Multi-Factor Authentication for Email: A Canadian Setup Guide

Multi-Factor Authentication for Email: A Canadian Setup Guide

Multi-Factor Authentication for Email: A Canadian Setup Guide

Hardware security key plugged into a laptop

Multi-factor authentication (MFA) protects your email by asking for more than a password when you sign in, such as a code from an app or a physical security key. Two-factor authentication (2FA) is the most common form: exactly two different kinds of proof. Turn it on for every mailbox you own, starting with the one that receives your password resets. This guide explains the methods, shows how to switch it on in Gmail and Microsoft 365, and covers rollout and recovery for a Canadian business.

TL;DR

  • MFA means two or more different factors (something you know, have or are). 2FA is MFA with exactly two.
  • Email comes first because it resets the passwords for almost everything else you use.
  • Authenticator apps are a solid default. Hardware security keys are the strongest option for administrators and anyone handling sensitive data. SMS is the weakest.
  • Businesses should roll MFA out in phases, write down the recovery process before enforcing it, and expect cyber insurers to ask about it.
  • Whichever provider you use, a strong, unique password and a recovery plan matter as much as the second factor.

Table of Contents

What MFA and 2FA mean for email

The Canadian Centre for Cyber Security (CCCS) describes MFA as combining something you know, something you have and something you are. In practice:

  • Something you know: a password, passphrase or PIN.
  • Something you have: a phone running an authenticator app, or a hardware security key.
  • Something you are: a fingerprint or face scan.

Two-factor authentication is the same guidance’s name for MFA validated with two different factors. A typical example: you type your email password, then enter a six-digit code from an app on your phone. Password plus code is two factors from two categories.

One wrinkle is worth knowing. The same CCCS page says two-step verification can use the same type of factor twice, for example two passwords, so it is not the same thing as 2FA. Google and others use “2-Step Verification” as a product name, and in everyday use it works as 2FA. When you choose a method, though, pick factors from different categories.

Why email is the account to protect first

Your inbox is the key ring. When you click “forgot password” on a bank, a supplier portal or a cloud storage account, the reset link lands in your email. Anyone who controls the mailbox can take over everything behind it.

The CCCS says MFA helps prevent unauthorized access to email accounts even if the password has been compromised. It also protects against credential stuffing, where attackers replay passwords stolen from one breach against other services, hoping you reused them. The CCCS recommends organizations mandate MFA for users and administrators of cloud and Internet-connected services.

The numbers back this up. A Microsoft study of its own cloud accounts, as summarized by Cyber-Safe, found MFA cut the risk of account compromise by 99.22%, and by 98.56% even where the password had already leaked. The same write-up cites a Google field study in which an on-device prompt blocked 100% of automated bot attacks, 99% of bulk phishing and 90% of targeted attacks, while SMS codes blocked 100%, 96% and 76% of those same categories.

MFA study results by attack type and method

If you want the bigger picture of what happens after a mailbox is taken, our guide on how email account takeover happens and how to stop it walks through the typical sequence.

The insurance angle for Canadian businesses

If you run a business, MFA on email is increasingly a condition of doing business, not just good hygiene. One Canadian insurance readiness guide states that insurers want MFA enforced on email, not merely available, and that exempting some users does not satisfy underwriters. Aon Canada’s small-business cyber application asks directly whether MFA is enforced for cloud-based email and for web and non-corporate device access. Check your own application or renewal wording for the exact requirement.

The insurance angle for Canadian businesses

Which MFA method should you choose?

Not all second factors are equal. This table compares the common choices for an email account.

Method How it works Strength Convenience Best for
Authenticator app (TOTP) App generates a code that refreshes every 30 seconds, on your device Good Good Most individuals and staff
Push approval Tap Approve on your phone Good with number matching, weaker without Very easy Staff who sign in often
Hardware security key (FIDO2) Plug in or tap a physical key Strongest, resists phishing Needs the key on hand Admins, executives, finance
SMS code Code texted to your number Weakest Easy Last-resort fallback only
Biometrics Fingerprint or face on the device Good, can be mimicked Very easy Unlocking the device or passkey

Authenticator apps

Authenticator apps generate time-based codes that refresh every 30 seconds and are created on the device, so they never travel over the cellular network. For most people this is the sensible default: free, quick and far better than a text message.

Push prompts and MFA fatigue

Push approvals are convenient, but the CCCS notes attackers have bypassed MFA through MFA fatigue, token theft and man-in-the-middle attacks. MFA fatigue means bombarding you with prompts until you tap one by accident. Number matching, where you must type a number shown on the sign-in screen, helps prevent this. Cybersecurity Canada reports that Microsoft requires it by default. The rule of thumb: never approve a prompt you did not trigger.

Hardware security keys

Security keys verify that the website is the real one, which is why they resist phishing. The CCCS strongly recommends FIDO-based solutions and hardware-based MFA that is independent of the device being authenticated. Cybersecurity Canada suggests them for administrators, executives and anyone with access to sensitive financial or customer data. Buy two, so a lost key does not lock you out.

SMS codes

Text messages are better than nothing, but the CCCS says SMS should only be considered for low-risk logins. Codes are sent unencrypted, and attackers intercept them through SIM swapping, phishing and other social engineering. Use SMS only if it is the sole option available, and move to an app or key as soon as you can.

Biometrics

Fingerprints and face scans are handy for unlocking a phone or a passkey. The CCCS adds a caution: for highly sensitive data consider three factors including one biometric, while noting attackers can still mimic or copy biometrics.

Will it slow you down?

Less than you think. Cybersecurity Canada estimates MFA adds roughly 10 seconds to a login, and trusted-device features mean you may only verify once per device every 30 to 90 days.

How to turn on two-factor authentication in Gmail

Google calls it 2-Step Verification. According to Google’s Gmail Help, the steps are:

  1. Open your Google Account.
  2. Go to Security and sign-in.
  3. Under how you sign in to Google, select Turn on two-step verification.
  4. Follow the on-screen steps and choose your second step.

If the account belongs to a workplace or school, these steps may not work, and the administrator controls the setting. Before you finish, add a backup option such as backup codes or a second security key, and store them somewhere safe and separate from your phone.

How to set up Microsoft Authenticator for Microsoft 365 email

The steps below follow McGill University’s IT instructions. Your screens may differ slightly if your organization has its own settings.

  1. Install the Microsoft Authenticator app on your iOS or Android phone.
  2. On a computer, go to mysignins.microsoft.com/security-info and sign in.
  3. Click Add sign-in method and choose Authenticator app.
  4. On your phone, open the app, tap the + icon, choose Work or school account, then Scan QR code.
  5. Back on the computer, click Next and scan the QR code with your phone.
  6. Approve the test notification, or enter the two-digit number shown, to finish.
  7. Add a backup method in case your phone is unavailable.

If you are an administrator rather than a user, enforcing MFA across the organization happens in your Microsoft admin settings, and it is worth planning that rollout as described below.

Rolling out email MFA across a business

Switching MFA on for everyone on a Monday morning invites lockouts and help-desk calls. A phased plan works better. TechCare Canada outlines six phases over four to six weeks:

  1. Assess: list every account, sort them into privileged, sensitive and standard, and find any legacy sign-in methods.
  2. Choose methods: security keys for administrators, authenticator apps for standard users, and SMS dropped.
  3. Plan recovery: document how lost devices are handled before anyone is enforced.
  4. Communicate: tell staff what is changing and why.
  5. Pilot: enroll the IT team and five to ten volunteers, and test recovery on purpose.
  6. Enforce: enable it for everyone else, watch enrollment daily, audit at 30 days and disable SMS fallback after 60.

The CCCS agrees on sequencing: enforce first on high-value targets such as administrative accounts and senior management email. It also advises awareness campaigns and training that cover phishing and MFA spamming, so staff know what a suspicious prompt looks like.

A framing that helps with reluctant staff, suggested by Cybersecurity Canada, is to say you are adding an extra step to protect their accounts and personal information from theft.

Do not leave exceptions

Partial rollouts are the usual failure. A Canadian IT firm reports that the most common gap on small-business Microsoft 365 audits is MFA on for some users but not others, often with an executive or administrator on the exception list. Those are exactly the accounts attackers want. For the longer term, the CCCS says organizations should deploy phishing-resistant MFA to every user, without exception.

Plan for lost phones and recovery

The question that decides whether MFA is a nuisance or a non-event is: what happens when someone loses their phone? Decide in advance.

  • Give each person at least two methods, for instance an app and a security key.
  • Generate backup codes and store them offline, in a safe or a password manager that does not depend on the phone.
  • Write down who can verify an employee’s identity and reset their MFA, and how. TechCare Canada points to Microsoft 365 Temporary Access Pass and Google Workspace backup codes as recovery tools.
  • Test the process during the pilot, not during an emergency.

Mistakes that weaken MFA

  • Approving prompts you did not start. If your phone buzzes with a sign-in request you did not make, deny it and change your password.
  • Keeping SMS as the main method. Treat it as a fallback to retire.
  • Reusing passwords. MFA covers a stolen password, but unique passwords still reduce how often that matters.
  • Skipping the backup. One phone is a single point of failure.
  • Protecting only the boss, or only staff. Everyone with mailbox access is a way in.
  • Sharing a single mailbox login. MFA is tied to a person. Give each person their own address.

Perspective

We built Tinymail on a simple belief: your email is the most sensitive record of your working life, and it should be treated that way. Invoices, contracts, client conversations and password resets all pass through it.

That is why we are committed to privacy in everything we do. Your data is safe with us: all customer email data is hosted exclusively in Canada and handled in line with PIPEDA, so your mail is not exposed to foreign surveillance. We also do not use AI anywhere in our service.

Strong sign-in habits and sovereign hosting work together. A second factor protects the door, and Canadian hosting protects what is behind it. If you are moving away from a big tech inbox, use the move to tidy up your habits too: unique passwords, a backup method for every account, and one person per mailbox.

We keep our pricing as plain as our approach: simple annual plans with no complicated fees, so a small team can get a professional address on its own domain without a surprise on the invoice.

Aaron Manfred

Your email on a Canadian, privacy-first service

If you are choosing where your email lives, Tinymail offers Canadian-hosted email on your own domain, with integrated calendar and contacts, spam and malware protection, DKIM and DMARC alignment, IMAP and SMTP sync and webmail. We are committed to your privacy, your data is safe with us, and we do not use AI anywhere. Annual plans are straightforward: Solo is $19.99 a year, Startup $39.99, Business $59.99, Business Plus $99.99 and Team $179.99. See the plans on tinymail.ca.

Tinymail

Once you are set up, our guide to syncing email across your devices covers getting phones and laptops connected cleanly, and the piece on organising and protecting your contacts helps you keep the address book in order.

FAQ

Is two-factor authentication the same as multi-factor authentication?

Not quite. Two-factor authentication is one type of MFA that uses exactly two different factors, such as a password and a code from an app. MFA is the broader term and can use two or more. The CCCS also separates both from two-step verification, which can repeat the same kind of factor.

What is the best MFA method for email?

A hardware security key is the most resistant to phishing, and the CCCS strongly recommends FIDO-based options. For most people an authenticator app is a practical choice. Keep SMS as a last-resort fallback only.

What if I lose my phone?

Use a backup method you set up earlier, such as backup codes or a second security key. Businesses should have a documented reset process, with an administrator who can verify identity first. Settle this before you enforce MFA, and keep codes somewhere that does not depend on the lost phone.

Does my small business really need MFA on email?

The CCCS recommends it for organizations using cloud services, and Canadian cyber insurers commonly ask whether MFA is enforced on email. A compromised mailbox can be used to reset other passwords and to stage fraud, so it is one of the most worthwhile settings to enable.

Is MFA still worth it if my password is strong?

Yes. A strong password can still be phished, leaked in a breach or reused elsewhere. The second factor means a stolen password alone is not enough to open your inbox.

Sources

This article is provided for general informational purposes only and does not constitute professional advice.