A practical MFA rollout for a 10-person company

Multi-factor authentication (MFA) is one of the most useful controls a small team can deploy, but rollout quality matters as much as the switch itself. The goal is not simply to turn on an app prompt. It is to make account takeover harder while ensuring people can still work and recover safely.

Start with an inventory

List the services that can reach business data or administrative controls: email, identity provider, cloud console, payroll, finance, source control, password manager, endpoint management, CRM, and customer-support tools. For each service, note the account owner, whether MFA is available, whether an administrator can enforce it, and whether backup codes or recovery methods already exist.

Prioritize email and identity systems first. A compromised email inbox can often reset access to everything else.

Choose the strongest practical method

Prefer phishing-resistant methods, such as security keys or platform passkeys, where the service supports them. Authenticator-app codes are generally stronger than SMS for routine use. SMS may still be a temporary fallback when there is no better option, but it should not be the only recovery path for an administrator account.

Avoid sharing one authenticator device or storing recovery codes in a team chat. Each person should enroll their own method, and recovery material should be kept in the company password manager or another approved restricted location.

Roll out in a controlled sequence

1. Protect the administrator and break-glass accounts first.
2. Test enrollment with one or two people using ordinary workflows and a recovery scenario.
3. Announce the change, the deadline, and where staff can get non-emergency help.
4. Enroll the remaining team in small groups.
5. Enforce MFA only after confirming each person has a working primary method and a recovery path.

For the break-glass account, use a unique long password, a protected MFA method, and a documented owner. Keep its use rare and review any use promptly.

Verify and maintain

After enforcement, confirm that dormant accounts, contractors, and shared mailboxes have an appropriate access decision. Remove old recovery phone numbers and review who can reset MFA. Revisit the inventory when you add a new critical service or change identity providers.

A careful scope note

MFA reduces the likelihood of certain account-takeover paths; it does not make an environment secure by itself. Pair it with least privilege, good recovery controls, device hygiene, and a documented response process. Validate settings in each service before relying on them.