How to roll out multi-factor authentication across an agency

Multi-factor authentication is the highest-return security project most agencies can run, and the identity platform they already license usually supports it. The work is in sequencing, recovery, and the handful of awkward cases, not in the technology.

Phishing-resistant methods such as passkeys and hardware security keys are now practical for ordinary staff and should be the target for anyone with elevated access.

Steps

1. 1Inventory where authentication happens

   List every service that accepts a login from outside the network: email, remote access, cloud consoles, finance, human resources, and any application with its own account database. The last category is where the gaps hide.

2. 2Choose methods by risk

   Authenticator applications as the general default, phishing-resistant passkeys or hardware keys for administrators, finance, human resources, and executives. Avoid text message codes except as a temporary fallback.

3. 3Design recovery before enrollment

   Decide what happens when someone loses a device. A second registered credential plus an identity-verified help desk process. Do not let recovery fall back to a phishable method, because attackers will use that path.

4. 4Start with administrators

   Enroll IT and privileged accounts first, remove password-only fallback for them, and separate administrative accounts from everyday accounts.

5. 5Pilot with a friendly department

   Run a small pilot, watch the enrollment, and fix the instructions. Most rollout friction comes from unclear enrollment steps rather than from the technology.

6. 6Handle shared and field devices deliberately

   Dispatch consoles, counter workstations, vehicle tablets, and shared operational systems each need a design. Hardware keys, badge-based sign-in, or device-bound credentials depending on the case.

7. 7Address legacy applications

   Put single sign-on in front of applications that support it. For those that cannot, document the exception, apply compensating controls, and set a replacement date.

8. 8Communicate, then enforce

   Announce the date, provide short hands-on enrollment sessions, staff the help desk for the first week, and then enforce. An open-ended voluntary period does not converge.

9. 9Eliminate shared accounts and clean up service accounts

   Shared logins undermine the whole control. Replace them with individual accounts, and move service account credentials into a managed vault with rotation.

10. 10Measure and report

    Track the share of accounts on multi-factor and on phishing-resistant methods, by role. Report it to leadership, since this is the number insurers and auditors ask about.

What you end up with

Every internet-facing service protected by a second factor, privileged accounts on phishing-resistant credentials, a recovery process that does not reintroduce the risk, and a metric leadership can track.