The short answer
Multi-factor authentication (MFA) adds a second proof, an app prompt or security key, to the password. Stolen passwords become far less useful; insurers and clients increasingly expect it. To avoid a revolt:
- Explain whyLeadership, plainly, before enrolment emails.
- Fit methodsIncluding a no-personal-phone option.
- Pilot, then wavesFriendly group first; fix rough edges.
- Ready help deskPlus lost-phone recovery.
- Enforce on dateAnnounced ahead; exceptions closed.
Choose the right methods
Factors are something you know, have or are. Phishing-resistant FIDO options are strongest, and number matching resists "MFA fatigue": prompt after prompt until someone taps approve.
| Method | Security | Staff experience | Where we use it |
|---|---|---|---|
| Authenticator app with number matching | Good | Familiar, quick | Most staff |
| FIDO2 security key or passkey | Strongest against phishing | Very quick once set up | Administrators, finance, executives |
| Hardware token with one-time codes | Good | Slower, but no phone needed | Staff without a work phone |
| SMS or voice code | Weakest | Easy | Only as a temporary fallback |
In Microsoft 365, number matching is enabled for all Microsoft Authenticator push notifications (users type the number on screen into the app), which defeats most prompt-bombing (Microsoft Learn).
The personal phone objection
The most common objection deserves respect: some staff do not want work apps on a personal phone, some have no smartphone or share one with family, some have employment terms or staff union arrangements that address it.
Explain the app
An authenticator app gives the organisation no access to the phone's contents.
Offer a key
A hardware key or token as an equal alternative, not a punishment.
Work phones
Where the role already justifies one.
Settle this before launch: nothing drains goodwill faster than a manager saying "just use your phone".
A phased rollout plan
- PrepareWeeks 1 to 2: sign-in routes, service accounts, break-glass, lost phones.
- PilotWeek 3: IT, managers, a non-technical person; questions become the FAQ.
- WavesWeeks 4 to 6: leadership first, then department by department.
- EnforceWeek 7: everyone, legacy sign-in blocked, exceptions reviewed.
Week-by-week detail
- Prepare: inventory every way people sign in (email, VPN, remote desktop, cloud apps, finance and payroll portals, line-of-business systems). Service accounts, shared mailboxes and devices such as scanners that send email need their own approach, not a blanket exception. Create two emergency "break-glass" administrator accounts, protected with strong keys, stored securely and monitored. Write the lost-phone process: how staff prove who they are to the help desk, and who can issue a temporary pass.
- Pilot: include at least one person who is not comfortable with technology, and note every question they ask.
- Waves: leadership enrols first, visibly (it is much easier to ask staff once the managing director has); each department gets a short drop-in session or video and a named contact; schedule away from month-end, payroll and busy seasons.
- Enforce: block legacy sign-in protocols that cannot use MFA; every exception gets an owner and an end date.
Rather talk it through? If your last MFA attempt stalled on exceptions and lost phones, we can plan and support a rollout that sticks. Talk to a Promatics specialist
Communication that works
Keep messages short and specific: what is changing, why, what to do by when, where to get help. Skip jargon such as "conditional access policy"; say "when you sign in from a new device, you will confirm it's you on your phone or with a key". Use staff's everyday language and the channels they read, including WhatsApp groups where that is how the office talks. Screenshots beat paragraphs.
What usually goes wrong
The surprise switch-on
Enforced overnight, half the office locked out Monday, leadership orders it off.
Permanent exceptions
A leader, shared account or old app excluded "for now". Attackers find those first.
SMS forever
Meant as a fallback, SMS codes became the default.
No recovery process
A phone is stolen on the way home; the help desk resets MFA for any caller, as attackers hope.
Forgetting the admins
Staff get MFA; administrator and third-party support accounts do not.
Rollout checklist
- Every sign-in route listed, including VPN, remote desktop and finance portals
- Methods chosen, with a non-phone option available
- Break-glass accounts created, secured and monitored
- Lost-phone and identity verification process written
- Pilot completed and FAQ updated
- Leadership enrolled first
- Messages ready in the languages and channels your staff use
- Legacy sign-in blocked after enforcement
- Every exception has an owner and an end date
- Phishing-resistant methods required for administrators
When to bring in help
A small team on Microsoft 365 or Google Workspace can often do this with built-in tools and this plan. Bring in a professional for:
- Several systems with separate sign-ins
- Older apps without modern authentication
- VPN or remote desktop access
- A previous attempt that stalled
AI can draft your staff email; it cannot find the service account buried in your tenant, sit with a nervous user, or take the 7 a.m. call from an executive locked out before a board meeting. Our cybersecurity services team plans the rollout, supports staff through it and, for managed-service clients, provides 24/7 monitoring and support afterwards. For Microsoft configuration, see the Microsoft 365 security baseline.
Limitations
A general approach. Features, licences and defaults change: check current vendor documentation. Personal-device employment and privacy considerations vary by workplace, and the Nigeria Data Protection Act 2023 applies to the personal data authentication systems collect about staff: involve HR and, where relevant, employee representatives.
Sources and further reading
Product capabilities and guidance change. These are the primary sources this article relies on, checked on the review date above.
- How number matching works in MFA push notifications for Authenticator, Microsoft Learn
- Cybersecurity Framework, National Institute of Standards and Technology
This article is general information, not legal, accounting or security advice for your specific situation. Examples are hypothetical unless stated otherwise.