Prioritize by consequence
Inventory every service that supports MFA and rank accounts by access to money, sensitive data, customer communications, administration, recovery, or critical operations. Enroll protected backup administrators before changing the only administrator account.
Design enrollment and recovery together
- Document supported methods, managed devices, hardware keys when appropriate, backup codes, and help-desk verification.
- Pilot with a small group and test common devices, travel, lost phones, new phones, accessibility, and offline scenarios.
- Keep recovery information protected and separate from the account it restores.
- Time-limit exceptions, assign an approver, document compensating controls, and review exceptions regularly.
Operate the control
Monitor enrollment, repeated prompts, suspicious sign-ins, failed recovery attempts, and inactive accounts. Tie MFA removal and device recovery to the onboarding and offboarding process.
MFA reduces account-takeover risk but does not make phishing, session theft, weak recovery, excessive permissions, or malicious approvals impossible.