Passwordless and adaptive MFA rollout checklist

Before rollout

Map every way people actually sign in.

• Inventory sign-in paths: laptops, VDI, VPN, web apps, legacy and mainframe.
• Confirm how the identity provider integrates with each path, for example SAML to a VDI gateway or network access control for laptops.
• Define adaptive policies: which device, location and risk signals raise or lower the challenge.
• Design break-glass and account-recovery paths before anyone loses a password.

During rollout

Pilot with the people most likely to break it.

• Start with IT and a volunteer business group, then expand by site or function.
• Keep a tested fallback for each sign-in path during cutover.
• Prioritise high-privileged users, including administrator and mainframe accounts.
• Staff the service desk for enrolment and device-change requests.

After launch

Prove it’s working, then retire the passwords.

Track enrolment, fallback use and help-desk volume. Remove password-based paths once adoption is stable, and give audit teams evidence that strong authentication is enforced.