If you could turn on only one security control, multi-factor authentication (MFA) would be a strong candidate. The hard part isn’t the technology — it’s rolling it out without locking people out.
Phase 1: Administrators first
Start with every privileged account: cloud administrators, SAP Basis users, domain admins. These accounts do the most damage if compromised, and their owners understand why MFA matters.
Phase 2: Remote access and email
Next, protect the entry points attackers try first — VPN, remote desktop gateways and email.
Phase 3: Everyone else
Roll out in waves by department, with:
- A short guide and a five-minute video.
- A help-desk process for lost devices before launch day.
- A grace period with reminders before enforcement.
Choose stronger factors where you can
| Factor | Strength | Notes |
|---|---|---|
| Hardware security key | Strongest | Phishing-resistant |
| Authenticator app with number matching | Strong | Good default for most users |
| SMS code | Weak | Better than nothing; phase out over time |
Don’t forget service accounts
Service accounts can’t use MFA, so restrict them instead: limit where they can log in from, rotate their credentials and alert on interactive logins.
