MFA is not optional anymore. Here is how to roll it out without a revolt.
Multi-factor authentication stops most account takeovers. The rollout, not the technology, is what goes wrong. A practical plan for small and mid-size organizations.
Every cyber insurance renewal form now asks the same question: do you enforce multi-factor authentication on email, remote access, and administrator accounts? If the answer is no, the premium goes up or the policy goes away.
The technology is the easy part. Microsoft 365, Google Workspace, and every serious business application support MFA today. What fails is the rollout.
Why rollouts fail
- No one explained why. Staff see a new hoop, not a stolen-password story.
- The wrong method. SMS codes are better than nothing but slow and phishable. Authenticator app push or passkeys are faster than typing a password.
- Everyone at once. A single cutover day guarantees a helpdesk queue and an executive who cannot get into email before a board meeting.
- No exception process. Someone loses a phone on a Friday and the answer is “wait until Monday.”
A rollout that works
- Start with administrators. Every privileged account gets MFA on day one. No exceptions and no announcement needed.
- Pilot with a friendly department. Ten to twenty people, one week. Fix the instructions based on their questions.
- Communicate in plain language. One email, one page, one two-minute video. Say what changes, when, and who to call.
- Roll out by department over two to three weeks. Helpdesk capacity stays sane and each wave learns from the last.
- Enforce, then remove the fallback. Conditional access policies block legacy authentication and require MFA for everyone. Then turn off the old paths that attackers use to bypass it.
- Write down the recovery process. Lost device, new phone, departing employee. Each has a documented, tested path.
What to use
Authenticator app with number matching is the practical default. Passkeys and FIDO2 security keys are stronger and increasingly simple. SMS should be a temporary fallback only.
The payoff
Microsoft’s own telemetry consistently shows MFA blocks the overwhelming majority of automated account attacks. It is the single control with the best ratio of effort to risk reduction. Done with a plan, most staff stop noticing it within a week.
Need a hand? Our cybersecurity team runs MFA rollouts as a standard first step in every security engagement.