Account security: 2FA and active sessions

This is the system that runs your business, so a password on its own is not enough. Two things are worth doing on day one.

Turn on two-factor authentication

With 2FA, signing in needs your password and a second code, so a stolen or guessed password is not enough on its own. Turn it on from your account security settings, and turn it on first for anyone who can see money — owners, managers and whoever does the books.

Check which devices are signed in

Under Users & security → Login Device Management you can see the sessions currently signed in to your business — the device or browser, the IP address, when it signed in and when it was last active — and end any you do not recognise.

Worth a look whenever a staff member leaves, a phone is lost, or anything looks off. Ending a session signs that device out immediately.

The rest of the picture

2FA sits on top of the protections already there: each business runs in its own isolated tenant, access is limited by role, and everything travels over HTTPS. Sessions are also revoked when a password changes.

Give people the narrowest role that lets them do their job — see Adding staff and setting permissions. Most security problems are an access problem, not a password problem.