Security · Zero Trust & Secure Architecture · 02
MFA and phishing-resistant authentication planning
MFA and phishing-resistant authentication planning determines which populations, applications and administrative paths need multi-factor authentication, which need phishing-resistant methods such as hardware keys or platform passkeys, and how to get there without locking out the people who keep the business running. It is needed when MFA coverage is partial or inconsistent, when insurers and customers ask specifically about phishing-resistant methods, when an incident began with a stolen credential or a pushed approval, or when a regulation or contract names the methods required. Planning produces a coverage map of who has what today, a target state by population and risk, the method and policy choices with reasoning, and a rollout plan with enrollment, recovery and exception handling defined before the first user is enrolled.
Scope
What the review covers.
- Coverage assessment: populations, applications and administrative paths with and without MFA
- Method selection: phishing-resistant, push, time-based codes, by risk
- Policy design: conditional access, session controls, legacy protocol handling
- Enrollment, recovery and lost-device procedures
- Exception handling for accounts that cannot use standard methods
- Rollout sequence and user communication
Deliverables
What you receive.
| Deliverable | Form |
|---|---|
| Coverage map | Current MFA state by population and application |
| Target state and method plan | Who gets which method, and why |
| Policy specification | Conditional access and authentication policies |
| Rollout and recovery plan | Sequence, enrollment, recovery, exceptions |
Prerequisites
What we need from you.
- Access to the identity provider and authentication logs
- The list of applications and whether each supports modern authentication
- Insurance, regulatory or contractual requirements that name methods
Related
Where this sits.
- Zero Trust & Secure Architecture Service
- Security Hub
- Privileged access management Also
- Network segmentation Also
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days
Questions
Asked before engaging.
Is push-based MFA enough?
For many populations, with number matching and fatigue protections. For administrators and high-value accounts, phishing-resistant methods are the standard insurers and regulators now expect.
What about legacy applications that cannot do MFA?
They are identified, isolated behind a gateway where possible, and recorded as exceptions with compensating controls.
Do you run the rollout?
We plan it and can coordinate it. Enrollment is usually run by your IT team or provider with our support.