Prioritise the identities that can change the environment
Not every account creates the same consequence. Begin with administrators, finance approvers, remote support identities, developers with deployment authority and people who can change identity policy. Map the applications they use, the authentication methods those applications accept and the recovery routes that can bypass the primary sign-in control.
Push notifications and one-time codes improve on passwords alone, but they can still be captured, relayed or approved under pressure. Phishing-resistant authenticators bind the sign-in to the legitimate service. Treat this as a risk-based migration rather than a universal hardware purchase, and explain which attack path the change is intended to close.
Design enrolment, recovery and exceptions together
A strong authenticator fails operationally when enrolment is confusing or recovery silently falls back to weak identity proofing. Define how devices and security keys are issued, how identity is verified, how lost authenticators are replaced and how urgent access works when normal support channels are unavailable.
Maintain at least two controlled authentication options for critical administrators, stored or assigned so one lost device does not create an outage. Exceptions need a named owner, reason, compensating safeguard and expiry date. Monitor registrations and method changes because attacker-controlled enrolment can be as damaging as a stolen password.
Roll out with evidence and safe fallback
Pilot with a small group that represents real devices, locations and accessibility needs. Test ordinary sign-in, new-device enrolment, travel, offline conditions, account recovery and loss of the identity platform. Record support demand and failed journeys before expanding to a larger population.
Measure coverage of high-impact accounts, remaining weak methods, recovery events, exception age and suspicious authentication changes. Validate that legacy protocols and alternate applications cannot bypass the intended control. A completed rollout is not the number of keys issued; it is verified reduction of phishable access paths.
What to do next.
- ✓Identify the accounts with the highest operational authority.
- ✓Inventory every accepted authentication and recovery method.
- ✓Provide two controlled authenticators for critical administrators.
- ✓Test enrolment, loss and emergency access before enforcement.
- ✓Give every exception an owner and expiry.
- ✓Monitor authentication-method registration and change.
Use guidance responsibly
Technology, provider behaviour and legal requirements change. Validate implementation details against current official documentation, test changes safely and obtain qualified legal advice where required.
Maya Naidoo
Identity & Cloud ContributorWrites about identity architecture, cloud access and the controls that make distributed systems easier to trust and operate.
More from this writer