Include employees, contractors, remote users, and business-critical SaaS users.

Attackers often target email, VPN, SaaS, admin portals, and the identity provider itself.

External users can become weak access paths if they are exempt from strong identity controls.

Permanent exceptions, shared accounts, and unreviewed bypass groups are common MFA failure points.

Choose the strongest method most protected users actually use, not only a method enabled in settings.

Phishing-resistant methods use cryptographic authentication that resists fake login pages and replay attacks.

Number matching, context display, rate limits, and suspicious prompt reporting reduce push-bombing risk.

Examples include FIDO2 security keys, smart cards, Windows Hello for Business, platform credentials, or managed passkeys.

Privileged identity compromise can defeat many downstream controls.

Emergency accounts need strong protection, strict ownership, and alerting without blocking recovery during a real outage.

Strong MFA should be paired with least privilege, just-in-time access, approvals, and privileged session controls.

Examples include impossible travel, new device, high-risk sign-in, admin console access, and financial workflow approval.

Weak first-time enrollment can let an attacker register their own authenticator after stealing a password.

Attackers often target help desks, recovery flows, and fallback channels instead of the primary MFA method.

Backup methods reduce lockouts but should not downgrade users to weak SMS, voice, or help-desk shortcuts.

Authenticator lifecycle controls should remove old devices, revoke sessions, and respond quickly to employment or device changes.

Legacy mail, basic auth, old VPN, and older protocols may bypass MFA entirely.

Non-human accounts often cannot use MFA, so they need least privilege, secret rotation, workload identity, or stronger compensating controls.

Strong login controls can still fail if attackers steal sessions or use unmanaged devices without reauthentication.

Monitor failed prompts, suspicious resets, new authenticator registration, impossible travel, and admin sign-ins.

A roadmap should define target methods, priority users, device readiness, exception handling, communication, and migration phases.

Human-risk controls remain important because attackers still use social engineering against push prompts and help desks.

MFA posture drifts when bypass groups, admin roles, and weak methods are not reviewed.

Useful metrics include phishing-resistant adoption, admin coverage, weak method usage, reset volume, exceptions, and legacy-auth attempts.

Tabletops and purple-team tests can reveal weak reset paths, token theft exposure, and social-engineering gaps.

MFA maturity depends on the platforms you rely on, including support for SSO, WebAuthn/FIDO2, logs, and conditional access.