# MFA rollout

## 1. Policy

Dashboard > Security > Multi-factor Auth. Policies:

- Never: off.
- Confidence-based / adaptive: step up when risk signals fire (new device, impossible travel, suspicious IP). Best default for most products.
- Always: every login. Strongest, most annoying.

Set policy per application if the dashboard supports it for your tier; admin tools get Always, the marketing site gets adaptive.

## 2. Factors

Enable TOTP (authenticator apps) as the baseline; add WebAuthn/passkeys where your users' devices support it; SMS only as a fallback (SIM-swap risk, cost). The factor list is the enrollment screen; keep it short or users bounce.

## 3. Enrollment campaign

Do not flip enforcement on day one. Announce, give 2-4 weeks, show enrollment prompts post-login (an Action can nudge users without one), then enforce. Track enrollment rate in tenant logs before the deadline.

## 4. Recovery codes

Show recovery codes at enrollment and offer regeneration in account settings. Users who lose their factor AND have no codes become support tickets; have a verified-identity recovery flow ready (not "email us").

## 5. Enforcement

An Action or the MFA policy enforces. Gate API-side too for sensitive operations: require `amr` claim containing `mfa` on step-up. The id token's `amr` tells you which factors were used.

## Checklist

- Enrollment rate measured before enforcement day.
- Recovery path exists and has been tested by someone who is not you.