ok weird one we need to enable multi-factor authentication for all staff at our small business 😭 my worry is the practical side: people getting locked out, teh support load, staff without company phones.
Any advice from people whove done a rollout like this? 😂 Were about 25 ppl on a cloud office suite, and nobody has MFA right now. A few staff have no work phone. thx in advance!!
Our suite has basic security defaults available, and conditional access on a higher plan we don't have. Four people won't use personal phones. Budget for a few hardware keys is approved.
Plan for lockouts before they happen 🔥 Every user should rgeister at least two methods (e.g. app plus a key, or app plus printed backup codes stored safely). Write down a verified process for resetting MFA, one that invovles confirming idetnity in person or by a known callback number, so a social engineering call cant simply get a reset.
oh ive been there lol well. Once it's rolled out, look at teh sign-in logs for blocked attempts and leagcy protocols. Older protocols that don't support MFA (some mail clients) can be a back door around it. Most cloud suites let you block legacy authentication; plan that as a follow-up step. hope that helps :)
happy to help with this one. prefer an authenticator app with push or codes, or hardware security keys, over SMS. SMS is better than nothing but is more vulnerable to SIM swapping and phishing. for people without a work phone, a hardware key is a good option: no personal device needed, and it resists phishing.
@polarfiddler rolled out over three weeks: admins, a pilot of five, then everyone. Four people got hardware keys. Two lockouts sooo far, both handled with the backup method. Legacy auth is blocked now too. worked for me anyway 🤷
oof classic. Do it in phases. Start with admins and IT (yourself), then a pilot group of friendly users, then everyone. Give a clear date, a short guide with screenshots, and a drop-in session 😤 Most resistance comes from surprise, not from MFA itself. fingers crossed 🤞
Sign in or create an account to reply.
