// Journal / Guide
Turning on MFA without a revolt
Sep 10, 2026
5 min read
Written by
Marco Conti, Head of Customer Success
Filed under
Guide
Multi factor login stops almost every attack that starts with a stolen password. The hard part is not the setting, it is the people. Here is the one week plan our customers use.
Monday: say why, in one paragraph
Send a short note from someone people trust. Not a policy, a reason: passwords leak, and a second step on the phone means a leaked password is useless. Say when it starts and that help is ready.
Tuesday: start with the people who say yes
Turn it on for the team leads and anyone who offered. They find the small problems first, and they answer their colleagues' questions later.
Pick one app for everyone. Two choices is already one too many.
Print the three setup steps on one page and leave it on every desk.
Wednesday to Thursday: everyone else, in small groups
Ten people at a time, with someone from IT on a call for fifteen minutes. Most setups take two minutes. The call is for the one person whose phone is three years out of date.
Nobody minds the second step. What people mind is being surprised by it at 9 a.m. on a deadline.
Friday: close the gaps
Shared accounts. Give each person their own login, or move the shared one to a password manager with its own second step.
Lost phones. Write down the backup codes process before anyone needs it.
Old apps. List the ones that cannot do MFA and put a date on replacing them.
With Hexwall, the dashboard shows who is still without a second step, so the last few names are easy to find.