When two-step login is optional, security posture becomes uneven across the organisation. Some users will still rely on passwords alone, which increases the impact of phishing, credential stuffing, and password reuse. Optional MFA also makes policy enforcement harder because administrators cannot prove that every account meets the same access standard.
Why This Matters for Security Teams
Leaving two-step login optional creates a split security model: some enterprise users are protected by stronger authentication while others remain one password away from account takeover. That inconsistency weakens trust in every downstream access decision, especially where identity is the first control plane. NIST Cybersecurity Framework 2.0 treats identity and access governance as a core outcome, not a preference, because weak authentication cascades into higher likelihood of phishing success, credential stuffing, and lateral movement.
For NHI Management Group, the same pattern shows up across non-human access as well. When controls are optional, coverage gaps become invisible until an incident forces a review. The Ultimate Guide to NHIs — Why NHI Security Matters Now notes that 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, which is a reminder that inconsistent identity controls rarely stay isolated to humans. Optional login protections also make audit evidence weaker because administrators cannot prove the same access standard applies everywhere.
In practice, many security teams discover the real cost only after a password-only account is used to reach privileged systems that were assumed to be protected by policy.
How It Works in Practice
Two-step login stops being optional only when it is enforced at the right control points: the identity provider, conditional access layer, and any legacy path that can bypass central authentication. Best practice is to require multifactor authentication for all enterprise users, then narrow exceptions to tightly managed break-glass accounts. The operational goal is not just stronger login friction, but consistent enforcement across VPN, SaaS, admin consoles, and remote access flows.
A useful implementation pattern is to pair mandatory step-up authentication with risk-based checks and device trust. That means a standard login may still be allowed in low-risk situations, but privileged actions, new devices, unusual geographies, and sensitive applications trigger stronger verification. For organizations with mature identity programs, this should be backed by phishing-resistant methods and clear recovery procedures so support teams do not create shadow exceptions. The NIST Cybersecurity Framework 2.0 supports this kind of identity-centric control alignment, while the Ultimate Guide to NHIs — Why NHI Security Matters Now is especially relevant where enterprises also manage service accounts, API keys, and other secrets that should never depend on human convenience.
- Require two-step login by default for every workforce identity, including contractors.
- Eliminate broad exemptions and document any break-glass access separately.
- Enforce step-up authentication for privileged or sensitive actions.
- Monitor for legacy apps that still allow password-only sign-in.
- Test recovery flows so help desk workarounds do not reintroduce weak access.
These controls tend to break down when organisations run mixed identity stacks with older applications that cannot consume modern conditional access, because enforcement becomes fragmented and users find bypass paths.
Common Variations and Edge Cases
Tighter login enforcement often increases support overhead, requiring organisations to balance user friction against the reduction in account compromise. There is no universal standard for every recovery workflow yet, so teams should distinguish between ordinary users, privileged administrators, and emergency access accounts. The strongest stance is usually mandatory step-up authentication for all regular enterprise users, with narrowly scoped exceptions that are time-bound and reviewed.
Some environments need extra nuance. Shared terminals, plant-floor systems, and third-party managed services may require alternate sign-in designs, but those cases should still preserve equivalent assurance rather than reverting to password-only access. For regulated organisations, optional multifactor authentication can complicate audit readiness because evidence of policy coverage is incomplete. Current guidance suggests that optional security controls are acceptable only in tightly bounded pilot scenarios, not as a standing enterprise posture. When identity policies are inconsistent, the weakest account becomes the easiest entry point.
The NIST Cybersecurity Framework 2.0 is helpful for framing governance expectations, while NHIMG’s research shows why identity sprawl matters: NHIs outnumber human identities by 25x to 50x in modern enterprises. That scale makes weak human authentication even more dangerous, because one compromised user account can often lead into systems that also contain poorly governed secrets.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-63, NIST Zero Trust (SP 800-207) and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-1 | Identity proofing and authentication strength are central when MFA is optional. |
| NIST SP 800-63 | AAL2 | AAL guidance explains why password-only access is weak for enterprise accounts. |
| NIST Zero Trust (SP 800-207) | AC-6 | Zero Trust requires consistent access enforcement, not optional user choice. |
| OWASP Non-Human Identity Top 10 | NHI-01 | Weak human auth often mirrors the same governance gaps seen in NHI access paths. |
| NIST AI RMF | Governance principles apply when authentication policy affects automated and human workflows. |
Define accountability, monitoring, and escalation for any identity control that can be bypassed.
Related resources from NHI Mgmt Group
- How should organisations implement policy based access control for enterprise applications without slowing down users?
- What breaks when organisations manage human users and bots on separate identity stacks?
- What breaks when organisations do not know how many MCP servers they have?
- What breaks when organisations only focus on secret scanning for NHI security?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 28, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
