Start with privileged users, supplier access, and systems tied to regulated or sensitive data. Replace SMS and push-based approval with phishing-resistant methods such as FIDO2/WebAuthn or PIV/CAC, then update access policies so the stronger method becomes the default for high-risk accounts.
Why This Matters for Security Teams
Legacy MFA was built to reduce account takeover, but sensitive access today is often targeted by phishing kits, token replay, help-desk social engineering, and session hijacking rather than password guessing alone. For high-value accounts, the problem is not whether MFA exists, but whether the factor can be bypassed, approved from a malicious prompt, or inherited by an attacker through a compromised device or supplier path.
That is why phasing out SMS and push approval should be treated as an access-risk programme, not a convenience upgrade. NHI Management Group’s Ultimate Guide to NHIs notes that 97% of NHIs carry excessive privileges, which is a useful reminder that strong authentication only helps when it is paired with constrained access and clean lifecycle controls. NIST’s SP 800-53 Rev. 5 also reinforces that authentication strength must be matched to risk and system sensitivity.
In practice, many security teams discover legacy MFA weakness only after a supplier mailbox, privileged portal, or admin console has already been used as the foothold.
How It Works in Practice
The safest way to retire legacy MFA is to phase in phishing-resistant authentication by access tier. Start with privileged users, third parties, and systems handling regulated data, then require a stronger method for those paths before widening the rollout. For most organisations, the practical baseline is FIDO2/WebAuthn or PIV/CAC, because those methods bind the login to a cryptographic credential rather than a reusable code or an approval prompt.
Implementation usually needs three parallel changes. First, update policy so the stronger factor is mandatory for sensitive roles and risky sign-ins. Second, map applications to their actual authentication support, because many legacy systems cannot enforce modern methods without federation or a gateway. Third, prepare recovery and exception handling so that break-glass access is tightly governed and time-bound.
- Use risk tiers to decide where legacy MFA can remain temporarily and where it must be removed first.
- Prefer phishing-resistant authenticators over SMS, TOTP, and push approval for privileged access.
- Require step-up checks for supplier, remote admin, and regulated-data workflows.
- Review session lifetime, device trust, and recovery paths alongside the factor change.
For identity programmes that also manage machine access, the same lifecycle discipline described in the Ultimate Guide to NHIs — Key Challenges and Risks applies: remove broad standing access, reduce long-lived credentials, and make revocation routine rather than exceptional. OWASP’s Non-Human Identity Top 10 is also relevant here because weak authentication and poor lifecycle control often fail together.
These controls tend to break down when older applications, shared admin accounts, or outsourced support processes cannot support modern authenticators without a broader redesign.
Common Variations and Edge Cases
Tighter authentication often increases user friction and rollout overhead, requiring organisations to balance phishing resistance against service continuity. That tradeoff is real, especially where help desks handle a high volume of resets or where frontline staff share devices, but it should not be used to justify indefinite exceptions.
Current guidance suggests a few common exceptions need special handling. Shared accounts should be eliminated where possible, because they undermine traceability regardless of MFA strength. Legacy VPNs and RDP gateways may need federated access or a brokered control plane before modern factors can be enforced. For emergency access, best practice is evolving toward tightly monitored break-glass accounts with separate approval, short expiry, and post-use review rather than permanent backdoor credentials.
There is no universal standard for migration sequencing, but sensitive systems should move first, then medium-risk users, then the long tail of low-risk access. The goal is not just to replace one factor with another, but to make the stronger factor the default wherever the business impact of compromise is highest. The NHI evidence base, including 52 NHI Breaches Analysis, shows how quickly access failures become systemic when identity controls are treated as static rather than risk-based.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10, OWASP Agentic AI Top 10 and CSA MAESTRO address the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AC-7 | Supports phishing-resistant authentication for sensitive access. |
| NIST SP 800-63 | Defines assurance levels and phishing-resistant authenticators. | |
| OWASP Non-Human Identity Top 10 | NHI-03 | Covers credential lifecycle weakness relevant to MFA migration. |
| OWASP Agentic AI Top 10 | Agentic systems need phishing-resistant access for tool use. | |
| CSA MAESTRO | Addresses identity and access controls for autonomous and supplier access. |
Apply phishing-resistant auth to high-privilege agent and operator workflows.
Related resources from NHI Mgmt Group
- What breaks when organisations rely on SMS or email MFA for sensitive access?
- How should regulated organisations phase out SMS 2FA without disrupting access for users and administrators?
- Who is accountable when access control failures expose sensitive systems, and what regulations push organisations toward MFA?
- What breaks when legacy MFA is used against AI-assisted credential theft?
