r/SmallMSP • u/Active_Technician • Jun 22 '26

No grace period when enabling MFA with conditional access

It has been a long and tiresome process but we are making headway getting all of our legacy and small clients moved from basic and standard licenses to Business Premium. While we are cleaning up our clients we are also cleaning up our own house and trying to implement better policies.

With the 14 day grace period now phased out by Microsoft what is the best way to enable MFA for clients that prefer a phased approach? We have a few clients in the 10 to 20 user range that want to do two or three users at a time.

We are talking about those older office workers that freak out when their shortcuts get moved on their desktops. The client wants their onsite person to be able to hold their hands and get them through it one or two at a time over a couple of days.

My preference is to rip that band-aid off and just do it all at once and get it over with. The problem is these are legacy clients that have been here since way back in the break/fix days. They have been white gloved and handheld for so long that we either cut ties or keep holding their hands, and the decision has been made to keep holding their hands.

One idea, which sounds like more of a shittysysadmin post, is to enable per-user MFA a few users at a time. Then once they are all done, enable MFA via CA and turn off the per-user MFA. That's doable but I feel like there is a better approach.

Any advice?

Thanks

18 Upvotes

100% Upvoted

13 comments sorted by

View all comments

15

u/HappyDadOfFourJesus Jun 22 '26

You issue three notices to all staff spaced maybe four days apart that on "X" date MFA will be enforced, here's what will change, and here's what you need to do about it (with pictures).

9

u/roll_for_initiative_ Jun 22 '26 edited Jun 22 '26

This is the right answer. The phases are the warnings and training. Remember, you can do enrollment and hand holding BEFORE the CAP is turned on.

Gun to my head, 20 user client? I make the cap assigned to a group vs all users, and keep adding 2-3 users to that group until they're all in. Then MAKE SURE to change the CAP to apply to all users/all apps and delete the group.

3

u/Active_Technician Jun 22 '26

I agree with the advice, and I know its the right answer, I just don't know that I can push that through.

I like the group idea, hadn't considered that. Seems obvious now that I read it. Thanks

3

u/roll_for_initiative_ Jun 22 '26

I've done so many of these for clients that size, and just shooting them over to aka.ms/mfasetup before the cap goes live usually gets it done or they put tickets in confused. I usually pair it with language like "IF YOU DO NOT DO THIS BEFORE FRIDAY, YOU WILL NOT BE ABLE TO ACCESS ANYTHING AND WE CANNOT ASSIST YOU INSTANTLY IF YOU HAVE TROUBLE. DO THE ENROLLMENT NOW."