# MFA rollout
## 1. Policy
Dashboard > Security > Multi-factor Auth. Policies:
- Never: off.
- Confidence-based / adaptive: step up when risk signals fire (new device, impossible travel, suspicious IP). Best default for most products.
- Always: every login. Strongest, most annoying.
Set policy per application if the dashboard supports it for your tier; admin tools get Always, the marketing site gets adaptive.
## 2. Factors
Enable TOTP (authenticator apps) as the baseline; add WebAuthn/passkeys where your users' devices support it; SMS only as a fallback (SIM-swap risk, cost). The factor list is the enrollment screen; keep it short or users bounce.
## 3. Enrollment campaign
Do not flip enforcement on day one. Announce, give 2-4 weeks, show enrollment prompts post-login (an Action can nudge users without one), then enforce. Track enrollment rate in tenant logs before the deadline.
## 4. Recovery codes
Show recovery codes at enrollment and offer regeneration in account settings. Users who lose their factor AND have no codes become support tickets; have a verified-identity recovery flow ready (not "email us").
## 5. Enforcement
An Action or the MFA policy enforces. Gate API-side too for sensitive operations: require `amr` claim containing `mfa` on step-up. The id token's `amr` tells you which factors were used.
## Checklist
- Enrollment rate measured before enforcement day.
- Recovery path exists and has been tested by someone who is not you.