MFA rollouts stall at about 90% coverage, and the remaining 10% is where the risk concentrates: shared accounts, service accounts, field staff without smartphones, and executives who asked for an exemption.
Choose phishing-resistant factors for privileged accounts. Push notifications are defeated by fatigue attacks and real-time phishing proxies. Hardware keys or platform passkeys for anyone with administrative access, even if the general population uses an app.
Block legacy authentication first. Protocols that cannot present a second factor simply bypass MFA. If legacy auth remains enabled, your MFA coverage number is describing something other than your actual protection.
Work the edge cases from day one. Shared accounts, service accounts, field staff without company phones, and VIP exemption requests are what leave you stuck at 90%. Start solving them during the pilot, not after enforcement.
Here's a preview. Unlock the free download to get all 4 sections (3 more below).
| Account type | Primary factor | Backup factor | Rationale |
|---|---|---|---|
| Privileged / admin | FIDO2 hardware key | Second hardware key | Phishing-resistant; required where compromise is most damaging |
| Standard user | Authenticator app with number matching | Second device or temporary access pass | Resists basic fatigue attacks; low friction |
More free templates IT teams use alongside this one.
Most password policies still enforce 90-day rotation and complexity rules that current NIST guidance explicitly advises against, because they push people toward predictable patterns. This one follows the evidence: length, breach screening, and MFA.
Access control policies state least privilege and then leave the mechanics unspecified, which is where it breaks down. This one fixes the approval route, the review cadence, and the privileged-access rules explicitly.
An access review where every manager clicks approve is worse than no review, because it manufactures evidence that access was checked. This template is built to produce the two things auditors actually test: a named reviewer who attested, and proof that the revocations they asked for happened.
Phishing-resistant factors such as FIDO2 hardware keys or platform passkeys for privileged accounts, and an authenticator app with number matching for general users. SMS is the weakest option and should be a last resort.
Because the last stretch is the hard cases: shared accounts, service accounts, staff without smartphones, legacy protocols, and exemption requests. Starting on these during the pilot rather than after enforcement is what gets a rollout finished.
It substantially reduces it, but not if legacy authentication protocols remain enabled, since those bypass the second factor entirely. Blocking legacy auth is as important as enabling MFA, and is frequently the step that is skipped.
