The MFA rollout that doesn't lock out your bookkeeper: a small-team checklist

A stolen password is how most small-team breaches start — and MFA is the cheapest fix on the board. But half-finished rollouts are worse than none: an "optional" MFA policy is a policy nobody follows, an SMS-only rollout trains everyone to approve prompts blindly, and an enforcement day without recovery codes becomes the day your bookkeeper is locked out of payroll.

The order below is the whole trick: the recovery layer exists before the enforcement switch does. The full checklist lives on our ops notes site: MFA Rollout Checklist for Small Teams — here's the engineering summary.

1. Pre-flight: inventory before you touch a setting

• List the accounts that can hurt: email, bank, payroll, cloud console, domain registrar, code hosting, product admin panels. Roll out to the five that matter, not forty that don't.
• Find the non-humans. Service accounts, scripts, printers, old mail clients don't carry a phone. They get scoped app passwords or dated exceptions — not surprises.
• Note where each app's enforce toggle lives. Available MFA and enforced MFA are different switches; you'll visit the enforce one on day zero.
• Pick the factor before rollout: authenticator app (TOTP) default, hardware keys for the two admin accounts, SMS as a documented last resort. Passkeys where offered.

2. Build the recovery layer first (the part everyone skips)

• Two break-glass admin accounts tied to no employee's phone: long random passwords, hardware-key MFA, credentials sealed offline. Test once, then leave alone.
• Per-person recovery codes — generated and stored before enrollment, not after the first lockout. Ten codes, one use each, dated.
• One backup admin per critical app. The person who resets MFA must not be the person who loses their phone the same week.
• A written "lost phone" path: who to contact, how identity gets verified (video call with the manager — not "answer me in Slack"), expected turnaround. If it's not written, enforcement day invents it under pressure.

3. Volunteers first, everyone second

• Pilot with 3–5 volunteers for one week. They find every broken integration: the desktop mail client that only does passwords, the invoicing tool that logs in quarterly, the script on an old API. Fix or exempt those on five people instead of forty.
• Answer the repeated questions publicly: why codes keep coming, what happens when the phone dies, whether it logs out active sessions.
• Announce with real dates: T-7 notice, T-1 reminder with the setup guide, T-0 enforcement. Open-ended "soon" rollouts never finish.
• Run a 15-minute setup window with screen sharing. The pilot volunteers are the best teachers, and the culture lands better as "we all did this" than "IT made me."

4. Enforcement day, in order

1. Flip one volunteer account to enforced and verify a normal login end-to-end — mobile app and the desktop client people actually use.
2. Then enforce the rest in one batch, keeping "allow existing sessions" on if the app offers it, so nobody gets logged out mid-task on day one.
3. Watch the named lockout channel all day. Every unblock goes through the written path: verify identity, recovery code, re-enroll the new device.
4. Same day, check the exceptions list: every service account and old client now has a scoped app password or API token, labeled with an owner and an expiry.
5. Close the loop in the weekly review: enforcement status per app, exceptions remaining, and the date the last "optional" box gets switched off. The rollout ends when nothing is optional.

5. The mistakes that flood the helpdesk

• Enforcing before recovery codes exist — the one that turns a Tuesday into a payroll outage.
• One human's phone as the factor for a shared account. Shared logins get scoped app passwords or delegated access, not a personal device as a single point of failure.
• SMS as the default. SIM-swap and phishing make it the weakest common factor, and it breaks silently when someone changes carriers.
• "Optional" forever. The users who most need MFA are the most likely to skip an optional setting. Set the enforcement date when you announce.
• No re-auth on sensitive actions. MFA at login but password-only for changing the bank account on file is a drawer with a lock on the drawer handle.

Takeaways

Recovery before enforcement (break-glass admins, per-person codes, written lost-phone path), pilot on volunteers so broken integrations surface on five people instead of forty, authenticator over SMS with hardware keys for admins, exceptions with expiry dates — and nothing stays optional.

The full fillable version is here: MFA Rollout Checklist for Small Teams — part of the HIVE80lab ops notes library (free, no signup, no email wall).

---

If you want the sheets that make the pre-flight inventory ten minutes instead of an afternoon: the Ops Starter Kit ($14) covers incident response and access review for small teams, and the Automation Starter Pack ($19) turns the weekly review — exceptions, expiry dates, enforcement status — into a workflow that runs itself. Launch week: 30% off any paid kit with code HIVE-LAUNCH30 at checkout. The First 30 Minutes checklist is free.