Plan the full access journey
Confirm the available authentication methods for your deployment and decide which users require additional verification. Explain enrolment and recovery before staff begin using the system. Review session behaviour on shared devices and how people end a session when their work is finished. Administrators need appropriate controls for account changes, particularly where a role can manage users, export information or alter configuration.
Make recovery a controlled process
A lost device or changed email address should not lead to an informal bypass of the account checks. Agree who verifies a recovery request and what evidence is appropriate, without asking users to send passwords or verification codes through ordinary messages. Review account activity and permission changes alongside the access controls. Two-factor authentication reduces particular risks, but it does not replace careful permissions, device security or staff awareness.