Our organization is trying to improve MFA adoption among more than 20,000 frontline retail workers, as well as users in K–12 environments. Most employees do not receive company-issued computers; they primarily use personal phones, scanners, badges, or point-of-sale systems. We have created detailed instructions with screenshots, pictographs, and QR codes, but many users still download the wrong authenticator app—some have even paid for unofficial apps.
What processes, tools, or enrollment methods have worked well for users who need very simple, highly guided instructions? We're especially interested in approaches that reduce help-desk involvement, such as group onboarding, local site champions, passwordless authentication, FIDO2 badges, or other ways to make MFA practical for a large frontline workforce.
4 Answers
There probably isn’t a completely self-service solution for this audience. The approaches that tend to work best are short in-person or phone-assisted enrollment sessions, ideally done in groups during onboarding. It also helps to train a few trusted employees at each location so they can assist coworkers before everything reaches IT.
Passwordless authentication can simplify the sign-in experience, but it doesn’t remove the initial enrollment problem. If workers already use badges, FIDO2 security keys or badge-based credentials could be a good long-term direction, especially for shared or frontline devices. The tradeoff is the operational change: issuing, replacing, recovering, and supporting the credentials requires a solid process.
FIDO2 badges are one of the options I’m considering. The technology looks promising, but coordinating the rollout across another organization would be a significant process change.
For a workforce this large, I’d make enrollment part of the onboarding process rather than treating it as documentation that users complete later. Have a facilitator walk everyone through the official app download and registration, verify that the setup succeeded, and provide a very clear visual card showing the exact app name and publisher. A managed enrollment link or QR code that opens the official app store listing can also reduce people choosing lookalike paid apps.
A verification step is important. We’ve found that simply handing someone instructions doesn’t confirm that MFA is actually working when they leave the session.
Certificate-based authentication works well for managed, one-to-one devices because the certificate can be installed during provisioning and the user doesn’t have to configure MFA manually. It won’t solve every scenario, though. Users signing in from personal or otherwise unmanaged devices will still need an authenticator app or another phishing-resistant method.
That matches what we’re seeing. Getting site leaders to consistently support the process is difficult, but local enrollment champions may be the most realistic way to scale it.