Set up two-factor authentication

I need everyone on engineering transitioned to two-factor authentication by Friday. Audit who hasn’t enrolled, send a direct message to each lagging engineer with setup steps, and escalate to their manager if they don't enroll within 48 hours. Confirm enrollment for any contractors are enforced the same way.

Before I push this to the team, make the 2FA enrollment easy: put the one-sentence business reason up front, list supported authenticator apps in order of reliability, give step-by-step enrollment for phone and for security key, and highlight common failure points (lost phone, company account on personal device) with immediate fixes. Flag who will need manager backup to enforce compliance.

I notified the team about mandatory two-factor by Friday and Marco replied he can’t enroll because his work phone is locked down and IT won’t install an authenticator. I don’t want to single him out publicly, and I’m afraid he’ll miss the deadline and leave a hole in coverage. What’s the best next step to get Marco compliant without escalating to HR — a temporary exception, IT intervention, or providing a hardware token?

Every rollout of two-factor stalls among specific teams where managers don’t follow up. That leaves security gaps and forces emergency escalations. How should I change the process so managers are accountable and enrollment actually completes on schedule — what standard message, deadline enforcement, and reporting cadence will stop this recurring delay?