You must roll out MFA to 40,000 employees. Security wants hardware keys; the service desk fears the call volume. Design the rollout.

The framing that resolves the argument

Not every identity carries the same risk, so not every identity needs the same factor. A uniform mandate is what creates the support burden, and it is also unnecessary.

Tier by what the identity can reach

Tier 1 — phishing-resistant, mandatory, no exceptions. Administrators, anyone with production access, finance approvers, and anyone who can change identity configuration. Passkeys or hardware keys. This population is small — typically low single-digit percentages — so the support cost is bounded and the risk reduction is the largest available. Start here, this quarter.

Tier 2 — phishing-resistant, strongly encouraged, with a fallback. Everyone with access to customer data. Passkeys as default, TOTP permitted during transition.

Tier 3 — MFA required, factor flexible. Everyone else. Platform passkeys (Touch ID, Windows Hello) cost nothing per user and are what most people will end up using without noticing.

Why passkeys reduce support load rather than increasing it

The service desk's concern is based on the wrong model. Passkeys are lower friction than TOTP — a fingerprint rather than opening an app, reading a code and typing it before it expires. Most of the anticipated call volume comes from expired codes, clock drift and lost phones, none of which apply.

The genuine support load is enrolment and recovery, which is where the planning should go.

The recovery design, which is where rollouts actually fail

Register at least two factors at enrolment — a platform passkey plus a roaming key, or a second device. Single-factor registration guarantees lockouts.

A defined, identity-verified recovery path — and this is the security-critical part. Help desk recovery is a well-documented social engineering vector; recovery must require verification stronger than a phone call, and for Tier 1 it should require a manager or an in-person step.

Temporary access passes with short validity rather than falling back to password-only.

Sequencing

Pilot with IT and security (they will find the problems and can absorb them), then Tier 1, then department by department with local champions, with self-service enrolment open throughout and a deadline per tier. Keep the old factor working during each department's window.

What a strong answer adds

Naming what MFA does not solve: session hijacking after authentication, malicious insiders, and token theft. Which is why it pairs with short session lifetimes, step-up for consequential actions, and device posture checks — MFA at the front door does not make the rest of the house safe.