MFA can add an important barrier when a password is compromised, but the method, account recovery and session handling all affect the protection. Plan the rollout as an access change, not simply a checkbox.
Identify the accounts that matter
Begin with business email, administrator access, remote access and services holding important information. List account owners and recovery routes. Confirm how staff and suppliers will access the service and who can approve changes.
Named accounts and appropriate permissions remain important. MFA on a broadly shared administrator account does not resolve unclear ownership or excessive access. Remove obsolete accounts and address recovery dependencies alongside the rollout.
Choose an appropriate method
Where supported, consider phishing-resistant methods such as properly implemented passkeys or security keys. Different methods provide different protection. SMS, one-time codes and generic push approvals can face interception, phishing or approval-fatigue risks.
Check the service’s current guidance and the organisation’s device and recovery requirements. Do not label every method equivalent or assume MFA makes an account immune to compromise. See ACSC MFA guidance as a starting reference.
Test enrolment and recovery
Provide staff with understandable instructions and a route to support. Plan for a lost authenticator, a replaced device and a staff member leaving the business. Keep recovery methods controlled so they do not become a weaker alternative to the main sign-in protection.
Use a small, authorised rollout test before changing access for everyone. Confirm that the responsible people can recover critical accounts without relying exclusively on the device or mailbox that could be unavailable.
Understand the remaining risks
Malware, compromised devices, stolen authenticated sessions and weak recovery processes can still expose information. Monitoring and appropriate response remain necessary. An unexpected prompt or suspicious session should be reported through the organisation’s agreed route.
If compromise is suspected, involve the service owner or responder using a trusted communication path. Credential changes, session revocation and device review need to fit the circumstances; a public guide cannot establish that changing a password alone resolves the incident.
Record the working arrangement
Maintain account ownership, approved methods, recovery contacts and joiner/leaver steps. Review the arrangement after material changes in systems or roles. A useful readiness question is whether the business can explain how an administrator regains legitimate access without bypassing its own controls.
For a wider review, see security assessment scope and our remote-work checklist. The right implementation depends on the services and risks involved.
