What should organisations do when administrators are not required to use two-factor authentication?

Why administrator MFA should be mandatory, not optional

When administrators can opt out of two-factor authentication, the organisation is effectively allowing its highest-impact accounts to fall back to password-only protection. That creates an avoidable weakness at the exact point where access has the broadest blast radius. Central enforcement matters because privileged access should be governed by policy, not preference.

Administrator accounts are a high-value target because they can change configuration, reset other identities, access sensitive data and sometimes move across tenant or environment boundaries. Workforce Identity Security Guide is a useful reference for the broader control pattern: strengthen sign-in, recovery and session controls together, so MFA is not bypassed by a weak fallback path.

In multi-tenant environments, the issue is more than account compromise. A single administrative login can affect multiple customer or tenant boundaries, so the organisation is not just protecting one mailbox or console session. It is protecting the trust boundary that separates one tenant from another, which makes admin MFA a baseline requirement rather than an enhancement.

What fails when admins are left to choose their own authentication strength

Optional MFA usually fails through inconsistency. Some administrators enroll, some delay enrollment, and some remain on weaker methods that are easier to phish, intercept or fatigue. The result is not equal risk reduction across the admin population, but a patchwork in which the weakest account becomes the practical entry point.

This also creates governance drift. If the policy exists but is not centrally enforced, security teams cannot rely on it during access reviews, incident response or audit evidence. The control only works when the enforcement point is upstream of the login decision, not after the user has already signed in and obtained elevated access.

For administrators, the main concern is not only theft of the password. It is abuse of the privileged session that follows, because once an attacker is inside an admin context they can often alter recovery settings, create new access paths or weaken the environment further. MFA Fatigue and Bypass Guide helps explain why control design matters as much as enrollment, especially where push prompts, fallback methods or recovery workflows can be manipulated.

There is also a known abuse pattern where attackers look for privileged accounts without MFA and use them as the shortest route to durable access. Microsoft Midnight Blizzard breach shows how a legacy account without MFA can become the weakness that matters, even in a mature environment.

How organisations should implement the control without creating weak exceptions

The practical objective is simple: make MFA mandatory for every administrator account, and remove self-service opt-outs. That means enforcing the policy centrally through the identity platform, applying it consistently across all admin roles, and treating exceptions as time-bound, documented risk decisions rather than user choice.

Choose a phishing-resistant method where possible for the most privileged roles, because admin accounts need stronger assurance than ordinary user access. NIST SP 800-63 Digital Identity Guidelines provides a strong external baseline for assurance levels and modern authenticators, while Passwordless and Passkeys Guide is useful for rolling out stronger sign-in methods without relying on reusable one-time codes as the default answer.

Where administrative access spans cloud consoles, SaaS tools and internal platforms, the policy should cover every path, not just the main login page. OWASP Top 10 A07 Guide is relevant because authentication failures often show up in the seams between password policy, session handling and recovery behaviour.

If the organisation manages many privileged accounts, the control should be paired with session monitoring and rapid revocation so that a compromised admin can be contained quickly. MITRE ATT&CK T1550 Use Alternate Authentication Material Guide is a good companion for understanding how stolen tokens, cookies and other authentication material can bypass weak sign-in assumptions after the fact.

Risk and Threat Considerations

When admin MFA is optional, the organisation inherits avoidable exposure to credential theft, session hijack and privilege abuse. The risk is highest where administrators can reach production systems, tenant administration planes or recovery settings, because compromise at that layer can quickly expand beyond the original account.

Failure mechanism: An attacker gains or guesses a privileged password, then targets the weakest admin account or the least resistant authentication path, often using phishing, prompt fatigue or stolen session material to avoid stronger sign-in checks.

Impact: Privileged access can be used to change security settings, access multiple tenants or systems, and create persistent backdoors that outlive the first login event.

Practitioner Guidance

What to verify: Check that MFA enforcement applies to every administrator path, including break-glass design, remote admin access, API-backed admin tools and any legacy consoles. If any privileged account can still authenticate without MFA, treat the control as incomplete.

Escalation / exception: Any exception for an administrator should require explicit time limits, compensating controls and named ownership. If the exception is permanent or based on convenience, it is not really an exception, it is a control failure.

What good looks like: Admin MFA is enforced centrally, logs show consistent enrollment, and the security team can prove that no privileged account is outside the policy. The strongest sign is that administrators cannot self-select a weaker path even if they want one.

Practitioner takeaway: For privileged access, optional MFA is not a flexible policy, it is a predictable failure mode. Enforce it everywhere, remove opt-outs, and design the surrounding recovery and session controls so the first protected login remains the one that matters.

Related resources from NHI Mgmt Group

• Guide: MFA Guide
• Two-Factor Authentication
• What breaks when two-factor authentication is too hard to use?
• Why do OTP bots succeed even when organisations use two-factor authentication?
• Why do convincing phishing pages create so much risk even when organisations use passwords and two-factor authentication?