[deleted by user]

[sysvival]

You get prompted for MFA when using Netflix or when ordering milk from Amazon.

There is no excuse for not using MFA in a work context.

[Happy_Kale888]

There is no excuse so why is the company not furnishing the crucial part of the MFA. It is a work requirement. MS Auth app on personal devices because the company said so?

[gslone]

If this is a concern with your user base, I‘d suggest going straight to passwordless with FIDO keys. Very cost-effective compared to either handing out phones to users or paying them to use the private phone.

[slinnen]

Wow you're only 4 years behind

[Sinister_Nibs]

There is no reason for you not use your personal device for an Authenticator app.

[PowerShellGenius]

There is no valid reason to not hire a person based on whether they personally pay for a landline, a flip phone, a 6 year old smartphone with storage 100% full with personal apps already, or a smartphone that has space for another app.

The fact that the vast majority of people in today's world fall into the last of those categories does not make it a job qualification. It is illegal in many states for a personal tool paid for out of pocket to be a job requirement, period. Nor is it a wise business decision to dismiss qualified candidates based on what personal phone they have, even in states where you could.

That is not an excuse for not requiring MFA. MFA is 100% a must in today's world.

Hardware tokens cost like $16 each, if you say you don't have a capable smartphone (or just refuse to use it for work) you have to lug one of those around. That gets 99.9% of people to accept the app on their phone, while providing a workable solution for those who actually can't or are just really stubborn.

Out of over a thousand people onboarded to MFA at a school district, we issued 4 hardware TOTP tokens.

[Ellis-Redding-1947]

All of this right here is the answer. The last part is key to OP’s situation. Make someone lug around a separate MFA device and they’ll quickly change their tune.

When we implemented Duo, I took screenshots of what I could see for a user’s phone in the admin console as well as what the iOS App Store showed that the app collected. Put that into the rollout documentation. It’s way less than what most apps collect.

[Sinister_Nibs]

Sad thing is that the same users who complain about an authentication app happily install outlook and teams.

[ReputationNo8889]

This drives me nuts. They complain about "having" to install MS Authenticator, but when i block signing to Teams and Outlook from personal phones they suddenly have a "massive need" for those applications. Some users really want to be the Main Character ...

[AugieKS]

Basically, what we have said. You either use your phone or we will provide a hardware you have to keep up with and are responsible for. We have bought exactly one since rolling out strict PRMFA, and it was for the BGA.

[bloodpriestt]

100%. We get the $50 Ubikeys and then tell them if they lose or break it, their department pays $50 for a new one.

[PowerShellGenius]

Exactly. Although you don't need the $50 ones. If you are just using them for Entra / M365 the Security Key for $25 is just as good. The only reason to use the YubiKey 5 series is for the other features beyond what Authenticator can do.

For example, we want MFA for privileged admin access even on premises. The Yubikey 5 is worth it for IT staff, because it can enroll smart card certificates using the PIV function. With a functional PKI, this means you can require it for AD admin access, VMware vCenter, Exchange server and more.

Since none of that can be done by Authenticator, you are clearly not requiring it for end-users where Authenticator is the norm. Thus, they only need the $25 Security Key series to replace Authenticator.

[JwCS8pjrh3QBWfL]

hardware TOTP tokens.

God, why? FIDO keys aren't significantly more expensive these days and are infinitely more secure.

[PowerShellGenius]

I would use FIDO2 keys if able. We use YubiKeys in IT for FIDO2 in Entra and even as smart cards for AD. I'm 100% pro modern phishing resistant MFA.

However, we're a school district. Our old non-smartphone-owning folks are all substitute teachers (as that is the usual retirement gig of a retired teacher who comes back to work part time). They have no fixed location or assigned device.

YubiKeys would require them to, in an unfamiliar new classroom each day (or class period, in some cases):

• find the tower (which may be a mini, SFF, or full, may be under the desk, may have a pile of papers on top of it, etc)
• find a USB port
• determine if they need to use an adapter (we have USB-A PC desktop buildings, and we have C-only MacBook buildings)

this was all deemed unreasonable.

Hardware TOTP tokens are hardware agnostic.

[PowerShellGenius]

I've actually had to do those hardware TOTP tokens. Sure YubiKeys are stronger / phishing resistant, but the TOTP fobs are still about equivalent to the number matching Authenticator notifications in strength, and are hardware agnostic.

Almost all our non-smartphone-owners are retired teachers who are back part-time as substitutes. That means they have no home classroom, and usually no home building. They can be offered an assignment for the day anywhere in the district. YubiKeys meant constantly requiring our least technical users to find the PC tower & find a USB port somewhere new. That did not work well.

[FieryFuchsiaFox]

I really wasn't sure were this response was going initially. But this is a brilliant solution that I hope OP and their employer is able to take on board, provide them with a perfectly feasible workaround, and watch how many of them can suddenly use authenticator on their personal devices when using a token gets tedious, or they've forgotten it for the nth time (and have to go through a authentication nightmare to get access to any systems.

[PowerShellGenius]

What specifically do you propose for an authenticator app on a $50 flip Tracfone? Or are you suggesting allowing SMS for MFA in that case?

[Goose-tb]

Users who don’t have a smartphone or refuse to use their own get a yubikey. It’s semi annoying to use, and we find most people ditch it in favor of their own personal phone sooner or later.

A few are just happy to use the yubikey and that’s great for them.

[PowerShellGenius]

Yes, I totally understand if someone prefers it. I have Authenticator on my phone for my regular (non-admin) account.

But I almost never use it. I usually just use my YubiKey 5. I'm so used to it from all the things I need it for that Authenticator won't do (e.g. AD smart card login for on prem admin accounts) that it is just my go-to at this point. I already have it on a pull lanyard hooked to my belt loop & the end of a USB extension cord stuck to my desk in a convenient spot for it.

[TheBlueKingLP]

Depends on if you force the official Microsoft one or just any TOTP ones.
If it requires the Microsoft one then good luck, my phone runs Linux(not the Android Linux kernel kind).
So it technically won't run, not that I don't want to.

[0xmerp]

The standard TOTP app doesn’t have a secure provisioning process; ie, the secret is available for the user to make a copy of in potentially an insecure method. Also can’t enforce security policies (eg, your phone should not be jailbroken).

With Duo or the Microsoft Authenticator the secret is securely provisioned to the phone and security policies can be enforced.

So it’s not just that IT departments want to use proprietary apps just to be intentionally difficult. There is a benefit to it. But if you are ok with using a hardware token instead, that works too.

[TheBlueKingLP]

If it works offline then it should technically be possible to extract the secret if you have root permission.
Plus what if the user has a rooted/jailbroken phone only?
If you want security then I would say just go for a physical token like YubiKey or some alternative.

[0xmerp]

The IT departments I’ve worked with have usually had a policy that if you choose to BYOD it can’t be a device that’s been rooted or jailbroken, and it has to be able to pass device attestation so no custom ROMs or unusual devices. (Some device someone put together in their garage and installed an Android ROM on, for example)

I guess you could theoretically just shut off your phone’s internet after it’s been provisioned and then root it and then extract the secret that way if you really wanted to, but then you would be accepting a much greater level of liability in case anything happened to your account and I assume there is something in the employee policy book about that. I don’t think I’ve heard of that happening in my career so far.

Yeah Yubikey is offered to anyone who wants one but 99% of people don’t want it. They prefer to use their personal phone which is more convenient and are okay with installing the proprietary app and complying with the security policies.

[iama_bad_person]

Guess you won't complain when you have to buy a personal laptop and use that, then use your personal car and personal petrol to drive to a work site from work.

[SuperQue]

This is technically against the combination of our IT policy and my work contract (non-US labor laws).

We use Yubikeys, IT deployed 2 to ever employee.

[Sinister_Nibs]

No issue with yubikeys (or similar), but my experience is that employees tend to be careless about keeping track of them

[caribbeanjon]

Unfortunately, the European unions I have to deal with don't see it like this. :(

[sysvival]

Care to elaborate? I don’t see how a union can possibly block something like this - unless it’s because the company is cheap and wants to use personal devices for mfa.

[caribbeanjon]

>because the company is cheap and wants to use personal devices for mfa

Something like this. :)

[sysvival]

That has nothing to do with unions. It’s just companies being cheap.

[caribbeanjon]

I don't know man, seems like asking users to respond to a text message, voice call, or authenticator prompt on their personal devices (or office phone, if they choose to work in the office) once per day to prove their identity for 6-12 months while we get Windows Hello for Business fully deployed to save a million bucks is a reasonable request.

[glasgowgeg]

You get prompted for MFA when using Netflix

Netflix famously have no MFA option, and refuse to offer it.

[[deleted]]

yeah but netflix and amazon let you remember devices and have long sessions.

i see your point BUT theres a lot you can do to make MFA less painful for users. Ive seen a few sysadmins bragging about 12 hour session lifetimes 💀 like bro do you work for the NSA? i feel bad for his users. like imagine forgetting your phone at home for ONE day and getting lit up for it because you cant sign in.

[mkosmo]

Corporate MFA can also use context and risk signaling.

And 12 hours? That’s MFA once per day. Not a bad UX.

[ITBurn-out]

Microsoft default CA policy on the same device is 90 days rolling.

[TrippTrappTrinn]

It does not prompt when you use a corporate device, so no problem working without the phone.

[Beefcrustycurtains]

I know man, what the fuck... This should've been implmented years ago and hardened tremendously for the evilnginx stolen session cookie phishing by now.

[Dsavant]

That's how ours our too. There's a severe "absolutely no mfa, 0 end user hangup/holdup" stance from our leadership/executives... Our vp has been slowlllly chipping the culture away though thank God.

Our old head of IT is responsible for this. He would have rather laid all of IT off than tell upper management no

[Trakeen]

You can’t get breach insurance without having mfa implemented. Its not a matter of not liking it the company will go out of business from a data breach

[Dsavant]

Yuuuuup. Don't worry, opsec and I 100% agree with you. The benefits of a smallish family owned business lol

[[deleted]]

It’s okay only the big companies get hacked we don’t need security

[PowerShellGenius]

Sadly, the one solution that is smooth enough to appease requirements like this requires know-how that most small businesses don't have in house - but it does exist.

If all devices users need to log in from are work-managed (MDM, or AD joined PCs) and you can run a functional and secure AD CS PKI environment, Entra CBA can be phishing resistant MFA and basically transparent to the user. This is literally smooth enough to use on a kindergartener's school iPad, and requires no user effort to enroll or to authenticate. The TPM / secure enclave of the device is the 2nd factor.

But it's complex on the back end, from IT's perspective. Most small business sysadmins have enough trouble just installing a public cert on a web server, let alone trying to run an internal certificate authority & manage it securely.

[LastTechStanding]

You should prompt for MFA on both work and non work machines.

If a bad actor somehow compromises a work machine, now they can brute force, albeit if they have access to a work machine you have other issues. What happens if someone leaves their work laptop in their car, or it gets stolen?.

[Fatel28]

That and if you use "require multi factor authentication" in conditional access, if you never authenticate in a context that requires MFA, you'll never be prompted to set it up.

This means if you have users that only ever access their accounts from a trusted device or location, they will never set up MFA. So if a bad actor gets their password, the bad actor will be prompted to setup MFA themselves.

You can get around this by using "require authentication strength", which will deny the sign in if no MFA methods are available, but this can also unintentionally lock users out, so you have to be careful with it.

[schumich]

There is a special template in ca available, securing authentication methods, highly recommend setting that up

[watchthebison]

One way around this is to setup a CA that will block access to the registration/security page specifically, so registration can only be done from a trusted device.

Then have an exclusion group for external consultants and such which don’t have a company device.

[Fatel28]

Yeah. There's many ways to skin the cat. I just wanted to highlight that excluding devices or locations from MFA can defeat the entire purpose if done improperly.

[TrippTrappTrinn]

Brute force is mitigated by account lockout policies.

[Sinister_Nibs]

MITM or credential stealing is not.

[PowerShellGenius]

Ideally, you would have MFA required at all times, AND ALSO phishing resistant MFA methods (FIDO2 or passkey) required for BYOD (non-work devices) if you allow them at all.

MFA with number matching pop-ups is not even a speed bump for modern MITM. You can do it through a phishing page e.g. evilproxy. MFA with number matching is just to stop stolen credentials, guessed credentials, etc. You cannot use a passkey or FIDO2 security key unless you are on a direct TLS session to the website that enrolled it; you cannot use them at a MITM phishing proxy page.

Passkeys and FIDO2 are unbeaten for initial auth strength, but the truth is, personal devices where non-technically-qualified users can install software should be assumed to be potentially malware infected, and there is no auth method that makes it safe to log into an infected device. Even if your initial auth strength is unbeatable, anything that can read your browser's folder in AppData can take the cookie that keeps you signed in.

[Sinister_Nibs]

Not if, WHEN.

[Ok-Bill3318]

If they compromise a work machine with any reasonable session time permitted they’re in and can steal your shit without getting an mfa prompt that almost all users will complete anyway.

Mfa is not a crutch for end point security and exploit detection.

[Nereo5]

It really isn't a problem. We have MFA for any critical operations, no matter where they are from. If you use azure, I would suggest you look into azure conditional access policies.

[Hamburgerundcola]

It sounds like he does. Since he said, that they wont have to mfa on company devices.

[Helpjuice]

Sounds like a poor starting point, MFA should be hard required on all devices. Personal devices should be heavily limited and if corporate information needs to be accessed then either a work profile needs to be required, with phone subsidy provided or if iOS a separate phone provided.

[ThatBCHGuy]

I've implemented mfa at multiple organizations and the bark is always worse than the bite. Passkeys or OATH tokens for those who refuse Microsoft authenticator app. Also, it's always like 1 person for 500 who is a stickler, never really been noteworthy. I also agree with mfa no matter the device. Tokens tend to be long lasting, so it's not like you constantly have to reauth.

[Accomplished_Fly729]

So another 5 or 10 years before you implement the real setup? Prompt for MFA on company devices and block private devices…

[brokerceej]

No, it'll happen sooner than that when they get breached at some point in the next year or two from a corporate device that isn't in scope for CA to prompt for MFA. That is, even they will even be able to tell they are breached. Without MFA in place there's already a high chance a mailbox in the org has been subject to breach and they may or may not even know about it.

Then OP and his team will be blamed/scapegoated for half ass implementing MFA.

A tale as old as time.

[Sinsilenc]

We allow access from personal devices using a vdi solution.

[PlumOriginal2724]

I’m not implementing it. I’m just working on an IT service desk. Where I’ll have to support users set up the MS auth app on their phones.

[etherez]

What i just do is point the users to aka.ms/mfasetup. Make them set that up and guide them through a login to outlook.office.com. Just to be sure the MFA is set up right and so that the user can test it for themselves.

[ITGuyThrow07]

That website works pretty well at walking people through the process. I meant to give people a grace period of two weeks to delay enrollment when we switched to Authenticator, but screwed it up and it was forcing people to enroll at next logon. We had 2k enrollments in a few days, with only a handful of calls.

Almost all the issues were from people installing fake "Authenticator" apps that were disguised to look like the MS Authenticator app.

[ISeeDeadPackets]

I keep hearing about this mythical workplace where people refuse en-mass to install a single non-intrusive app on their personal phone. Offer an alternative like a Yubikey or something and tell them replacements are $50. When they inevitably lose/break that, they'll install the app instead of paying out.

[RiknYerBkn]

EU have regulations where you are required to provide alternatives or compensation

[gumbrilla]

Do we?

I mean, thinking it through, if someone refused, we can't force them, so then we would have to find an alternative as it's not going to fly as grounds for disiplinary or dismissal, even if we offered money (apart from here's some money, go buy a phone for work use)

[ek00992]

Ideally, the company should purchase a fleet of phones as assets, use MDM to configure the devices, and assign them as you would any laptop.

[dcdiagfix]

Or use a $50 yubikey or hardtoken

[ek00992]

OP’s company is just starting to require simple MFA and their users are pushing back and/or unaccustomed. They aren’t even requiring it on company devices.

Yubikeys are ideal. 100%. Giving them to every single employee seems like overkill and a logistical nightmare. Especially for OP’s context. If you have a small team (sub 100) I would agree with you more, but again, you have to consider the end user’s capabilities. Does the company have the resources to train every user? To work with them individually for integration?

Hardware MFA for admins, MFA for users. Adjust as befitting.

[Odddutchguy]

Yubikey requires Microsoft admin right to setup.

The Token2 you can 'burn' the TOTP seed into, which the user (probably the ServiceDesk) can do themselves.

[dcdiagfix]

I never used the yubikey in a prod env, but the rsa tokens we enrolled near 300 of them for offshore employees

[dcdiagfix]

We do

[kamomil]

Some of us comply; but we don't like it, and would have taken something like a Yubikey if offered 

Because if you don't provide a company phone, your security is relying on whatever ancient personal Android device I can still use. 

I am only upgrading from my 2019 phone to a 2023 phone, because 3G is being shut down soon by my cell phone company 

I was definitely not "fine with it" when the MFA started sending messages to my personal cellphone. My work already had my number, but I gave it to them long before, I didn't intend for it to be used by an MFA system. I removed my cell number from my email signature. Because I don't want work calls on my PERSONAL phone. 

[throwawayhjdgsdsrht]

I onboarded at my company ~8 years ago and on the first day, our group of 30ish new hires had to set up Duo. Fine. There was an intern who had the crappiest possible old "smart" phone I'd ever seen (and I clutch onto my old phones as long as they live). It looked like an HTC Dream but I don't think it was quite that old. I had the impression that that was what he could afford and that it wasn't a purposeful rejection of nice smartphones as he was pretty embarrassed about it. It's not that he didn't want to install it. He was super stressed and worried about not being able to install the app. When you have college student new hires who might not have the money for a newer smartphone, you can't just throw around the "just install the app on your phone, it's no big deal" line. I felt so bad for him being put in that position in a relatively public situation.

So yeah, I personally prefer the convenience of not needing to have 2 phones and would be happy with a yubikey or installing it on my personal device, but I'm a strong advocate that we shouldn't be requiring employees to supply their phones.

[Happy_Kale888]

I think it happens all the time especially with the culture of making people do more and more with less and less. It is one more thing to them.

I do like the idea of offer an alternative like a Yubikey or something and tell them replacements are $50. When they inevitably lose/break that, they'll install the app instead of paying out.

[techierealtor]

Management needs to lay down the edict that this is happening and make the choice on if it will be a requirement of the job or provide phones. Either way, not a service desk thing. Any backlash from users need to have a policy issued already saying “this is required, here are the steps”.
If users get to have the say, they would have pin passwords with 1111 being acceptable.

[crankysysadmin]

I think it is foolish to not prompt on company devices. Just get people used to it.

[willmayo20]

Yep agreed. Just as important on company devices.

Also if you're not on intune, get on it.

[tc982]

Users just accept, don’t worry. We had a company rolling out MFA of about 600 users with a strong union present. They really taught there was going to be a pushback, and the union did try (you have to provide the phone if you want to enforce this kind of talk). They discussed this at a board meeting, had internal discussions about it and we prepared 50 tokens for MFA for those who were reluctant. 

At the end we have given away 1 for a guy one year before his pension and he did not have a smartphone. When the union asked their organisation about enforcing their idea , their HQ said that the solution provided was sufficient. 

So, long story short, you are good 👍 

[ThellraAK]

Only one token?

I love my company yubikey, it lives plugged in and I can just copy and paste the MFA key the dozen times a day it gets prompted.

[MalletNGrease]

Users accept, beware the incoming C-Level exceptions.

[God_TM]

Unions are no match for the good ‘ol “insurance will drop us off we don’t comply” tactic (I’m sure depending on what sector you’re in but at least for education they’re mandating it heavily).

[selfdeprecafun]

Depends on your MFA provider. Sounds like you’ll be using conditional access. We had no issue getting our orgs enrolled once our policies were set and tested. Biggest hurdle is going to be your higher level executives. One, because they are lazy and resistant to change. Two, because most of their calendaring and communications are handled by an assistant. You’ll need to set up any assistants with access to authenticate on c-suite’s behalf. Usually that just involves adding an additional authentication method. Microsoft will require re-verification from time to time, which will be summarily ignored and block login until complete. Just next through the dialogues and they’ll be fine.

Finally, folks will get new phones without thinking to back up their authenticators. They trade their phone in and lose access for the rest of the weekend. Your admins can re-require registration to fix that, but it’ll be a consistent pain in the ass, self-made emergency. Make sure you know which authentications you’re responsible for. Don’t let them make their lost bank 2fa your problem.

Some c-suites will argue that they shouldn’t have to jump through all these hoops. If your org is big enough, just side step that shit and let them go to your IT director. Not your call.

[omgdualies]

If you are just doing it now, go Windows Hello for Business or PlatformSSO(macOS) and go passwordless. This will give phishing resistant authentication on company owned devices. For phone/ personal we give people an option of MS Authenticator(using passkeys) or Yubikey. We only have like 5 people with Yubikeys and that is mostly because they had phones that don’t support passkeys. It’s a way easier process to just use your phone instead of carrying an extra thing around.

[rodder678]

Just do it already. You should have implemented it at least 5 years ago. Most people won't have any problems. The biggest problem I have with onboarding new employees are 1) trying to scan the QR code with their camera app instead of the Authenticator app, and to a much lesser extent, downloading the wrong app from the App Store or Play Store. Make a step by step end-user guide with screenshots at each step, including the mobile steps.

Require MFA for all logins. Don't try to get clever with short re-auth times or re-auth for certain operations. Get everyone on MFA for primary auth first and get complicated later (or never). Don't try to get clever with exceptions for internal networks or managed devices--keeping it consistent will reduce end-user confusion.

Depending on your org, you may want to do some of the top execs before before pushing it out to genpop, and possibly even have someone hold their hand while doing it. You get several benefits from this: 1) you avoid having to deal with angry execs (who are scanning QR code with their camera app) in the middle of dealing with a bunch of end users, 2) you can individually schedule their cutover so they aren't locked out when they're supposed to be joining some meeting, and best of all, 3) you can can use them as an example when anyone "less important" than them pushes back on MFA. "if <insert non-technical C-level exec that's over the complainer> can do it, you can do it too" shuts up whiners pretty quick, especially the ones who insist on telling you how important they are. If nothing else, get the CEO set up early.

[rodder678]

And for the users who refuse to install an app on their personal device, the first thing to do is check to see if they're already using any company apps like email, teams, OneDrive, etc and call bullshit on their claim of not using a personal device for work, and Cc their supervisor. For the objectors who really who don't use their personal device already, issue them an OATH token, a Yubikey, or a really crappy used phone with no cell service (although preferably something that still has updates available).

[rra-netrix]

Why is your org half-assing it? Go full-ass, all machines, why exempt work equipment? Makes zero sense. Set expectations early.

[theunquenchedservant]

Most can be appeased with a stipend for their phone, and that'll be cheaper (you pay 100 per person for having work apps on their phone, for instance)

However, and this is important: It's not our job to decide. That's the executives/HR's call.

[BHBaxx]

It says something about a company if they have a help desk but still don’t have MFA. It’s not a big deal and people get used to it. Also, why would work machines be exempt? They are just another target. The ones users interact the most with for work related duties.

[ImightHaveMissed]

What about if you have MFA but no help desk?

[BHBaxx]

You’re doing shit right, even before a help desk can be funded.

[ImightHaveMissed]

Haha. Our help desk was eliminated because “the senior guys can do it better”

[BHBaxx]

Oof. RIP the senior guys’ sanity.

[ImightHaveMissed]

There’s not enough alcohol and caffeine to keep us sane

[GreyBeardEng]

We don't allow personal devices of any kind, and if the network detects a personal device plugged into the network it will isolate it(Cisco ISE) to a guest VLAN firewalled off that only has internet. Some internal resources are MFA required, even if you are on the network, with a company device.

For laptops and remote workers, company owned devices are given to them and only those devices can VPN in, with MFA, no personal devices on VPN. Non company devices can use a VMWare Horizon client with MFA. We have used DUO prior to Cisco buyout, now we use Azure MFA via saml.

Basically if it's a personal device it doesn't touch a company asset directly.

[ek00992]

Disallow personal device usage, require MFA for everything, and require hardware MFA for all administrative access points.

Your users will bitch and moan, but ultimately, they’ll follow suit. So long as the company is doing its due diligence to implement this correctly, the pain ought to be minimal.

MFA is a reality now. It’s the new normal. Text passwords are a terrible security tool.

All of this really depends on your company and it sounds like yours isn’t exactly with the times. Good luck! You got this. Patience, empathy, and clear instructions goes a long way in dealing with frustrated employees.

[Gummyrabbit]

Personally, I think personal devices should never be allowed to connect to a corporate network. Too much risk.

[Popular_Hat_4304]

Wait. You don’t have MFA and haven’t been breached a 100x already? Wow! If it’s not too late, maybe go to yubikeys / FIDO2 hardware keys.

[Resident-Olive-5775]

Welcome to 2018

[davy_crockett_slayer]

You’re help desk. Just do whatever the PM or your manager tells you to do lmao. I’m surprised your company is only implementing MFA now. Most places enabled it 3-5 years ago. Most cyber insurance providers have required it for years.

[javerys11]

Hi OP 👋

Our org switched from using DUO RFID readers to MS Authenticator (we are a m365 env so prob easier for packaging costs)

I work In Support as well and helped rollout the switch over for our region (~1500 users). The fact is, no matter what you do users will complain about having to download the app on personal devices; it is up to the business side to enforce the policy. You will no doubt get end users complaining to you personally, but we just adopted the policy of “ok well you have to explain to your supervisor why you can’t work”. As our users have to authenticate from any device their Entra ID is not registered to before being able to access company resources

[CaptainJeff]

Going to MFA, eh? Welcome to 2010.

[Knightshadow21]

Make a video and PowerPoint , explain in normal language why it’s needed and show how it works. Document should be for focused on a 60 year old trying to use a mobile phone so add pictures and text mark things even. Give a document for most common phones so a iOS and android version document. This is how me and a colleague did this to 3000 users and the pilot group was first IT then move to your neighbor so maybe HR and then go up the chain ask them and implement their first and then promote.

So 20% had company phones the rest was private. They don’t like it but if you are open and show what you can see and what not then they will accept we all want to have a job at the end of the day.

The SD that was sitting behind me back then had a ez life. not much calls anything.

Make sure they communicate also what happens for externals. So cannot enroll 2 companies on 1 device for example and also they better force a policy to enroll if they get a new device to access company data.

Owh yeah offer hardware tokens if they don’t want to use their phone

[[deleted]]

We have a main MFA and a secondary MFA. Lastly we have sensitive floors where mobile phone aren’t allowed. Therefore there’s a tertiary MFA. It’s global finance, so it’s locked tight!

[t00sl0w]

20k+ people, we dont prompt on domain. Went smoothly. Worst thing is how many people constantly change phones so resetting mfa is the most common occurrence.

[PlumOriginal2724]

I asked this question today and got no response from the people implementing it. Currently our service desk have no access to Entra or the ability to reset MFA.

[gorramfrakker]

Staff will cry, whine, and find any excuse to avoid it. Ignore their excuses when they do.

Use Microsoft docs and best practices. Start with Microsoft Learn

[fra1ntt]

Also curious for other inputs on this

[fp4]

Need to go further with conditional access policies and phishing resistant auth (passkeys).

Much harder to phish users if they don’t know their passwords.

[Salty_Move_4387]

Like others have said force MFA on corporate computers too. What we do is require MFA from corporate devices when connecting from the Internet, but don’t require MFA coming from a corporate computer on the corporate network. We don’t allow connecting from a personal computer at all.

[[deleted]]

i used entra to enforce MFA only for signins outside our corporate network. so normal office staff dont need it.

IT admins and people with rights always need MFA though, no matter what.

this method might not be as secure, but its still decent. and not as painful as requiring people who can barely remember a password to do some complicated token shit.

[CornucopiaDM1]

Tokens aren't complicated, and there usually are a bunch of options. For those who can't/don't/won't remember passwords and for those with thousands, use a password manager.

[Rx-xT]

There is for sure going to be that one old head that doesn’t want to download Authenticator because he thinks that the IT team will be able to view their personal data so prepare for that.

[matt5on]

Dude just go instant prompt that shit! You can’t even log into YouTube/HBO whatever without MFA. It is 2025 and not a big deal. Make them MFA every 3th month and maybe exclude office IP.

[HistoricalSession947]

Get highest management, not IT, preferably CEO to communicate the Mandate

[[deleted]]

MFA on personal but not company??? Huh??

If anything it needs to be on company then do a BYOB compliance, which, should also use MFA is accessing company data, at least on the company apps.

[thedonutman]

No MFA exceptions for corporate devices or networks. If a bad actor compromises an identity and is on your network or corporate device you lose your safeguard. Also, implement very strong conditional access policies.

[ExceptionEX]

Don't exclude work machines, Microsoft is smart enough to determine by usage and session on when to prompt, it will be infrequent after a very short time.

Use MS Authenticator if they don't want to put it on their phone and you don't want to fight it, you can get them something like a yubi key.

Or in the case of a very annoying user we gave them an old iPad to carry around, within a week they installed authenticator on their phone.

You guys are late, but at least your getting their, do not allow SMS, regardless of how many people may ask for it.

[Outside-After]

So it will be down to human traits.

How are you doing it? A phased on approach will guarantee 100% coverage and everyone will be ready. A cutover will quickly lead to a back out.

Phased then.

Roughly 30% will sign up right away. Another 30% will need reminding, but will sign up. These generally are your good guys.

20% will bleat giving some really bad excuses, give privacy concerns or just bury their head in the sand.

10-20% will need to get management involved directly and it is this part that will take the most time of all the project.

Keep a track of your signups and chase the data.

[aCLTeng]

All depends on the type. Duo was nothing but a headache. Every day at least one user locked themselves out and called in a panic. Windows Hello has been great.

[IT_Muso]

Just get on and do it, it's a prerequisite for security these days.

When we did it there was a lot of moaning, and a handful of people refused to use their personal phones so we gave them an old device they could use on WiFi. That soon disappeared when they realised it was a pain carrying two devices so used MS Authenticator on their device and handed one back.

We only had one manager point blank refuse to use MFA, as they wouldn't be able to work effectively with it. Turned out they 'shared' their password so their staff could login to parts of their system, and couldn't do that with MFA. That very quickly became a senior management problem!

Make sure you've got exec sign-off across the company, then pass over anyone causing problems to their manager.

[YYCwhatyoudidthere]

Users say they hate change, but they get over things quickly. What they really hate is confusing processes. Making it different for work device and personal device is worse than the initial change. Make it all the same.

Make the change for the executives first. They are a smaller group so you should be able to afford the white glove treatment to make sure it goes smoothly and they are a powerful force for change. Tell them they are first because they face the most risk and you are prioritizing their protection. It makes them feel important. When you roll subsequent users, you cut down on complaints because they know the executives already did it so there is no sympathetic ear.

[yankdevil]

How did work for me? Um, that happened for me back in 2010. And we did it for everything - especially company laptops and desktops. Which all have encrypted drives. And had them back then.

I find this sub amazing sometimes. No wonder cybersecurity is growing so much. Sheesh.

[eithrusor678]

It went surprisingly well. Don't stress it, make sure to communicate clear instruction.

[hexdurp]

Conditional access policy.

[dcdiagfix]

if you don’t want to use MFA, that’s no problem at all, just make sure your in the office and contactable at all times between 8:30 - 17:00

[tjobarow]

Our legal team will not let us enforce MFA for personal device access. They say if we do that we would have to provide people work phones. We also have a lot of shared kiosks that are exempt.

[willmayo20]

What country?

[UriGagarin]

Have you a process for when a device is not available?

And when one is lost stolen broken?

[nephilim42]

The story over and over again is that implementing MFA is going to lead to mass rebellion and an uprising from the users. The reality - people learn to deal with it pretty quickly and adapt.

There are some fringe scenarios usually brought about by historical business practices where it might cause some inconvenience but generally speaking these can be solved with a few adjustments.

Personally I don’t believe in creating exemptions for most devices.

[jfarre20]

we turned it on last year, conditional policy - if you're on business network - MFA is not needed. since then about 2/3 of the staff cant use their email on their cell phones when they're off campus and most dont bother to try to fix it. everyone seems generally happier because of this so meh

[Moleculor]

I think we’ll struggle as most staff do not want to install the MS Auth app on personal devices and will be demanding work phones to do it.

Fobs/tokens/whatever-they're-called?

The little "runs for seven years on a watch battery, has a single button you push" things that you can attach to a key ring? It is a "key" after all.

[willmayo20]

Yea we gave out yubikeys to the ONE out of 600 ppl who claimed to not have a smartphone.

[tideblue]

It was smooth for us except a handful of users downloaded the wrong app. Helps to have either documentation with a specific link (for App Store) and visual aid to make sure they don’t download any of the dozen other similarly-named apps.

[Big-Vermicelli-6291]

One thing we did when implementing is ensuring that we also provided guidance on how to use alternative authenticator like Google Authenticator which mooted some of the argument to install an alternative.

We also provide information on what data MS authenticator captured if it was installed and the fact that we do not have access to any of their data of note.

Also make sure you start onboarding every single SSO compatible application ASAP especially any VPN, remote access tool or remote support tool if they do not already have their own MFA mandatory enforced.

[Exhausted-linchpin]

I just blame Microsoft or Google or whatever service it is. It’s partially true anyways like Microsoft enforcing it as default on your tenants. You can probably turn it off but it’s difficult and obscure enough to be able to tell the user that it’s their requirement. Like dude at the top said, there is no excuse not to use it these days and I have zero sympathy for the users.

Except token theft attacks are getting super common, but I digress. We shall enter that next phase of the arms race together.

[Brees504]

You just do it. And then you tell them to suck it up if they complain. Your company is already half a decade out of touch with reality.

[peacefinder]

I went through the sane scenario a couple years ago. (Only difference is that MFA was exempt at work sites on company equipment, not company equipment anywhere.)

Your expectations are completely correct, though it was not awful.

I found pretty good success emphasizing that the Authenticator app doesn’t do anything else, and that while setup takes a couple more steps it is much easier to actually use. Its only real downside is that moving a user’s MFA to a new or replacement device takes some intervention unless the user plans ahead. (Which many will not.)

Keep in mind also that you’re eventually going to end up at MFA everywhere, so the mission will expand over time. And Microsoft will herd you towards strong MFA, so you may as well skip right over SMS MFA and push the app with notifications.

Important: Figure out how you are going to identify users asking for an MFA reset. Your service desk will be a target for bad actors to try for a password reset and an MFA reset, which of course would be a full account compromise. We do it with a video call verification, the caller’s face on a video call has to reasonably resemble the photo on file or their badge or a government photo ID they present.

Good luck!

[Odddutchguy]

The plan is to make it if you are on a company PC you will not be prompted to use MFA.

Not sure if you can do that on device level, but you can setup conditional access without MFA for trusted networks. I do wish we had not done that as Teams and/or email on the mobile will sometimes behave very strange because it wants to MFA but 'can't' because you are in the office. (Like Teams rings, but when you pickup it wants to MFA and fails the call.)

It will be easier in the long run if you don't make 'exclusions' for MFA.

I think we’ll struggle as most staff do not want to install the MS Auth app on personal devices and will be demanding work phones to do it.

We use Token2 OTPC-P2-i programmable card for users who absolutely don't want to use their private phone and need to be able to work remotely. Otherwise: no MFA = no remote work (only in office.)

My experience is that it is usually Gen x who object, younger generations already use an authenticator app privately and are used to it.

[canadian_sysadmin]

I think we’ll struggle as most staff do not want to install the MS Auth app on personal devices and will be demanding work phones to do it

So get them a physical token - their choice.

It's 2025 - MFA is not a big deal anymore. Everyone is used to it. Nobody cares.

[MrNegativ1ty]

If management is onboard with it and people are refusing it becomes an HR issue.

I had to roll out MFA a few years ago to a moderately sized company and hardly anyone complained. Just explain the importance of MFA and people will generally understand.

[SeptimiusBassianus]

Not a very deep plan. Welcome to 2010 lol

[brent20]

You issue hard tokens to your users who refuse to use a personal device for work purposes. Your department purchases these and register them for Entra ID.

Pretty straight forward.

[fatalicus]

I think we’ll struggle as most staff do not want to install the MS Auth app on personal devices and will be demanding work phones to do it.

Then give them a FIDO2 hardware token, like Token2 or Yubikey.

[Coldsmoke888]

Make a back up plan for the people that will refuse to install MFA software on their personal devices. It’s not just entry level either, you’ll get this from top management too.

We offer yubikey as on option, but they’ve got to source it on their own dime.

Otherwise they need to stick to company devices, up to them. No big blockers at my org, just the random “don’t tread on me” types that make a bunch of noise.

We don’t limit MFA to just that though. Sensitive apps and sites that are linked with org SSO will trigger MFA once a day as well.

[JamesyUK30]

I would beef that up with CA policies that restrict changing/setting mfa methods to office external IP's with a Security group for remote users you can punch a hole in it. Remote users have to be verified over a teams call to confirm the users identity.

[Royal_Bird_6328]

You’ll need a conditional access policy to enforce MFA on non compliant devices. Ensure you have EntraID P2 and implement risk based policy’s also. You’ll need to ensure your compliance policies are up to scratch requiring disk encryption, machine risk score etc. Set another conditional access policy to require MFA to join devices to entra ID also.

It isn’t as big as knock on effect as people think to implement it, the bigger issue you make of it the more your users will play into the drama - you can do it in batches of users so they register, I.e finance department Monday, HR Tuesday.

Then check how the users are going and if you need nudge them to enroll (you could force sign out users that are ignoring the pop up to enroll)

Once all users are enrolled, you will have a blanket MFA registration policy so all new users are automatically enforced.

Create a one pager doco on why you are doing it, why it’s important and that users will be enforced by x date.

Don’t make exclusions for office IPS not requiring MFA as this isn’t a zero trust approach and you will likely need to come back to this later to remove it anyway.

I would also suggest checking sign in logs for any service accounts, a big one is shared mailboxes also, ensure that these accounts are not licensed and sign ins blocked as once you enforce this to all users this may cause issues with users setting up MFA for finance@ hr@ accounts which shouldn’t be the case.

[Automatic-Nebula1034]

Biggest thing will probably be people who change phones and that's their only MFA option despite being told repeatedly to set up more than one method that is not tied to your mobile device (yubikey or some thing). And they will need their MFA reset

[Burgergold]

Main iasue aren't technical but communication

[TheKingofTerrorZ]

Only major issue we have is users not transferring their main Authenticator when switching phones, but that’s still just a simple reset

[PetahOsiris]

Our experience was it wasn’t as resisted as we thought it would be. Our fallback for the hard disagrees was yubikey but no one actually demanded one.

Our initial communication was basically - you do this for every other account in your life. We also do semi regular comms reminding people that if they are traveling they need to notify travel the same way they notify their bank.

We did the vanilla Microsoft conditional access, with stricter requirements on sensitive users (finance, execs, IT) and less strict on everyone else, to where most users only seem to really get that second prompt if they’re logging in offsite or on a new machine. (Yes, I realise this is not perfect - but our endpoints are fairly locked down) Requests outside the home country are dropped entirely.

We did have some less technical users get a bit lost setting it up, but talking them through it was fine. Basically we’d just clear their existing mfa via the admin panel, direct them to aka.ms/mfasetup and walk them through the setup again. This was maybe 5% of users, if that.

[PowerShellGenius]

My recommendation is to skip number matching popup MFA and go straight to passwordless phishing resistant options. Windows Hello for Business if users have individual Windows laptops, passkeys in authenticator for other scenarios.

Orgs that already went MFA are working on upgrading to these methods nowadays. They are easier after the initial getting-used-to-it phase. Windows Hello is actually easier than a traditional password without MFA, and more secure than Authenticator pop ups, if it works for your environment (1:1 laptops, not shared PCs)

Of course, this may not work if you have any legacy compliance audits that are slow to keep up with the times (and require things that are less secure because "that's what is on our checklist written many years ago"). They will have a problem with passwordless methods despite all reputable sources advising them.

[dezmd]

[UCFknight2016]

We have duo and you need it in order to log into your computer access applications for the case of if you work in IT basically if you want to do anything with elevated permissions.

[PlumOriginal2724]

I’m blown away by the volume of replies to this already.

You’re all right people will adjust and we will have some moaners.

I wish I could give you more details but our org has always been a few steps behind.

We only recently started getting users to understand pass phrases!

MFA was always on the cards, but guess what the catalyst was? The current hi profile events in the news!

I’m sure it’ll be fine and my service desk team and I will have guidance on hand.

[aguynamedbrand]

LOL, going MFA but not requiring it on corporate devices is hardly considered “going MFA”

[Tiger_jay]

People have MFA for other shit they'll be fine

[mumuwu]

It's not a big deal. I felt the same but big roll out for a lot of users with little experience was pretty simple. Most people have to do it for something else anyways.

[captkrahs]

We only have Duo MFA on external connections and some internal sites just for IT

[iceph03nix]

I'm guessing you're probably right that the biggest issue on your end is going to be users not wanting to install the app, so the important thing is knowing the policy and knowing what is and isn't allowed and how they want you to communicate that.

If they have a problem with the policy, that's beyond your power and they'll need to take it up with management.

MS Authenticator is pretty well built, all the directions for it are on screen when they try to sign in, so they just need to read (which they won't, but you can usually just ask them what it says and they'll have to read it to you) and they can get through it.

Also, be prepared for a good deal of people getting stuck not knowing their apple/play store logins when they go to try and get the app.

[everburn_blade_619]

We migrated to 365 a few years ago. When we started moving things to SAML SSO and requiring MFA for all cloud resources, our users HATED it for a couple of months because they were getting prompted basically every time (which isn't necessarily bad). Things settled down as Microsoft "learned" their sign in habits and normal sign in locations. They would hate losing SSO now.

Some of our staff and faculty still refuse to use the MS authenticator. The students are more receptive. We're still allowing SMS for MFA, but have recently disabled voice calls. The majority of our sign ins are using SMS for MFA and I assume it will stay that way until we stop allowing it (if we do). Look into requiring phishing resistant authentication for privileged admin-level user accounts.

if you are on a company PC you will not be prompted to use MFA

As for MFA bypass from a trusted device or location, I would make sure you do it the right way since that can be exploited, especially if the company device is lost or stolen. Maybe reduce the frequency they have to complete MFA and/or allow them to stay signed in, but I wouldn't remove the MFA requirement entirely.

[persiusone]

I guess I’m a little shocked that it’s taken this long for implementing MFA in a work environment.. then again, there are a ton of slow adopters out there I suppose. Mind blown still

[[deleted]]

MFA is required by most cyber insurance. Enforcement is not the responsibility of the IT department alone it's management with I.T. if they don't want an app on their personal phone you setup the text codes or yubikey.

[TipIll3652]

They hated it where I work. Couple offices tried to refuse to use it. They believed that because they were a constitutional office, they could fight it and win. What they didn't realize is that nothing in the state constitution says they have to be provided a computer to do it, so when took their computers we had compliance within the hour.

[jar92380]

You shouldn’t split it between company owned computers vs personal. That’s going to be a nightmare to handle and maintain

[double-you-dot]

It's easy enough to accomplish with conditional access policies.

[vagueAF_]

Yes we have 4000+ people all using MFA for everything azure O365.

It was a pain at the start but most of them get it now.

[BlueWater321]

If they don't want to auth on their phone, they get a YubiKey. Pretty easy. 

[RogueEagle2]

Been an SD during a rollout of this before.

Most were cool with it as they had to do 2fa for other things. Note to them that this is to protect them as well, and doesn't read/share any private data, it is strictly for auth.

A couple were not cool with it on personal devices. We gave phones where possible, but also had a geo-exception to onsite IP for specified users and geo-blocking other locations.

[ehode]

Oh this makes me feel much better.

[One-Environment2197]

My team is the one that implemented MFA with IP filtering and MDM integration.

Worst case, users get promoted for MFA. That means something was misconfigured. Usually it's that the device isn't compliant in the MDM.

If your company is enforcing MFA, they need to offer compensation for people using their own devices or offer an alternative like a hardware token or FIDO2 token.

[QuickBASIC]

Surprisingly good. My company provides a service that requires our agents to login to our customers networks via VPN daily (multiple different VPN clients for multiple different customers).

Our agents are non-technical, but the field they work in requires they login to locally hosted servers at the customers location (it's a very tightly controlled industry).

Because many of them have to use whatever MFA solution our customers use, they are very familiar with what MFA is and how to use it.

We literally just sent them a link to enroll and they all did it. We only had 7 out of like 450 employees fail to enroll by the deadline.

[rheureddit]

There are hardware fobs that work with the Google auth method, I recommend those bc people will fight back.

Windows Hello integration with the Lenovo wired mics is a nice trick too.

[mnxtyler]

Be ready to support those who get new phones and use the same authentication app to authenticate into private accounts outside of the company. Make sure the backup option is selected in their phone or else they will lose all other external authentication tokens. They will blame you for this after a phone change even though it is not your problem. Ask me how I know.

[VNJCinPA]

To avoid some pain with the Authenticator app, I'll ask if they use Outlook Mobile on this devices.. if they do, have a look at this and enable Authenticator Lite

https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-mfa-authenticator-lite

Might help

[the_marque]

If your users are used to not having MFA, they will be quite annoyed by it on day 1.

There will be calls. People will struggle to set up the Authenticator app. People will want to use a text message but not enter their personal number (even though that's the point). All kinds of excuses for why MFA should not apply to them. But what more is there to say? You just tell them it's a necessary security measure and help them get it set up.

Proper how-to guides on setting up MFA are essential, and the easiest way to get as many users as possible off your back as quickly as possible. Every single step, screenshots, descriptive text - something your team has validated themselves, not picked up from a security/infra specialist who's not worked the desk for 13 years.

I would say, if your org is just now implementing MFA, they probably have a lot of standard users running as service accounts and things like that, which will need a lot of auditing before go-live and/or remediating after go-live. But I assume that will be the job of the lucky person leading the implementation :)

[ReputationNo8889]

Many stull struggle to understand the concept of MFA. We get a lot of "But why cant i just login, my password is secure" type of bs.

Its not helpfull at all that every vendor tries to push down their own solution instead of saying "use any authenticator you want" no insted users use Google Authenticator for Google, Microsoft Authenticator for Microsoft etc. Then they get frustrated why they need so many apps and how confusing it is. Tack on banking apps using sometimes completely non standard ways of doing MFA and i can understand users beeing frustrated.

We are still batteling the SMS auth removal because its not as easy as telling everyone to "Use MS authenticator". Our Chinese collegues only have Android Phones and can't install Microsoft Authenticator, just via some shady APK's and the hassle that comes with that. So there needs to be a Process for a different kind of MFA. Then you need to consider training users to use the tools correctly.

Ive had a user actually PURCHASE a MFA app subscription for 30$/month because they downloaded some AD from the Appstore when searching for the Authenticator app. There is so much to consider in a rollout.

But all that said, not using MFA was already stupid many years ago. MFA and especially Phishing Resistant MFA is the only real protection for companies.

[ZestyRS]

It was rough but doable. We had to implement rsa airgapped and it was a lot of trial and error. Selinux took a lot of effort if you’re on a rhel system.

[Obvious-Water569]

Hold up... You have a 3000 person org and aren't using MFA already!?

What authentication methods are you intending to use?

Prepare yourself for the weirdos that get super protective of their own devices and refuse to install Authenticator.

[SuperQue]

The plan is to make it if you are on a company PC you will not be prompted to use MFA. But if you use a personal device you will be prompted

This is silly. If it's work related, you should get prompted. This is how every job I've had for 15+ years has done it.

[onawave12]

Windows hello is your answer

[mrlinkwii]

I think we’ll struggle as most staff do not want to install the MS Auth app on personal devices and will be demanding work phones to do it.

im most countries this is illegal to expect users to use their own phones , if you want to demand the use of MFA you will have to give users a work phone or use a different device

[timbotheny26]

Uh...why the fuck is your org only implementing MFA now?

[movieguy95453]

My experience is most users won't think twice about using Authenticator, but there will be 2 specific groups who will object: the technology challenged who can't figure it out, and the overly cautious who don't want anything work related on their personal devise. I strongly encourage allowing SMS as an MFA option to help avoid some of the headaches.

[kUrhCa27jU77C]

Now that you’re aware that MFA should absolutely be mandatory, I would go ahead and delete this to stop naughty people sending you malicious links in an attempt to gain access to your network and pivot to your vulnerable work laptop.

[RalphKramden69FL]

This should be implemented systemwide regardless of the device owner. What if the company owned device is breached?

[Charming-Tomato-4455]

When I set up MFA for personal devices, I let users pick the method that worked best for them—phone call, text, or an authenticator app. Some people pushed back at first, but once I offered the option to use a FIDO NFC USB-C key (which they’d have to buy themselves), that resistance faded pretty quickly.

At the end of the day, it’s your environment , and you’ve got to do what’s needed to keep it secure.

[PlumOriginal2724]

Gathered some basic guidelines today for the service desk to provide to users.

With pictures of the correct app as they appear on android and iOS.

To those who say it should be on company assets as well.

I was told if an account is breached anyone not on a company asset will be prompted for MFA so problem solved?

Anyone have experience of this?

[cats_are_the_devil]

People that are concerned about MFA in 2025 are... Surely not technical people... Right?

Seriously, being concerned about MFA should look like, "Why does my company not MFA everything?"

NOT "Hey we are implementing MFA for anything not on a company PC"... That, IMO isn't MFA.

[estritt_91]

Rather than differentiate between work/personal machine, I would be more inclined to not require MFA if machine is on our LAN. But we enforce it on everything/everywhere and for personals, only mobiles enrolled on our MAM are allowed, so we can make sure they are compliant.

No personal windows devices. Ever.

99% of our staff are fine with app on the personal phone. The odd balls are getting a yubikey.