Rolling out MFA without a revolt
Multi-factor authentication is the single most effective control against stolen passwords. The technical part takes an afternoon. The human part needs a plan.
Why it matters
Most account takeovers start with a password that was phished, reused or guessed. With a second factor, a stolen password alone is no longer enough to sign in. For email and cloud accounts this one change removes a large share of everyday risk.
Choose the right factor
- Authenticator app with number matching — a good default for most staff.
- Hardware security keys or passkeys — the strongest option, ideal for administrators and finance teams.
- SMS codes — better than nothing, but use them only as a fallback.
A rollout plan in five steps
- Start with administrators. Every admin account gets MFA first, preferably with a security key.
- Explain the why. A short message from management: what is changing, when, and why it protects both the company and each person.
- Offer drop-in help. Two or three half-hour slots where people can enrol with someone available to help.
- Enforce by group. Turn on enforcement team by team over two weeks rather than for everyone at once.
- Plan for lost phones. Write down how someone regains access, and make sure the helpdesk verifies identity before resetting a factor.
The weakest point of MFA is often the reset process. Attackers call the helpdesk too.
After the rollout
Block legacy authentication protocols that bypass MFA, review sign-in logs for unusual locations, and use conditional access to require stronger factors for sensitive actions. Revisit the setup once a year.
Need help? MFA rollout and identity hardening are part of our cybersecurity service.