The rollout often gets stuck at the same moment: an employee replaces a phone, but their sign-in approval is still tied to the old one. Multi-factor authentication (MFA) is worth enabling, but a rushed setup can turn a sensible security change into a queue of locked accounts. Treat recovery as part of the setup, not an afterthought.
Start With High-Impact Accounts
Begin with email, administrator accounts, finance tools, and any service that can reset access to other systems. List who owns each account and check whether the service supports an authenticator app, a security key, or another factor your team can realistically use. The available options differ by platform, so check the account’s own security settings before choosing a rollout method.
Set Up Recovery Before Requiring MFA
Have each person enroll a backup factor where the service allows it, and document the approved recovery route for lost or replaced devices. Store recovery codes in a controlled business password manager or another access-restricted location—not in a shared chat or an unprotected spreadsheet. Make sure an authorized administrator knows how to help without asking employees to send passwords or codes.
Pilot, Then Expand the Rollout
Test the process with a small group first, including someone who uses a different device or works away from the office. Confirm that sign-ins, backup methods, and account recovery all work before setting an organization-wide deadline. After launch, review who has enrolled and update the recovery instructions when your tools or staff change.