Updated October 8, 2026
Switching on multifactor authentication (MFA) for every account at once tends to stall. A smaller sequence works better: list your accounts, protect owner and admin logins first, then email and money accounts, and plan recovery before anyone is locked out.
CISA’s MFA guidance says any MFA is better than none, and that phishing-resistant MFA is the standard to work toward. Here is a two-week plan for a small team that applies that advice in a practical order.
Know the ladder before you pick a method
CISA calls FIDO/WebAuthn the only widely available phishing-resistant method. Its fact sheet on implementing phishing-resistant MFA covers the approach in detail. For organizations still using push approvals that cannot switch yet, CISA describes number matching as a useful interim step, though weaker than phishing-resistant options.
| Tier | Example | Where to use it first |
|---|---|---|
| Strongest | FIDO/WebAuthn security keys or device passkeys | Owner, admin, email, finance |
| Interim step | Push approvals with number matching | Accounts that cannot support keys yet |
| Baseline | Other second-step prompts, such as authenticator codes | Everything else, then upgrade |
| None | Password only | Fix these first |
Step 1: Build the account inventory
You cannot protect what you have not listed. Include the accounts people forget: the domain registrar, payroll, the password manager and any shared mailbox.
| Account | Admin | Who signs in | MFA today? | Method planned | Recovery path |
|---|---|---|---|---|---|
| Email and calendar | ________ | ________ | Yes / No | ________ | ________ |
| Bank and payments | ________ | ________ | Yes / No | ________ | ________ |
| Domain registrar | ________ | ________ | Yes / No | ________ | ________ |
| Payroll | ________ | ________ | Yes / No | ________ | ________ |
| Password manager | ________ | ________ | Yes / No | ________ | ________ |
Step 2: Roll out in a fixed order
- Days 1–2: Finish the inventory and choose a method for each tier.
- Days 3–4: Protect owner and admin accounts. Plan emergency access using your provider’s current guidance, with separately protected recovery credentials and monitored use. For Microsoft Entra, maintain at least two emergency accounts with phishing-resistant authentication; follow the provider’s recovery design rather than creating a password-only spare admin.
- Days 5–7: Turn on MFA for email and file storage, since a hijacked mailbox can reset other passwords.
- Days 8–10: Cover banking, payroll, the domain registrar and the password manager.
- Days 11–14: Cover the remaining accounts, retire shared logins and test recovery.
Budget example for security keys
Suppose a 9-person team gives everyone a primary and a backup key, plus 2 spares. The price below is invented for the arithmetic; check current prices before buying.
9 people × 2 keys = 18 keys. 18 + 2 spares = 20 keys. At a hypothetical $30 each, 20 × $30 = $600, or about $66.67 per person ($600 ÷ 9).
Keys are not required to start. A team can begin with authenticator-based MFA this week and add keys for admin and finance accounts as budget allows.
Match the method to the role
| Role | Why the risk is higher | Start with |
|---|---|---|
| Owner and admins | Can change settings, users and billing | Security keys or passkeys, plus a provider-specific emergency access plan |
| Finance and payroll | Can move money or change payment details | Security keys where supported; otherwise the strongest option available |
| Everyday staff | Email and shared files hold customer data | Authenticator-based MFA now; upgrade later |
| Contractors | Access is temporary and easy to forget | Separate accounts, MFA required, end date on the calendar |
Where rollouts go wrong
- Recovery codes live in the same inbox. If that mailbox is locked, the codes are unreachable. Store them somewhere separate.
- Shared logins hide who approved a prompt. Give each person an individual account where possible.
- A new phone arrives with no plan. Decide in advance how a lost or replaced device is verified.
- Departed staff keep access. Add MFA devices and sessions to your offboarding checklist.
- Unexpected prompts get approved. Tell staff to deny any approval request they did not start, and report it.
What to tell your team
People accept a new step more readily when they know why and when. Send one short message before each wave: what changes, the date it starts, how long setup takes, where to get help and what to do if they lose their phone or key. Add one line that they should never approve a sign-in prompt they did not start.
Add MFA to offboarding
| Task | Done by | Date |
|---|---|---|
| Disable the person’s account and sessions | ________ | ________ |
| Remove their MFA devices and keys | ________ | ________ |
| Transfer shared files and mailbox access | ________ | ________ |
| Rotate any shared secrets they knew | ________ | ________ |
Check your work
At the end of week two, sign in to each protected account from a fresh browser and confirm the second step is required. Then test one recovery path on a low-risk account so you know it works before you need it.
The goal is not a perfect setup in 14 days. It is that the accounts an attacker would want most are no longer protected by a password alone.