Most two-factor rollouts fail in the week after go-live, not in the configuration: one employee cannot find the code, another installed the app on an old phone, a third asks the manager for an exemption. Enrolment stalls and the rest work around the control.
Before enabling anything, send a short note from management with three points: why this is happening, what changes at sign-in, and when your department's date is. A note that says "new security procedure" with no reason invites resistance. Tie it to something concrete: payroll, client data, and a stolen mailbox that can email customers in your name.
Then name one channel for questions — a ticket queue or an internal group.
Executives are not exempt — they are the primary phishing target. If someone asks for an exemption, offer a security key instead.
Most tickets arrive in the first five minutes: the app would not download, the code never came, the camera would not read the QR. A group session with one device in front of the room clears those cases before they become tickets.
In the session: install the app, scan the code, complete a real sign-in, print the recovery codes. Enable the thirty-day trusted device option, because it removes most daily friction. Q8DM runs enrolment sessions inside client offices and sees far fewer tickets when someone walks a team through it.
Do not switch the whole company on one morning. A staged rollout lets you fix the explanation before four hundred people ask the same question.
Expect three lines: sign-in is slower, my phone is old, and I work from two devices. The first is answered by number matching plus a trusted device, the second by a security key or printed codes, the third by a conditional access policy or a service account.
Some roles need planning: field staff sharing one phone, drivers and reps with no company mailbox. Give them keys or codes issued by one named person, with a record of who received what — not a code passed around a WhatsApp group.
Prepare three things before go-live: printed recovery codes in a locked drawer, a break-glass admin account outside the policy, and one support person who can reset a lost device without waiting for a vendor. Without all three, the first lost phone stops a department.
Then track three numbers: enrolment percentage, tickets per week, and average resolution time. If tickets have not dropped by week three, the problem is the explanation, not the tool. Q8DM is a Kuwaiti company working in software development, design and training since 1998.
To review your team's accounts and write a clear rollout plan, start at q8dm.com.