Microsoft 365 Setup & Migration
Multi-factor authentication rollout, on site
We know we should turn on multi-factor sign-in but are worried about locking staff out.
We know we should turn on multi-factor sign-in but are worried about locking staff out.
Multi-factor authentication stops most account takeovers that start with a stolen or guessed password. The risk of rolling it out is that staff get stuck when they cannot approve a sign-in. A planned rollout avoids that by registering everyone with a method that works for them and making sure admins can recover access. Legacy sign-in methods that skip MFA, such as old mail protocols, need blocking too.
What the technician does
- Check admin accounts and plan the rollout order
- Enable MFA policies in Entra ID and register staff
- Set up break-glass admin access and record recovery steps
Make sure at least one admin account is protected and tested before switching on MFA for everyone.
About multi-factor authentication rollout
We review admin accounts first and secure them, then enable security defaults or conditional access policies in Entra ID. Staff are registered with the Microsoft Authenticator app or hardware security keys. We set up a protected emergency admin account and write down the steps to reset a user who has lost their sign-in method. Staff are registered at their desks so questions are answered on the spot.
What usually causes it
- An account was compromised or a phishing attempt was reported
- Insurance or client requirements
- Admin accounts used for everyday work
- Old protocols allowing sign-in without MFA
Before we arrive
- Login for your domain registrar or DNS host
- Admin access to your current email or Microsoft 365 tenant
- A list of staff, their roles and which shared folders they use
- Any shared mailboxes such as accounts or info addresses
What a visit looks like
When you book multi-factor authentication rollout, you tell us what's going on and we reply with a time that suits you and a price. Nothing starts until you're happy with both.
On the day, the technician arrives, looks at the problem in person and confirms the plan with you before starting. If something turns out different from what was expected - a part is needed, or the cause is somewhere else - we stop and agree the change with you first.
When the work is done we test it with you, show you what was changed, and leave the area tidy. For business jobs we note what we did, so there is a record for whoever looks after your IT next.
Pricing
Each multi-factor authentication rollout job is priced before work starts. The price depends on what's involved - the size of the site, the equipment, and whether parts are needed - so the quickest way to a number is to tell us about the job on the booking form.
There is no contract and no monthly fee. You book the job you need and pay for that job.
Multi-factor authentication rollout: questions
What if a staff member does not want an app on their personal device?
Hardware security keys are an alternative. They plug into the computer or tap to sign in and do not need anything installed on a personal device.
Does MFA affect shared mailboxes?
Shared mailboxes are accessed through a user's own account, so they are covered by that user's MFA. Their direct sign-in should be blocked. We also check printers and scanners that send email, which may need a different method.
Do you do multi-factor authentication rollout on site?
Yes. We come to businesses and homes across Auckland and Hamilton and do the work where the equipment is.
How much does multi-factor authentication rollout cost?
It depends on what's involved. Tell us about the job on the form and we'll confirm the price before any work starts.