We're trying to improve Microsoft Entra MFA adoption across a large frontline workforce in retail and K–12 environments, but enrollment rates are very low. Many employees primarily use phones, scanners, or point-of-sale devices rather than company-issued computers, and some struggle even with highly detailed step-by-step guides that include screenshots and QR codes. We've also had people download paid apps costing $70–$90 because they selected the wrong authenticator. For organizations with roughly 20,000 or more frontline workers, what processes, tools, or enrollment methods have made MFA setup easier and more reliable?
4 Answers
For this type of workforce, assisted enrollment is usually more effective than better documentation alone. Run short group onboarding sessions at each site, and train a few local supervisors or experienced employees to help others before tickets reach IT. New hires can complete enrollment as part of their first-day process, with someone present to verify that they installed the official authenticator rather than a paid lookalike app.
There probably isn’t a magic self-service workflow for users who rarely use a computer. Make enrollment a required, supervised step during onboarding or badge activation instead of asking people to do it later. Keep the instructions limited to the exact official app name, a direct store link or managed QR code, and a few large screenshots. Local “MFA helpers” at each location can handle the routine cases and escalate only exceptions.
Certificate-based authentication can work very well for managed, one-to-one devices because the user doesn’t have to configure MFA manually. It’s less useful here if employees are signing in on shared or unmanaged devices, since those scenarios may still require an authenticator app or another phishing-resistant method. The best approach may be different controls for managed school devices versus retail and shared-device users.
For a workforce of 20,000-plus people who mainly use phones, scanners, and POS systems, hardware-based authentication may be worth evaluating. FIDO2 security keys or badges can remove the app-installation problem, but they introduce provisioning, replacement, PIN, recovery, and device-compatibility challenges. I’d pilot them with one subgroup first rather than making them the default immediately.
That seems to be the direction we’re considering too. Getting site leaders to consistently own the process is probably harder than creating the instructions, though.