Rolling out a password manager and MFA: a practical plan for SA small businesses and councils

Most cyber incidents in South Australian small businesses, not-for-profits and councils still start with a password: one reused from a breached website, guessed, or typed into a convincing fake sign-in page. Two controls stop most of that. Multi-factor authentication (MFA) means a stolen password alone is not enough, and a business password manager means every account can have a long, unique password that nobody has to remember or send by email. Both are cheap; the hard part is rolling them out without locking people out or leaving gaps. This guide explains, in plain words, which MFA methods to use, how to choose a business password manager, how to handle shared logins and lost phones, and a 30-day plan to put it all in place. It is general guidance, not legal advice, and products and requirements change, so check current details before you rely on them.

Why you need both, not one or the other

• MFA without a password manager still leaves reused and weak passwords on every system that does not support MFA, such as older supplier portals, and on the accounts that were quietly missed.
• A password manager without MFA puts every password behind one master password. The ACSC recommends protecting the password manager itself with MFA and a long, unique passphrase for exactly that reason.
• Together, they cover each other’s gaps: unique passwords everywhere, a second factor on everything that supports one, and a record of which accounts exist and who can reach them.

Step 1: list the accounts that matter

Before buying anything, write down the accounts that would hurt most if someone else got in. A shared spreadsheet is fine to start; it becomes the list you load into the password manager. For each account, note the owner, who uses it, whether it supports MFA and whether the login is shared.

1. Email and identity: Microsoft 365 or Google Workspace, including every administrator account.
2. Money: online banking, accounting (Xero, MYOB), payroll, payment gateways and the card on file with key suppliers.
3. Keys to everything else: the domain registrar, DNS host, website content management system and cloud accounts. Our domain, DNS and admin account ownership checklist covers who should hold these.
4. Line-of-business systems: CRM, booking, rostering, records and council systems, plus remote access or VPN.
5. Government and supplier portals: the ATO’s Online services for business (through myID), tender portals and supplier or client portals.

Step 2: choose MFA methods that match the risk

Not all MFA is equal. Attackers now use fake sign-in pages that pass a one-time code straight through, and they send repeated push prompts hoping someone taps approve. Phishing-resistant methods tie the sign-in to the real website, so a fake page cannot use them.

Method	Good for	Watch out for
SMS or voice codes Not phishing-resistant	A last resort where nothing else is supported.	SIM swap and number porting fraud, and codes typed into fake pages. Move away from these where you can.
Authenticator app codes Not phishing-resistant	Supplier portals and services that only offer six-digit codes.	Codes can still be typed into a fake page.
Push approval with number matching Not phishing-resistant, but much stronger than codes	Everyday staff sign-in to Microsoft 365 as a starting point.	Repeated “MFA fatigue” prompts. Number matching, now standard in Microsoft Authenticator, stops most blind approvals.
Passkeys on a phone or computer, including in Microsoft Authenticator Phishing-resistant	Administrators, finance, executives and elected members, then everyone as support grows.	Plan what happens when the phone is lost or replaced before making them mandatory.
Security keys (FIDO2) Phishing-resistant	Administrators, staff without a work phone, shared or depot devices.	Buy two per person for high-risk roles so a spare is kept safely.
Windows Hello for Business Phishing-resistant	Signing in to managed Windows laptops.	Needs managed devices; see managing staff laptops and phones.

If you work for government or regulated clients, check what they expect. Under the ACSC Essential Eight, Maturity Level One requires MFA that combines something users have with something they know, and since the November 2023 update Maturity Level Two requires phishing-resistant MFA. A practical path is push with number matching for everyone now, and phishing-resistant methods for administrators and high-risk roles first.

Step 3: choose a business password manager

Passwords saved in each person’s personal browser profile, a spreadsheet or a notebook are the usual starting point. They are hard to share safely, impossible to audit and walk out of the door when someone leaves. The ACSC recommends using a reputable password manager; for a team, choose a business plan rather than personal accounts. When comparing products, check:

• Admin console and policies: you can enforce MFA on the vault, set master password rules and see who has access to what.
• Shared vaults by team: finance, admin and operations each see only their own shared logins, and access can be removed in one step when someone leaves.
• Single sign-on: sign-in with your Microsoft 365 or Google Workspace account, so offboarding there also closes the vault.
• Recovery: a documented, controlled way to recover a staff member’s vault, so a forgotten master password does not lose business logins.
• Audit log and reports: which shared passwords were viewed, and which are weak, reused or exposed in known breaches.
• Security evidence: independent audits or certifications, where data is stored, and how the provider handles a breach. Treat it like any other critical supplier; see our guide to provider due diligence and exit planning.
• Everyday fit: browser extensions and phone apps your staff will actually use, passkey support and a clean export if you ever move.

One change to check: Microsoft Authenticator stopped storing and filling passwords in mid-2025 and moved saved passwords to Microsoft Edge. Authenticator still handles MFA and passkeys, but if staff used it as their password manager, find out where those work passwords are now.

Step 4: deal with shared logins properly

Shared logins are where most small organisations are exposed. Work through them one by one:

1. Replace them with named accounts where the system allows. A reception or accounts inbox should be a shared mailbox that named staff open with their own sign-in and MFA, not one password passed around.
2. Move the rest into a shared vault. Generate a new, long password when you move it, so the old one that was emailed around stops working.
3. Give each shared login an owner who reviews who can see it and changes it when someone with access leaves.
4. Turn on MFA for shared accounts too. Where the service only allows one second factor, store it in the shared vault or use a security key held by the owner, and record who has it.
5. Never send passwords by email, text or chat. Share through the vault, and change any password that has been sent the old way.

Step 5: roll out MFA in the right order

1. Administrators first. Separate admin accounts from everyday accounts, with phishing-resistant MFA. Microsoft now requires MFA to sign in to its Azure and Microsoft 365 admin portals, so administrators should already have it; make sure it is a strong method rather than SMS. Keep two emergency (break-glass) accounts, stored securely, monitored and tested, as our Zero Trust and Conditional Access guide explains.
2. Finance, executives and elected members next. They are the main targets for invoice fraud and mailbox takeover. See our email security guide for the payment checks that go with it.
3. Everyone else, team by team. Book short sessions so people register MFA with someone on hand to help, and ask everyone to register at least two methods, such as the app and a passkey or security key.
4. Then enforce it. In Microsoft 365 that means security defaults for very small tenancies, or Conditional Access policies where your plan includes Entra ID P1, such as Business Premium. Block older sign-in methods that bypass MFA.
5. Finally, the long tail. Turn on MFA in banking, accounting, the domain registrar, the website and every supplier portal on your list, storing the setup in the password manager.

Step 6: plan for lost phones and forgotten passwords

Recovery is where rollouts fail and where attackers aim. Callers pretending to be staff now ring help desks asking for MFA to be reset. Write down, before you need it:

• How identity is checked before any reset, such as a call back on the number already on file or a manager confirming in person, never a reset based only on an incoming call or email.
• How a temporary sign-in is issued. In Microsoft Entra ID, a Temporary Access Pass lets someone sign in once to register a new phone or key without turning MFA off.
• Who can recover a password manager vault and how that is logged.
• What staff do when a phone is lost: tell IT the same day so old sessions and methods are removed. This links to your cyber incident response plan.

Councils, not-for-profits and teams without work phones

• Elected members often use personal phones and tablets. Give them council accounts with MFA rather than personal email for council business, a short briefing, and passkeys or security keys if they handle sensitive matters.
• Volunteers and board members in not-for-profits should have their own named accounts, or guest access, for the few systems they need, removed when their role ends.
• Field, depot and frontline staff who do not have a work phone, or do not want work apps on their own, can use a security key instead of an authenticator app.
• Shared computers at a front counter or depot should not stay signed in to a password manager or personal account.

Tell staff what changes and why

A short, friendly briefing does more than a long policy. Cover four points: never approve an MFA prompt you did not start, and report it straight away; let the password manager create and fill passwords, so you never type them into a link from an email; use a long passphrase of four or more random words for the master password; and tell IT the same day if a phone or key is lost. Add these points to your staff onboarding and offboarding checklist, so new starters set up MFA and the vault on day one and leavers lose access on their last day.

A 30-day rollout plan

1. Week 1: list and decide. List the accounts that matter and the shared logins, choose MFA methods by role, shortlist and trial a business password manager with two or three people.
2. Week 2: protect the keys. Separate admin accounts, phishing-resistant MFA for administrators, break-glass accounts, and MFA on banking, accounting, the domain registrar and cloud accounts.
3. Week 3: roll out to people. Set up the password manager with shared vaults by team, run short sessions so staff register MFA and move their work passwords in, and replace or rotate shared logins.
4. Week 4: enforce and check. Turn on the MFA policies for everyone, block older sign-in methods, write the reset and lost-phone procedure, and check the password manager’s report for weak and reused passwords. Put a quarterly review in the calendar.

If you hold cyber insurance, expect the renewal questionnaire to ask about MFA on email, remote access and administrator accounts one by one. Our cyber insurance questionnaire guide covers how to answer accurately and the evidence to keep.

Questions to ask your IT provider

1. Which of our accounts, including administrators and shared logins, do not have MFA today?
2. Which MFA methods do our staff use, and how many still rely on SMS codes?
3. Are our administrators on separate accounts with phishing-resistant MFA, and do we have tested break-glass accounts?
4. Are older sign-in methods that bypass MFA blocked?
5. How do you confirm someone’s identity before resetting their MFA or password?
6. Which password manager do you recommend for us, who administers it, and how is a vault recovered?
7. What does our setup mean for the Essential Eight maturity level our clients or funders expect?

This article reflects general practice and ACSC and Microsoft guidance as at October 2026. Products, features and requirements change, so check current guidance before relying on a specific detail.

MFA and a password manager work best when staff also know never to approve a sign-in they did not start or read a code to a caller. Our security awareness and phishing training guide sets out a short staff program.

Talk to an Adelaide team

If MFA is only partly set up or passwords are still shared by email, talk to us about a password manager and MFA rollout or call 0402 401 584. We can quote a short review that lists your important accounts and shared logins, recommends MFA methods by role and a password manager that fits, and sets out a rollout and recovery plan your team can follow. Learn more about our managed IT and cyber security and training and consultations services.