The Missing Authenticator: A One-Page MFA Recovery Plan for Small UK Teams

The Tuesday morning problem

It is 8:15 on a Tuesday. The person who holds the authenticator app for your Microsoft 365 tenant is somewhere on the 07:42 to Leeds, their phone is at the bottom of a canal, and your finance manager needs to approve a payment before lunch. Nobody is being dramatic. This is just what happens when a small business builds its security around one person’s phone.

Multi-factor authentication is not the problem. MFA is one of the best things you can switch on in 2026. The problem is the recovery plan — or, more often, the complete absence of one. In a team of eight or eighteen people, the person who set up the authenticator is often the same person who holds the keys to the Microsoft 365 admin centre, the banking app and the remote-access gateway. That is a lot of weight for one pocket-sized device.

This is not about weakening security. It is about making sure a lost phone, a resignation or a fortnight in Portugal does not turn into a lost morning, a locked mailbox and a very awkward call to your bank.

Why one phone is not a recovery plan

Most small firms are good at the front door. They enable MFA, they nag people to install the authenticator app, and they feel better about the whole thing. Fair enough. But recovery is the bit nobody rehearses until the day the app says “account recovery required” and the only person who can help is on a beach with no signal.

The risk is not just theft or loss. It is holidays, sickness, a broken screen, a wiped phone, a contractor who leaves, or the slow realisation that the MFA for your accounting system is tied to an old mobile number nobody owns any more. Small teams feel this more sharply than large ones because there is less slack. When one person is unreachable, the whole business feels it.

A decent plan gives you two independent ways in. Not five. Not a 40-page policy. Two ways, documented, tested, and stored somewhere that does not depend on the device that has just gone missing.

Start with a break-glass account, then lock it away

For Microsoft 365, the first move is a break-glass account. Sometimes called an emergency access account, this is a cloud-only admin account that exists for exactly one job: getting back in when normal admin access has failed. Create one, or two if you want to be sensible. Give each one a long, unique password — not a phrase you use anywhere else — and store the credentials in a sealed envelope in the office safe or a locked cabinet.

A few rules keep this from becoming a back door. The account should not have a mailbox you use, should not be used for everyday admin work, and should be excluded from the conditional-access rules that would otherwise block it. That exclusion is deliberate, but it is also why you monitor it. Set an alert for any sign-in to the break-glass account, and make sure that alert goes to someone who will actually read it. If the account is used, you want to know within minutes, not at the next quarterly review.

Ask the same question of your other critical systems. Does your bank offer a second approver or an admin recovery route? Does your remote-access tool have a separate emergency admin account? If the answer is “we have never asked”, today is a good day to ask.

Print the codes, then put them somewhere boring

Recovery codes are deeply unglamorous, which is probably why people forget them. Many services — Microsoft accounts, password managers, domain registrars, some banking platforms — will issue backup codes when you set up MFA. Print them. Seal them in an envelope. Put the envelope with the break-glass password, or in a separate locked place with a note in your plan explaining where it is.

Do not email the codes to yourself. Do not save them in the same Microsoft 365 mailbox that you might be locked out of. Do not assume the password manager will save you if the password manager itself is behind MFA on the missing phone. A sheet of paper in a safe is not clever, but it works when the Wi-Fi is down and the person who knows everything is on annual leave.

For Microsoft 365 specifically, an admin can also issue a Temporary Access Pass to help someone recover their authentication methods. That is useful, but it still assumes you have an admin who can get in. The break-glass account and the printed recovery material are what make that possible.

Register a second authenticator on a separate device

A backup method should not live on the same phone as the primary method. That is not a backup; it is a photocopy in the same drawer. Register a second authenticator on a separate device — a hardware security key kept in the safe, or an authenticator app on an office tablet that stays in the building. For key accounts, a hardware key is a solid choice because it does not depend on a charged battery or a mobile signal.

SMS is better than nothing, but it is not the strongest backup. Mobile numbers get recycled, SIMs get swapped, and people change networks. Use it as a last resort, not the foundation of the plan.

Write the one-page plan

This is the part that saves the morning. Keep it to one side of A4. It should list:

• The critical systems that use MFA: Microsoft 365, banking, remote access, accounting software, domain registrar.
• Who holds the primary authenticator for each one.
• Who the backup person is.
• Where the break-glass credentials and recovery codes are stored.
• The vendor support numbers or account numbers you would need.
• Who can authorise use of the break-glass account.
• The date it was last tested.

Print it. Put a copy in the safe and a copy with the person who manages the office. Do not bury it in a SharePoint site that requires the very login you have lost. The plan should be readable by a calm colleague who is not an IT expert, because that is who will be using it.

Test it without locking everyone out

A plan that has never been tested is a rumour. Once a quarter, spend fifteen minutes checking that the break-glass account can sign in, that the recovery codes are where the plan says they are, and that the alert still fires when the account is used. Do not test during payroll week. Do not test by locking out the managing director for fun. Use a controlled window and a named person to watch the audit log.

If you find a gap, fix it then, not during the next incident. The whole point is to discover the missing recovery code on a quiet Thursday, not on the morning of a bank holiday.

Three mistakes to avoid

The first is sharing one phone as the authenticator for the whole company. It feels convenient until that phone goes for a swim. The second is storing recovery codes in the same inbox you are trying to recover. The third is assuming the person who set it up will always be there. People move on. Phones break. Plans should not depend on either.

The calm version

You do not need a security operations centre to get this right. You need a break-glass account, a sealed envelope, a second device, a one-page plan and a quarterly check. That is it. The next time someone’s phone goes missing, the conversation should be a short one: find the plan, use the backup route, reset the MFA, and get on with the day. Quietly. Without the drama.