How an 18-Person Wealth Management Firm Moved Every User to Microsoft Authenticator
Every user on push notifications, text-message codes retired, and one-on-one support for the staff who wanted it.
Summary: An 18-person wealth management firm in Evanston relied on text-message codes to verify sign-ins, and only a few users had Microsoft Authenticator set up. Microsoft’s MFA changes, CIO Landing’s minimum security standard, and the firm’s cyber insurance recommendations all pointed to the same fix. CIO Landing planned and ran the move to Authenticator push notifications. All 18 users are now enrolled, and text and voice sign-in methods are turned off.
At a glance
| Client | 18-person wealth management firm, Evanston, IL |
| Starting point | Most users verifying sign-ins with text-message codes |
| Drivers | Microsoft MFA changes, CIO Landing minimum standard, cyber insurance recommendations |
| Solution | Phased rollout of Authenticator push notifications with remote and onsite support |
| Result | 18 of 18 users enrolled; text and voice methods removed |
The challenge
Text-message codes are one of the weakest forms of multi-factor authentication. Attackers can intercept them or redirect a phone number to a device they control. Microsoft is moving tenants off legacy MFA settings, and the firm’s cyber insurer recommended stronger sign-in methods. Text codes also fell below the minimum standard CIO Landing sets for every client.
Leadership had two concerns. They did not want sign-in problems to interrupt client work. They also worried that less tech-savvy staff could not complete the setup alone.
What we did
Assessment. We reviewed MFA registration for every user and flagged special cases: shared mailboxes, service accounts, remote users, older phones, and staff who would want extra attention.
Configuration. We set up the Authentication Methods policy in Microsoft 365 and updated Conditional Access policies and exclusions.
Pilot. The firm’s point of contact and a small group enrolled first, with our team guiding them remotely.
Rollout. Every user received a quick-start guide. We then held an onsite day for local staff and followed up one by one with remote users who had not enrolled.
Cleanup. Once every user was enrolled, we removed text and voice methods and confirmed the result in Microsoft’s registration reports.
What got in the way, and how we handled it
- Outdated methods: Some users had outdated sign-in methods that we had to reset before they could re-enroll.
- Lost or replaced phones: We issued Temporary Access Passes so those users could sign in and register a new device.
- Number matching: Some users were unsure what the number-matching prompt meant. We walked them through it and explained why you never approve a prompt you did not start.
- Remote and traveling staff: We scheduled remote sessions around their calendars.
The results
- All 18 users enrolled in Authenticator push notifications.
- Text and voice sign-in methods removed.
- About half the team received one-on-one support. On the onsite day, we logged users out and had them sign back in to every system they use, on their own, with our team beside them.
- Sign-in security now meets CIO Landing’s minimum standard and the firm’s cyber insurance recommendations.
Every company has people who are uneasy with new technology. They need more time, and they get it from us.
What’s next
The firm’s next steps are passkey sign-in through Authenticator and regular reviews of authentication methods.
Still using text-message codes?
CIO Landing can review your MFA setup and plan a move to Authenticator. Call (312) 858-8886.