Enable two-factor authentication

I need to lock down my account. Send an email to my team saying I enabled two-factor authentication and what changes they must make. Tell them to expect a prompt on their phones, to use an authenticator app not SMS, and to bring their backup codes to Friday’s shift handover. Sign off as Jordan, IT lead.

Before I roll this out org-wide, make the instructions impossible to misread: put the step to install an authenticator app first, show the exact screen text they should accept, call out that SMS is deprecated, and list troubleshooting steps for older phones that won’t show the prompt.

I flipped two-factor on for support and half the reps report they aren’t getting prompts on their phones. I don’t know if it’s carrier SMS blocking, misconfigured authenticator apps, or that they never saved backup codes. What’s the most likely cause for mass failure and what immediate steps get us back to handling tickets without a security rollback?

We enable two-factor, several people get locked out, and I spend hours resetting accounts. Over the last six rollouts, which habit should I change so the next rollout doesn’t cost a day of productivity—immediate pre-checks, communication phrasing, or a temporary grace policy—and exactly how to run that change the week before activation?