Do We Need MFA for Every User (Exceptions and Rules)

‍

Last updated

May 1, 2026

Reviewed by

Reviewed by: IT Service Delivery Lead

Speakable Summary

Most SMBs should use MFA for every user because one compromised login can impact the whole business. MFA reduces account takeovers, fraudulent invoice and payment attempts, and unauthorized access to email and shared files. The right way to handle exceptions is to make them rare, written, time-limited, and reviewed.

MFA in plain English
MFA is a second sign-in step after your password, like a code on your phone or an approval prompt, so a stolen password alone is not enough to get in.

Opening

MFA is one of the simplest controls that reduces real-world risk. It is also one of the most argued-about because it adds friction.

Perfection is never possible. The goal is fewer account takeovers, fewer emergency lockouts, and fewer “someone got in and we don’t know how” situations.

This page explains when MFA should be required, what exceptions look like in practice, and how to set rules that staff will actually follow.

Direct Answer

Yes, most businesses should require MFA for every user for email and core cloud apps. Exceptions should be rare, documented, time-limited, and approved so they do not become a permanent hole.

LINK: Microsoft 365 Support
LINK: MFA Explained for SMBs
LINK: Cyber Insurance Readiness

The simple rule

Default
MFA is required for all users.

Non-negotiable
MFA is required for all admin accounts, all finance accounts, all email access, and all remote access.

Exceptions
Exceptions are allowed only when documented, approved, and time-limited.

Why “every user” is usually the right answer

Most breaches start with a normal user account. Email is the front door to password resets, invoices, vendor portals, and file access.

If one user is compromised, attackers often use that access to escalate. MFA blocks many of those attempts.

Cybersecurity insurance often expects MFA, especially for email, remote access, and admin accounts. Even when it is not explicitly required, it strengthens your evidence for underwriting and claims.

When exceptions make sense

Exceptions are not a strategy. They are a temporary accommodation.

Common legitimate reasons

• A break-glass emergency account with strict controls
• A service account that cannot use interactive MFA and has a safer alternative
• A legacy device or app that cannot support modern auth and is being replaced
• A user with an accessibility constraint requiring an alternate factor method

What does not qualify as an exception

• It’s annoying
• I travel a lot
• I don’t have my phone
• We’ve always done it this way
• It slows me down

Those are adoption problems, not technical blockers. Solve them with better factor choice and training.

Rules that keep exceptions from turning into a mess

1) Exceptions must be written

Every exception needs a short written record. Who, why, what system, and what alternative control exists.

If it is not written, it will not be reviewed. If it is not reviewed, it will become permanent.

2) Exceptions must expire

Every exception gets an end date. If the end date arrives, the exception is removed or re-approved with a new date.

A common pattern is 30 days or 60 days. The important part is that it is time-limited.

3) Exceptions must be approved by the business

MFA is a business risk decision. The approver should be the owner, CFO, or designated security approver.

IT should implement the rule. IT should not silently grant exceptions.

4) Exceptions must have compensating controls

If MFA is off, something else must reduce risk.

Examples of compensating controls

• Restrict sign-in by device only
• Restrict sign-in by location or IP
• Require a hardware key instead of an app
• Reduce access scope for that account
• Monitor sign-ins and alerts more aggressively

LINK: Conditional Access Explained

5) Review exceptions monthly

If you have exceptions, they must show up in the monthly IT report.

Owners and CFOs should see exception count and which exceptions are expiring soon. This keeps the rule enforceable.

LINK: Monthly IT Reporting

Recommended MFA rollout rules that work for SMBs

Step 1: Enforce MFA for admins immediately

Admins are the highest risk. Start there.

Also remove unnecessary admin accounts. Admin sprawl creates risk even with MFA.

Step 2: Enforce MFA for email and finance next

Email and finance are common breach paths. Require MFA for these roles early.

Step 3: Enforce MFA for everyone

After the first wave, enforce for all users.

If you allow MFA optional, you create permanent weak accounts. Those weak accounts become the entry point.

Step 4: Train staff on the right method

Most MFA frustration is poor setup.

What helps

• Choose a simple method the team will actually use
• Provide a one-page setup guide
• Explain what to do when a phone is lost or replaced

This reduces lockouts and support noise.

What should be documented

• MFA policy and enforcement rules
• Admin list and MFA status
• Exception list with owner, reason, and end date
• Approved factor types allowed
• Recovery process when phones change
• Break-glass account design and controls

Common Questions

Do we need MFA for every user

Yes for most SMBs because normal user accounts are a common entry point. Exceptions should be rare and controlled.

Is MFA required for admins

Yes always. Admin accounts should be protected first and reviewed regularly.

What about shared mailboxes and shared accounts

Shared mailboxes should not be used as sign-in accounts. Shared accounts should be avoided or tightly controlled.

LINK: Shared Mailboxes and Permissions

What if an app cannot support MFA

That is an exception case with an end date. Replace or modernize the app and restrict access until then.

What is the safest MFA method

It depends on your environment. For high-risk roles, hardware keys are strong. For most SMBs, an authenticator app is common.

Will MFA stop all breaches

No. It reduces many common account takeover paths. You still need monitoring and good offboarding.

Does MFA create more support tickets

Initially it can. With training and clear recovery steps, tickets decline and risk drops.

Should we allow SMS codes

SMS can be better than nothing, but it is not the strongest option. Use stronger factors for admins and finance when possible.

How do we handle lost phones

Have a written recovery process and at least two internal admins who can reset MFA. Recovery steps should be documented.

What is a Fit Check

An Objective Fit Check reviews your MFA status, exception list, and enforcement gaps. It produces a clean set of rules and next steps.

LINK: Contact / Fit Check

Key terms (plain English)

MFA: A second sign-in step beyond a password.Factor: The method used for MFA like app, key, or code.Exception: A time-limited case where MFA is not possible.Compensating control: Another control that reduces risk when MFA is off.Admin: A high-privilege account that can change settings.Break-glass: Emergency access with strict rules.Conditional Access: Rules that control when sign-ins are allowed.Modern authentication: Sign-in methods that support stronger security.

Optitech is the same is the same of the maintain the majororro quisquam est qui dolorem ipsum quia golor sit amet, conse ctetur, adipisci velit, sed eligendi optio cumque nihil impedit quo minus id quod maxime plac eat take a trivial example, which of us ever undertakes laborious physical exercise, except to obtain

We are Optitech provide the best quality It solution neque porro quisquam est qui dolore ipsum quia golor sit amet, conse ctetur, adipisci velit, sed eligendi optio cumque nihil take a trivial example, which of us ever undertakes laborious physical exercise except

We are Optitech provide the best quality It solution neque porro quisquam est qui dolorem ipsum quia golor sit amet, conse ctetur, adipisci velit, sed eligendi optio cumque nihil impedit quo minus id quod maxime plac eat take a trivial example, which of us ever undertakes laborious physical exercise, except to obtain some an advantage take a trivial example, which of us ever undertakes laborious physical exercis

‍