Why MFA Matters to an MSP
MFA is one of the cheapest controls you can put across a client, and one of the first things a cyber insurance application asks about. It also protects you: your own technicians hold admin access to every client, so a stolen MSP credential without MFA is a way into all of them at once. For how insurance requirements affect your agreements, see whether to require cyber insurance from clients.
The number that matters is enforcement, not availability. An account where MFA is merely offered is not protected. Track it as MFA Coverage, measured against every account that can sign in, not only the ones users remembered to set up.
Enforcement also has to survive change. New hires, new apps and new admin accounts appear every month, and each one starts without MFA unless a policy forces it. Conditional access policies that apply by default beat a checklist step someone has to remember during onboarding.
Where to Enforce It First
- Your own RMM, PSA, documentation platform and every admin portal your team uses.
- Client global admin and privileged accounts, ideally with no shared logins at all.
- Email and the client's identity provider.
- Remote access, VPN and any cloud app that holds client data.
Shared admin accounts defeat MFA because nobody can say who used them. Removing shared admin accounts is usually the step before enforcement makes sense.
Not All Second Factors Are Equal
| Method | Main weakness |
|---|---|
| SMS or voice code | SIM swap and number porting |
| Push approval | Users approve prompts they did not start |
| Authenticator app code | Can be phished by a fake sign-in page |
| Hardware key or passkey | Cost and lost devices |
Phishing-resistant methods such as hardware keys and passkeys suit admins and finance staff first. Number matching on push prompts reduces blind approvals for everyone else.
Recovery is the other weak point. If a user who loses a phone can call the help desk and have MFA reset on a name alone, an attacker can do the same. Write a verification step into the reset process, such as a callback to a known number or a manager's approval, and make sure every technician follows it.
Exceptions Are Where Attackers Look
Every client has accounts that skip MFA: service accounts, scanners that send email, legacy protocols, a vendor login nobody owns. Record each exception by name with a reason and a review date, and block legacy authentication wherever the client can live without it. MFA is one layer of a zero trust approach, not a replacement for monitoring such as EDR.
Common Questions
Is 2FA the same thing as MFA?
Two-factor authentication is MFA with exactly two factors. In practice the terms are used interchangeably.
What if a client owner refuses MFA?
Put the refusal in writing and note it in your risk register or QBR notes. Some MSPs make MFA a condition of the agreement.
Should MFA cost the client extra?
Enforcing it is usually part of the base agreement. Hardware keys and conditional access licensing can be billed separately.