As of 13 August 2026, AI can only partly set up multi-factor authentication for your business.

What to actually do

1. Hand it to a person

   The route this page recommends

   A person who owns the outcome does this end to end, worth it when the failure is dear.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface, chat-fluent skill, and roughly 30 minutes until you can act on the result.

   How to actually do it

   1. Open the official administrator documentation for your identity provider and list the provider name, applications, user groups, current MFA settings and available second factors without copying any passwords or codes.
   2. Create or confirm two separate admin accounts and document a recovery route that does not depend on the same device or factor as the main account, without placing any secret in the chatbot.
   3. Paste the prepared details and the copyable prompt into a chatbot, then ask it to produce instructions only for the named provider and to identify any missing information before giving rollout steps.
   4. In the provider's admin console, compare each proposed menu and setting with the current official documentation, then configure a pilot policy for a small group rather than enforcing MFA for everyone immediately.
   5. Enrol the pilot users and test normal sign-in, a failed second-factor attempt, a new device, lost-device recovery, admin access, integrations and any documented emergency account while recording the outcome.
   6. Compare the test results with the AI-generated checklist and correct any missing exclusions, recovery routes or unprotected accounts before extending the policy to the remaining users.
   7. Send the drafted user message through your normal business channel, then enforce MFA in stages and keep the confirmed recovery procedure with your internal IT records.

   Prompt

   Help me plan and carry out a safe MFA rollout for a UK business. Do not ask for or accept passwords, one-time codes, recovery codes, private keys, customer data or screenshots containing secrets. Work from these details only:
   
   Identity provider or admin service: [name]
   Applications that need MFA: [names]
   Number and type of user groups: [groups]
   Available second factors: [authenticator app, security key, passkey, SMS or other]
   Devices users have: [devices]
   Current MFA status: [what is already enabled]
   Business constraints: [working hours, remote staff, shared accounts, accessibility needs]
   Existing recovery and break-glass arrangements: [description, without secrets]
   
   Give me:
   1. A provider-specific sequence of admin-console steps, clearly separating settings that enforce MFA from settings that merely allow it.
   2. A pilot plan for a small user group, including a test account and a documented rollback or recovery route.
   3. A checklist covering enrolment, sign-in, lost-device recovery, admin accounts, service accounts, integrations, exclusions and emergency access.
   4. A list of checks I must perform in the live admin console because you cannot see it.
   5. A short user message explaining the change in plain UK English.
   6. Stop and ask a question whenever the provider, setting or consequence is uncertain. Never invent menu names or claim that MFA is enabled unless I have confirmed it.

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.