Guide
How to Turn On MFA for Your Whole Staff
Plan it like a small project, not a switch. Most problems come from staff who were not ready, not from the technology.
Why it matters
Most account takeovers start with a stolen password. MFA stops a stolen password from being enough. The technology is the easy part. Rollouts fail when staff are surprised, locked out or never trained on what an unexpected prompt means.
Step by step
- List every account and every person who signs in, and remove anyone who left.
- Pick the method for each person. An app with number match for most, a security key for anyone without a smartphone.
- Turn it on for admins and email first, then remote access, then everything else.
- Run a test sign in with each person before any deadline.
- Teach one rule: deny any prompt you did not start, and tell IT.
Common mistakes
- Turning it on for everyone on the same day with no test logins
- Forgetting staff who do not have a smartphone
- Leaving admin accounts and remote access for last
- Never explaining what to do with a prompt you did not start
Free tools for this
MFA Readiness Checklist
Get every person ready for MFA, with the methods ranked strongest first.
Stop. Check. Report. Scam poster
Eight red flags and three steps. Print it and post it near desks.
A real case
Agencies facing a statewide MFA requirement
- Situation
- Energy assistance agencies across California must use MFA for ServTraq and CALIHEAPApply starting in January.
- What was done
- Spoke at the ServTraq Innovation Summit on why security starts with MFA, and published a free readiness checklist for agencies.
- Result
- Agencies have a free, practical checklist to get their staff ready ahead of the deadline.
Questions people ask
What is MFA, and why does it matter so much?
Multi-factor authentication adds a second step after your password, such as an app approval or a security key. Most account takeovers start with a stolen password, and MFA stops a stolen password from being enough.
Which MFA method is the strongest? Are text codes still OK?
Strongest first: a security key or passkey, then an authenticator app with number match, then an app code, then a text or call code. CISA recommends phishing-resistant MFA and advises moving away from text message codes where you can. Keep text codes as a backup, not the main method. The MFA checklist compares them.
What about staff who do not have a smartphone?
Plan for them early. A security key or a call code usually works. Ask each vendor which methods it supports before the deadline, not on the day.
What should staff do if they get an MFA prompt they did not expect?
Deny it. Never share or type the code for anyone, change the password and tell IT right away. An unexpected prompt means someone else has the password.
Not sure where to start?
One conversation and a straight answer about where your organization stands. No cost, no commitment, no pitch.