How do we roll out MFA to every user without flooding the help desk?

Key facts

• Registration and enforcement are two separate steps; do registration first.
• Most help desk tickets come from lost or replaced phones, not from the first sign-in.
• Temporary Access Pass lets the help desk onboard or recover a user without a password reset.
• Waves of a few departments at a time keep ticket volume flat and predictable.
• Every exclusion, such as a break-glass account or service account, needs a written owner and reason.

Start with a registration phase

The biggest cause of an MFA ticket flood is enforcing sign-in requirements on people who have never registered a method. Separate the two. Open combined security info registration first, so users can add Microsoft Authenticator, a passkey or a security key at their own pace, and only then turn on enforcement.

In the Microsoft Entra admin center, the authentication methods policy controls which methods are allowed. A registration campaign can nudge users to set up Microsoft Authenticator or a passkey at sign-in, with a limited number of snoozes. Track progress with the authentication methods activity report and the user registration details view, and chase the stragglers by department.

• Decide the allowed methods: Microsoft Authenticator and passkeys as the default, FIDO2 security keys for people who cannot use a phone.
• Avoid SMS and voice as the primary method; keep them only as a short-term fallback where truly needed.
• Publish a one-page guide with screenshots and a short video before the campaign opens.
• Give managers a list of who in their team has not registered.

Pick the enforcement mechanism

Small tenants without Microsoft Entra ID P1 often rely on security defaults, which require MFA registration and challenge users when Microsoft judges it necessary. Security defaults are all or nothing, so they do not support waves or exclusions.

With Entra ID P1, included in Microsoft 365 Business Premium and E3, use Conditional Access instead. Build a policy that requires MFA, or an authentication strength, for all users and all resources. Scope it to a group, run it in report-only mode, review the sign-in logs for what would have been blocked, and then switch it on. Add departments to the group wave by wave.

Run the rollout in waves

A wave plan keeps ticket volume predictable and gives you a chance to fix problems before they reach everyone. Waves are usually set by department or location, sized so the help desk can absorb them. A typical SMB or mid-market rollout runs two to six weeks, driven by user count, the number of shared devices and frontline workers, and how many legacy apps need attention. The final schedule is set after discovery.

Prepare the help desk before wave one

The help desk needs three things: a way to verify the caller, a way to get the user back in, and a script. Verification should not rely on information an attacker could find, so use a manager callback, a video check or an in-person check for high-risk requests.

Temporary Access Pass is the key tool. It is a time-limited passcode an admin issues in Entra ID so a user can sign in and register a new method on a new phone or a new laptop. It avoids resetting passwords and avoids turning MFA off for a user, which is the habit that creates real risk.

• Lost or replaced phone: verify identity, delete the old method, issue a Temporary Access Pass, user registers again.
• Travelling user with no signal: Microsoft Authenticator codes work offline once registered.
• Shared mailbox access: users sign in as themselves; shared mailboxes should not have their own sign-in.
• Repeated unexpected prompts: check the sign-in logs; this can signal a password that has already leaked.

Clean up the edge cases

Legacy authentication protocols such as basic auth for POP, IMAP and SMTP AUTH cannot do MFA. Block legacy authentication with Conditional Access and find any scanner, line-of-business app or script still using it before enforcement starts.

Keep two cloud-only emergency access accounts outside the MFA policy only if they use strong phishing-resistant credentials and are monitored. Service accounts should move to managed identities or app registrations where possible. Contractors and guests should be covered by a guest policy, not quietly excluded.

How Accred Consulting approaches it

Accred Consulting plans MFA rollouts as a short, fixed-scope project. Discovery checks licensing, current registration, legacy authentication use and the help desk model. The proposal sets a clear scope, fixed price and timeline. US-based specialists then build the authentication methods policy and Conditional Access in report-only mode, run the registration campaign, write the help desk script and Temporary Access Pass process, and enforce in waves with structured check-ins. A roughly 350-user manufacturer moved to MFA and Conditional Access in 6 weeks this way. Handover includes documentation and knowledge transfer.

Track record: 475+ client projects, 2,000+ migration workstreams and 210,000+ users migrated by a US-based team. Company facts · Case studies

Related questions