MFA · Rollout and Management
Service group: CybersecurityMultifactor authentication your staff can actually live with
We plan and run MFA rollouts that cover every account that matters, choose methods that resist modern phishing, enrol staff without chaos, and give you a safe way to recover when someone loses their phone.
At a glance
- Service
- Planning, rollout and ongoing management of multifactor authentication across Microsoft 365, remote access and key business applications
- Best suited to
- Organizations of roughly 5 to 200 employees with partial, inconsistent or no MFA coverage
- Core inclusions
- Coverage inventory, method selection, staff enrolment support, recovery procedures, admin hardening and coverage reporting
- Not included by default
- Hardware security key purchases, MFA for applications that do not support it, and custom integration development
- Methods supported
- Microsoft Authenticator with number matching, passkeys, FIDO2 security keys and Windows Hello for Business; SMS only as a documented fallback
- Pricing basis
- Fixed-fee rollout project, with ongoing management per user per month, confirmed in a written quotation
- How to start
- Book a consultation to inventory where MFA is missing
What an MFA service covers
Multifactor authentication requires something beyond a password, such as an approval in an app, a passkey on a phone or a physical security key, before a sign-in succeeds. It is one of the most effective controls a small organization can deploy, and it appears in every baseline we reference, including the Canadian Centre for Cyber Security baseline controls and the CIS Controls.
Turning MFA on is easy. Doing it completely is not. Gaps hide in shared mailboxes with passwords, service accounts, VPN and remote desktop gateways, accounting and payroll portals, and administrator accounts on firewalls or backup consoles. Staff also need a smooth enrolment and a recovery process that cannot be abused by an attacker calling the help desk.
This page is about getting MFA deployed and kept healthy. Deciding when MFA is required, from which devices and for which apps, is covered by our wider Identity Security service.
MFA problems we fix
Partial coverage
Most staff use MFA, but a few executives, shared accounts or the person who complained loudest were exempted and never revisited.
Weak or phishable methods
SMS codes and simple push approvals remain the default, leaving staff exposed to SIM swapping, MFA fatigue and phishing proxies.
Systems outside Microsoft 365
VPNs, remote desktop, firewall consoles and line-of-business portals still accept a password alone.
Unsafe recovery
When someone gets a new phone, MFA is reset after a quick phone call with no identity verification.
What we deliver
Coverage inventory
A list of every system staff sign in to, whether it supports MFA, whether it is enforced, and who is exempt.
Method strategy
Authenticator with number matching for most staff, passkeys or FIDO2 keys for administrators and finance, and SMS or voice disabled or limited to documented fallback.
Enrolment campaign
Staff communications, short guides, scheduled enrolment windows and help desk support so the rollout does not stall.
Beyond Microsoft 365
MFA for VPN and remote access through Entra ID or the vendor's own MFA, and for third-party portals that support it.
Secure recovery process
A documented identity verification procedure for lost devices, temporary access passes and replacement enrolment.
Coverage monitoring
Regular checks for users without registered methods, new exemptions and sign-ins that bypass MFA.
Scope
Typically included
- Inventory of sign-in points and current MFA status
- Microsoft Entra ID authentication methods policy configuration
- Staff communication templates and enrolment support during the rollout
- MFA for supported VPN, remote access and admin consoles listed in scope
- Documented, verified recovery and temporary access procedure
- Monthly MFA coverage report during ongoing management
Requires separate scope or quotation
- Purchase of security keys or replacement phones
- Applications that do not support MFA or single sign-on
- Custom development to add MFA to in-house software
- Customer-facing or consumer sign-in systems
Technologies
- Microsoft Entra ID multifactor authentication and authentication methods policy
- Microsoft Authenticator with number matching and passkeys
- FIDO2 security keys such as YubiKey
- Windows Hello for Business
- Temporary Access Pass for secure onboarding and recovery
- Firewall and VPN vendors' MFA or RADIUS integration with Entra ID
Who it suits
Teams without consistent MFA
Organizations where MFA was switched on for some people at some point but nobody can confirm full coverage.
Finance and executive targets
Businesses where payment approvers and leaders are frequent phishing targets and need stronger methods.
Organizations facing insurer questions
Teams that must confirm MFA on email, remote access and privileged accounts for a cyber insurance application.
Benefits
- Stolen passwords alone no longer open your email or remote access
- Stronger methods for the people attackers target most
- A rollout staff understand, with fewer help desk surprises
- Recovery that does not become a social engineering weakness
- An accurate coverage record for insurers and clients
How the rollout works
Inventory
We list every sign-in point and record current MFA status and exemptions.
Plan
We agree methods, phases, communications and the recovery procedure with you.
Pilot
A small group enrols first so instructions and support can be refined.
Organization-wide enrolment
Staff enrol in scheduled waves, followed by enforcement and closure of exemptions.
Maintain
We monitor coverage, handle recovery requests and extend MFA to new systems as they appear.
Ways to buy
Prices are proposed and confirmed in a written quotation.
MFA rollout project
A fixed-fee project to inventory, plan, enrol and enforce MFA across your organization.
Ongoing management
Per-user monthly coverage monitoring and recovery handling, often included in managed IT plans.
Part of identity security
Combine MFA with conditional access and admin separation in a wider identity engagement.
Frequently asked questions
Is SMS-based MFA acceptable?
It is better than a password alone, but it is vulnerable to SIM swapping and interception. We recommend Authenticator with number matching or passkeys for most users and keep SMS only as a documented fallback where needed.
What if a staff member will not use a personal phone?
We can issue FIDO2 security keys or use Windows Hello for Business on company devices, so MFA does not depend on a personal phone.
What happens when someone loses their phone?
They contact support, we verify their identity using the agreed procedure, issue a Temporary Access Pass, and they re-enrol on a new device. Old methods are removed.
Can attackers bypass MFA?
Some can, using phishing proxies, repeated push prompts or stolen session tokens. Number matching, phishing-resistant methods and conditional access reduce those risks, which is why MFA is part of a wider identity approach.
Related services
Products and packages
Industries we support
Service areas
Close the MFA gaps you cannot see
We will inventory where MFA is missing and propose a rollout plan and fixed fee in writing.