Key takeaways
- •Prioritise email, administrator and remote-access accounts.
- •Choose methods supported by the service and user context.
- •Protect recovery and enrolment processes.
- •Review exceptions and stale accounts regularly.
Start with high-impact accounts
Prioritise accounts that administer systems, manage money, control email or access sensitive data. Include third-party and emergency accounts in the review.
Plan enrolment and recovery
A control that cannot be used may be bypassed. Provide a supported enrolment path, secure recovery process and way to replace a lost device without weakening identity checks.
Review exceptions carefully
Document accounts that cannot use the chosen method, their compensating controls and an owner who will revisit the exception. Avoid permanent exclusions without a clear reason.
Combine with good access hygiene
MFA works alongside least privilege, device protection, account monitoring and removal of unused access. Review sign-in alerts and administrative permissions as part of the wider identity process.
Sources and further guidance
Official guidance may change. Check the source directly for current requirements. This article is general information, not legal advice.
Put your next step into context.
A free 30-minute cybersecurity review provides a Red, Amber or Green score and prioritised fixes.
Book a review