Multi-factor authentication (MFA) adds a second verification step to the password when signing in. That second step can be an approval in a phone app, a one-time code or a physical security key. Even if a password is stolen, the attacker cannot get in without the second factor.
Which methods are most secure?
- SMS codes: Better than nothing, but exposed to attacks such as SIM swapping.
- Authenticator app codes: More secure than SMS.
- App notification with number matching: Convenient for users; number matching prevents "MFA fatigue" attacks.
- Security keys and passwordless sign-in (FIDO2 / passkeys): The most phishing-resistant option, recommended for admins and critical accounts.
Which accounts first?
- Admin accounts and cloud management portals,
- Email and collaboration tools (Microsoft 365, Google Workspace),
- VPN and remote access,
- Accounting, banking and ERP systems,
- Website, domain and DNS management panels.
Step-by-step rollout
- Inventory: List which systems support MFA and who uses what.
- Central identity: Where possible, connect applications to one identity system with single sign-on (SSO) and manage MFA in one place.
- Pilot group: Start with IT and a few volunteers and refine the guide based on their experience.
- Announcement and short guide: Explain why and how in a one-page guide with screenshots.
- Gradual enforcement: Allow a registration period first, then make MFA mandatory.
- Recovery process: Decide in advance how to verify a user who loses their phone.
Common mistakes
- Enabling MFA for some users while still allowing legacy protocols that bypass it.
- Exempting admin accounts.
- Disabling MFA on shared accounts.
ujans introduces MFA, single sign-on and conditional access policies as part of identity and access management, without hurting the user experience.