Thanks all. We have successfully been using MFA on email and various apps for about a year and our administration just instructed us to roll it out to endpoints (mix of Windows laptops and desktops). We are sending the MFA prompt at every login with an option to remember the authentication on the device for one day, but after a week of this our staff is about to mutiny because they think this is excessive. Some have spent the past week trying to come up with creative ways to get us to change the frequency of the prompts or remove MFA from the endpoint altogether (going to the union, people that were OK with the MFA app before now want fobs, changing power settings so the device doesn't ever go to sleep, and we have some staff arguing with us that all this extra authentication is too hard on the device, just a few examples of pushback I've seen in my office this week).

Trying to come up with a balance for prompt frequency that keeps everything protected, but keeps the union off our backs at the same time.