Contents
Two-factor authentication adds a second factor to the password (authenticator app, hardware key, SMS code) and blocks most break-ins that rely on stolen passwords. In a business app, I make it mandatory at least for administrator accounts; it is planned during scoping, in a project that starts at $6,800 (€6,000)excl. VAT.
Stolen passwords remain the easiest way into a business tool: a password reused on another site, a convincing phishing page, and someone logs into your CRM with the rights of a sales rep or an administrator. Two-factor authentication closes that door at a modest cost. Here are the available methods, the ones I recommend for each type of account, and how to roll it out without slowing your teams down.
What a second factor really protects
The principle is simple: logging in requires two elements of a different nature. Something you know (the password), something you have (a phone, a hardware key) or something you are (a fingerprint, a face). An attacker who has stolen the password can do nothing without the second element.
France’s data protection authority, the CNIL, says so plainly in its password recommendations (in French): multi-factor solutions provide better protection than a password alone. In March 2025 it adopted a dedicated recommendation on multi-factor authentication (decision no. 2025-019), covering factor types, the data collected and several points of attention (sources checked in October 2026). Even if you are not based in France, these documents are a clear, practical reference.
What two-factor authentication does not protect against: a workstation that is already compromised, a session left open, or permissions that are too broad. It goes hand in hand with role-based access control and a login log.
The methods, from weakest to strongest
| Method | Protection level | User comfort | Cost to the company | How I use it |
|---|---|---|---|---|
| Email code | Low: if the mailbox is compromised, so is everything else | Fair | Almost none | Low-sensitivity client portal |
| SMS code | Medium: number hijacking is possible | Good | Per-message sending cost | Fallback |
| Authenticator app (6-digit code) | Good | Good, after a one-time setup | None | Default method |
| Hardware key or passkey | Very good, resists phishing | Very good once set up | One key bought per person | Administrators, finance, leadership |
| Single sign-on with Microsoft 365 or Google | Inherits the security of the company account | Excellent: one account | Included in your existing subscription | Internal teams already equipped |
The last row matters a lot for a company of 50 or 200 people: if your employees already have a Microsoft 365 or Google Workspace account protected by a second factor, the app can rely on it. Arrivals and departures are then managed in one place. That is the topic of single sign-on (SSO).
Which accounts should require it
I do not recommend the same rule for everyone. I classify accounts during scoping:
- Mandatory: administrators, and accounts that can export data, change prices, approve payments or see sensitive personal data (HR, health, bank details).
- Mandatory for external access: partners, subcontractors and contractors who log in from their own devices.
- Offered: clients of a portal who view low-sensitivity documents.
Technically, the rule has to be enforced by the server, not just by the screen. With Supabase, which I use often, authentication supports TOTP codes and phone codes, and database access rules can require that a session has passed the second factor before it reads a table (Supabase documentation, checked in October 2026). That is what stops a direct API call from bypassing the protection.
The details that make the difference
A poorly designed second factor quickly turns into a stream of support tickets. These are the points I handle every time:
- Backup codes, generated at setup, for the day the phone gets lost.
- Reset by an administrator, with an identity check and a record in the log.
- Remembering the device for a reasonable period, so the code is not requested every time the app opens.
- Protection against repeated attempts: a cap on tries and an alert when something looks unusual.
- Step-up checks for sensitive actions: changing bank details or exporting the whole database can ask for the second factor again, even in an open session.
What it costs
Two-factor authentication is not a separate project: it is part of account management. Here are the reference points from my pricing.
| Situation | Price reference | Timeline |
|---|---|---|
| New business app, accounts and roles included | $6,800 to $22,400 (€6,000–€20,000)excl. VAT for the whole project (accounts and roles module: $1,700 (€1,500)excl. VAT in the estimator) | 1 to 3 months |
| Checking account security in an existing app | Express audit $660 (€589)excl. VAT, full audit $2,300 (€1,990)excl. VAT | A few days to 7 days |
| Adding two-factor authentication to an existing app | Quoted after an audit, depending on the code and database | Varies |
Running costs are low: authenticator apps are free, SMS messages are paid per send to the provider, and hardware keys are a one-time purchase. To size your project, the estimator gives you a range in one minute.
When it is not the priority
I would rather say it upfront: two-factor authentication is not always the first job. If your app lets any logged-in user read other users’ data, if secret keys sit in the browser code, or if nobody knows how to restore a backup, those flaws come first. A second lock on a door whose frame is broken does not achieve much. The page on the most common security flaws helps you sort out priorities.
Conversely, if your teams only use off-the-shelf software that already offers two-factor authentication, the job is to switch it on everywhere, not to build anything.
Where to start
- List the accounts across your tools and identify those with admin rights or access to sensitive data.
- Turn on the second factor wherever it already exists, starting with email and financial tools.
- For your business app, have someone check how authentication is actually enforced on the server. That is what the audit is for: an assessment and a costed action plan.
- For a new tool, two-factor authentication is decided during scoping, along with roles and the lost-device procedure. It should not be bolted on in a hurry after an incident.
Frequently asked questions
Are SMS codes still acceptable?
They are better than a password alone, but they are the weakest second factor: a phone number can be hijacked and SMS is not end-to-end encrypted. The French data protection authority (CNIL) flags them as a point of attention in its 2025 recommendation. I keep them as a fallback, not as the main method for sensitive accounts.
Should two-factor authentication be mandatory for every user?
Not necessarily. I recommend requiring it for administrators, for accounts that see sensitive or financial data, and for access from outside the company. For a client portal visited twice a year, it can stay optional: offered, not enforced.
What happens if an employee loses their phone?
You need to have planned for it: backup codes generated at setup, the option for an administrator to reset the second factor after checking the person’s identity, and a record of that reset in the log. Without a procedure, a lost phone locks an employee out for a whole day.
Can we ask employees to use their personal phones?
It is common, but it should be a deliberate, documented decision. The CNIL lists the use of employees' personal devices as a possession factor among its points of attention. The alternative is a hardware key provided by the company, bought once per person.
Does two-factor authentication replace a good password policy?
No, it complements it. The CNIL set out its password recommendations in a 2022 decision, for example 12 characters mixing four character types for a password used on its own. The second factor limits the damage if that password leaks.