How to set up 2FA on business accounts — without creating a new single point of failure

The four rules

• Authenticator app (or hardware key) over SMS — SMS is both weaker (SIM-swap) and personal by nature: a phone number belongs to a person, and people leave.
• Capture backup codes at enrolment, every time — the platform shows them once; they go straight into the password manager next to the account entry. Backup codes are what make every other mistake recoverable.
• Two humans per critical account — either two enrolled devices/keys where the platform allows it, or a TOTP secret stored in the shared vault so a second person can generate codes.
• Recovery contacts point at the business — the recovery email is the shared mailbox, not someone's personal Gmail; the recovery phone (if unavoidable) is a company number.

The enrolment procedure (any platform)

1. 1
   Sign in as the account's owner login

   The shared-mailbox-owned login from your register — not a personal seat.
2. 2
   Choose the authenticator-app option

   When the QR code appears, this is the moment that decides everything: scan it into a shared-vault TOTP entry (1Password, Bitwarden and peers all support this), or into two devices if the platform allows multiple authenticators.
3. 3
   Save the backup codes immediately

   Into the same vault entry. If you skipped this in the past, most platforms let you regenerate codes from security settings — do it today.
4. 4
   Verify the second path works

   Have the second person generate a code and confirm it's accepted. Untested recovery paths are decorative.
5. 5
   Record it in the register

   The recovery-paths column: which vault entry, which devices, where the codes live.

The break-glass pattern, scaled to your size

Enterprises keep dedicated emergency-access accounts — Microsoft's guidance for M365 is two cloud-only break-glass accounts, excluded from normal sign-in policies, tested about every 90 days. A ten-person company doesn't need the ceremony, but it needs the principle: for your two or three most critical systems, know exactly how you get in when the usual person, device, or identity provider is unavailable — and test that path a couple of times a year.

The security trade-off is honest: a shared-vault TOTP is slightly weaker than one hardware key in one person's hands, because the secret exists in two places. For a business account, that trade is almost always right — the realistic threat is lockout-by-life-event far more often than vault compromise. Guard the vault with your best 2FA, and let it guard everything else.

Where personal 2FA hides in business accounts

• The founder's phone as the Stripe/PayPal 2FA — the classic. Migrate to app-based with vault backup this week.
• Socials verified against a marketer's personal number — re-point to the socials@ path when you move recovery addresses.
• The registrar and DNS accounts everyone forgot have 2FA on an ex-employee's device — check your register's recovery column.
• Departures: 're-enrol 2FA' belongs on the offboarding checklist for every account the leaver could satisfy.