Why does MFA self-enrollment create risk for accounts that do not yet have a second factor?

Why unenrolled accounts are a high-value target

MFA self-enrollment changes the meaning of account compromise. Before a second factor exists, the attacker is not bypassing MFA so much as racing to become the first party to bind it. That makes the account especially attractive after password theft, phishing, session theft, or helpdesk abuse, because the attacker can convert a single foothold into a control relationship that outlives the original access path. For a practical overview of the governance side of this problem, see NIST Cybersecurity Framework 2.0.

Security teams often underestimate how quickly an unenrolled account can become “owned” once enrollment is open to the user by default. In practice, many teams discover the problem only after password resets, recovery flows, or MFA prompts have already been redirected by the attacker.

How self-enrollment turns a login into persistence

The key mechanism is authority transfer. In an unenrolled state, the first successful authentication can be enough to reach the enrollment workflow, and that workflow often assumes the current session is legitimate. If the attacker can add a phone prompt, authenticator app, passkey, or backup method before the real user does, future logins will validate against the attacker’s chosen factor instead of the owner’s. The compromise then survives password changes if the newly added factor remains trusted.

This risk is strongest where enrollment, recovery, and reset are tightly linked. A common failure chain looks like this: stolen password, successful login, attacker adds a second factor, then the attacker uses the same account to change recovery settings or trigger self-service password reset. Even when the password is later changed, the attacker may still hold an accepted authenticator and can regain access at the next challenge.

• Unenrolled accounts have no second barrier to protect the enrollment step itself.
• Self-service recovery paths can become a shortcut back into the account if they trust the newly enrolled factor.
• Session continuity matters, because the attacker only needs one authenticated window to establish durable access.
• Detection is often delayed because the initial sign-in may look “successful” rather than obviously malicious.

Where identity proofing is weak, or where helpdesk staff can override normal enrollment safeguards, the same pattern can extend beyond one account and become a repeatable takeover path. This guidance breaks down when enrollment authority is spread across multiple tools or when recovery channels are treated as equivalent to strong authentication.

When the standard answer changes: consumer apps, enterprise SSO, and recovery-heavy environments

Tighter self-enrollment controls often increase friction, requiring organisations to balance first-use convenience against takeover resistance. The answer is not identical in every environment. In consumer services, self-enrollment is usually designed for usability, so the main concern is account recovery abuse and weak notification. In enterprise SSO environments, the issue is more structural: if the identity provider allows enrollment during the first authenticated session, the attacker may inherit access across many downstream applications. In recovery-heavy environments, the real weakness may be the reset path rather than the MFA step itself.

Industry consensus is clear on the core risk, but implementation details vary. Some platforms delay factor trust until additional verification completes; others immediately trust the enrolled factor. That difference matters because immediate trust creates a persistence window even if defenders later notice the suspicious login. The most important question is not whether MFA exists, but whether the account can still be claimed before a legitimate second factor is established.

Risk and Threat Considerations

Unenrolled accounts create a specific takeover condition: the attacker only needs one valid entry point to bind a durable factor to the account. The risk is not limited to authentication bypass. It also includes recovery-chain abuse, account re-binding, and long-lived persistence after the original credential is changed.

Failure mechanism: the attacker authenticates before the legitimate user has enrolled a second factor, then uses the trusted session to register a factor the defender did not choose. If recovery or reset flows accept that new factor, the attacker can preserve access across password changes and re-entry attempts.

Impact: the account can become effectively transferred to the attacker, with continued access to email, business applications, data, and downstream reset channels that rely on the compromised identity.

Practitioner Guidance

What to verify: confirm whether first-time enrollment is gated by step-up verification, device trust, or administrative approval. If a user can sign in and immediately add a factor without additional proof, treat that as a takeover-prone design rather than a convenience feature.

Decision rule: if an account has no second factor yet, treat the enrollment moment as a high-risk control point and require stronger checks than ordinary sign-in. If the platform cannot enforce that, reduce exposure by limiting who can self-enrol and by notifying security staff on first-factor binding events.

Practitioner takeaway: the real issue is not the absence of MFA in the abstract, but the first moment when trust is assigned to a factor that the rightful user never had a chance to register.

Related resources from NHI Mgmt Group

• Why do non-human identities create more risk than many human accounts?
• Why do non-human identities create more remediation risk than many human accounts?
• Why do passwords and low-assurance second factors create ongoing account takeover risk?
• Why do over-permissioned accounts and orphaned privileged identities create such a large security risk?