designed to relay credentials as they are entered. Authenticator apps are significantly more resistant to both attack types and should be the minimum standard for any business account holding sensitive data. 

What is a passkey and how is it different from MFA? 

A passkey is a cryptographic credential tied to a specific website or application. It will not work on a fake phishing site because it is cryptographically bound to the legitimate domain. Gennix recommends passkeys, hardware security keys like YubiKey, and smartcards for clients in higher-risk situations, while noting that not all platforms have adopted passkeys yet. A mixed approach using passkeys wheresupported and authenticator apps elsewhere is the current practical standard. 

How do I roll out MFA across my whole team? 

Gennix handles MFA rollouts by configuring the policies through Microsoft 365 and testing them before staff are affected. Clear documentation is provided to guide staff through their own enrollment, and Gennix is available at the client site to assist anyone who needs hands-on help. This approach ensures the configuration is correct from day one and that no one is left unable to access their accounts after the rollout. 

Does Gennix help businesses in my area set up MFA? 

Yes. Gennix strongly recommends MFA for all business accounts where it is available and configures it as part of their managed IT services for businesses across Vancouver, Surrey, Langley, Burnaby, Chilliwack, White Rock, Richmond, Coquitlam, Delta, New Westminster, Maple Ridge, and Abbotsford. MFA configuration through Microsoft 365 is a core part of how Gennix secures client environments throughout the Lower Mainland.