“Ninety-eight percent enrolled” can be a reassuring number that answers the wrong question. The remaining accounts may include administrators, recovery operators, or an older application with a completely different sign-in path.
An MFA rollout becomes a security control when important access routes require the intended method, not merely when most employees have registered one.
Inventory the paths into important systems
CISA recommends phishing-resistant MFA and distinguishes stronger methods from options that remain susceptible to phishing. Use that guidance to define the target before measuring adoption.
For each critical service, list the primary sign-in, administrative sign-in, account recovery, external-user access, and any local fallback. Mark who owns each route. A policy on the central identity provider may not describe a service's independent local accounts.
Keep the review small enough to finish. Start with email, identity administration, remote access, and the systems whose loss would cause the most disruption. Expand from confirmed routes rather than from an incomplete application inventory.
Review exceptions as access decisions
An exception needs an owner, a reason, an expiry date, and a compensating control. “Temporary” is not an expiry date.
For a hypothetical finance team, an older reporting tool may not support the chosen authenticator. The useful decision is whether to restrict its access, replace it, or accept a documented temporary exposure. Counting the employees as enrolled does not resolve that decision.
Do not quietly exempt an entire group because one workflow is inconvenient. Identify the specific application and affected access route.
Exercise the awkward moments
Test ordinary operational situations using approved test accounts:
- A user loses their registered device.
- A contractor changes employers.
- A privileged operator needs emergency access.
- A service owner disables the central sign-in connection.
The objective is not to lock people out. It is to discover whether urgency causes the organization to fall back to an easier, weakly verified recovery path.
Record who can approve an exception and how the action becomes visible to reviewers. A well-written policy that cannot survive a support call is unfinished.
Measure coverage with denominators
Report protected critical routes, unresolved exceptions, and overdue remediation alongside enrollment. Define what “protected” means for each measure.
An exposure finding can then prompt a focused check: does this account have a remaining password-based route, and what access does it authorize? It should not trigger the assumption that every enrolled account is immune to misuse.
Read MFA fatigue and unexpected prompts for the user-facing response, and protecting emergency access accounts for a route that deserves its own review. A credible rollout connects adoption to actual access decisions.