Two-Factor Authentication: Implementation Without Employee Resistance
MFA stops the vast majority of stolen password attacks. Learn how to deploy it quickly and without complaints.
Two-factor authentication is the single measure with the highest impact-to-cost ratio. Nevertheless, it remains unimplemented in many places due to fears of employee backlash. In practice, this fear is unjustified — if the implementation is well-prepared.
TL;DR — Key Takeaways
- App-based push notification is significantly more secure than SMS codes.
- Passkeys and Windows Hello eliminate most login prompts.
- Exceptions are the greatest risk — attackers will target exactly those accounts.
- A procedure for lost phones must be prepared in advance.
Available MFA Methods
The most common methods are app-based push notifications (with number matching), one-time passcodes from an app, hardware security keys (FIDO2), and passkeys. SMS is still better than nothing, but it is vulnerable to SIM swapping and interception.
For administrator accounts, we recommend a hardware key or passkey; for standard users, an app with push notifications. Additionally, we use conditional access to limit how often login is required — on a known and compliant device, this is rare.
Why MFA is Essential
Today, a password is primarily just a username that attackers likely already have.
- Leaked password databases enable credential stuffing attacks.
- Phishing sites capture passwords in real time.
- Without MFA, a stolen account means instant access to email and documents.
- Insurance companies and clients increasingly require MFA contractually.
How to Get Started — Recommended Process
- Audit accounts: users, administrators, service accounts, external partners.
- Select methods by group and prepare clear instructions.
- Deploy MFA for administrators and management first.
- Roll out to departments with a two-week transition period.
- Eliminate exceptions; where impossible, restrict access to known devices.
- Implement a helpdesk process for lost phones with secure identity verification.
Comparison of Methods
| Method | Security | Convenience | Recommendation |
|---|---|---|---|
| SMS code | Low | Medium | Backup option only |
| App-based code | Medium | Medium | Acceptable |
| Push with number matching | High | High | Recommended for all |
| Passkey / FIDO2 key | Very High | Very High | Admins, management |
Common Mistakes
The most frequent mistake is permanent exceptions for management or for one 'problematic' system. Attackers target these specific accounts because they know they are often exempt.
Another mistake is the absence of a lost phone procedure. If IT resets MFA upon request without identity verification, the entire measure can be bypassed through social engineering.
How VitalIT Helps
At VitalIT, we implement MFA and conditional access while providing instructions and support for employees. View our Cybersecurity Services.
Related: Passkeys and Enterprise Password Management.
Frequently Asked Questions (FAQ)
- Do we need additional licenses?
- Not for basic MFA; however, conditional access requires Entra ID P1, which is included in Business Premium.
- What about employees without a smartphone?
- We use hardware keys or company devices; there is a solution for every case.
- Must employees use their private phones?
- Not necessarily. The alternative is a hardware key, which is also a cleaner solution legally.
- How often will a login prompt be required?
- On a known and compliant device, typically every few weeks; on a new device, with every login.
- Does MFA stop all attacks?
- Not all of them, but it eliminates the vast majority of attacks involving stolen passwords. For the rest, conditional access and monitoring are required.