How do you handle MFA for consultants who may change from week to week?

I’d keep the rule simple: one person, one account, their own MFA. Ask the consulting firm to provide a named contact who can confirm each person’s identity and access need. A short request form and a clear turnaround target can make onboarding much less painful, even across time zones.

Set access to the minimum systems and duration needed, then disable it when the work is done. That gives you a useful record if something goes wrong, which a generic account can’t provide.

If the consultant firm can manage its own identities, ask whether your remote access system can accept their identity provider. Each consultant would still sign in with their own account, while your side can require MFA before allowing access. Check whether your ERP and remote access setup support this, and confirm the arrangement with your insurer before relying on it.

Federation can reduce the account-by-account admin, but it doesn’t remove the need to know which people are authorized or what they can reach. Keep access scoped and make sure sign-ins can be traced to an individual.

For an older system that can’t handle individual logins, a managed access gateway or jump host may help. Give each consultant an individual account to reach it, and use its controls and logs to limit and track sessions. That’s not automatically equivalent to named accounts inside the ERP, though, so treat it as a workaround to review with your security team and insurer, not a shortcut around the MFA requirement.