Login friction is the extra effort a person or system faces when proving identity before access is granted. In IAM, it includes repeated prompts, device checks, MFA steps, password resets, and policy controls that slow sign-in. Excessive friction can reduce productivity, while too little can weaken security and governance.
What Login Friction Means in IAM
Login friction is not just inconvenience, it is the cost of proving identity before access is granted. In IAM, it appears whenever users or systems must repeat steps, satisfy policy checks, or recover access before they can continue.
The term matters because friction is both a security mechanism and a user-experience signal. Some friction is intentional, such as step-up authentication or device validation, while excessive friction usually means the login path is too fragile, too repetitive, or poorly tuned to the real risk profile.
Where Login Friction Comes From
Friction usually emerges from repeated prompts, MFA challenges, conditional access rules, password resets, device trust checks, federation hops, or inconsistent session behavior. It can also come from policy drift, where different applications apply different sign-in requirements to the same user or workload.
For people, this is most visible as slower sign-in and more interruptions. For systems, the same pattern can show up as brittle automation, failed token refreshes, or service dependencies that break when a credential or assertion expires sooner than expected.
Not all friction is bad. A difficult login can be a sign that the organisation is resisting account takeover, suspicious locations, risky devices, or weak authentication. The challenge is to distinguish useful resistance from friction that adds delay without materially improving assurance.
Why Login Friction Matters for Security and Operations
Login friction directly affects adoption, support burden, and the likelihood that users will look for workarounds. When people encounter too many prompts or resets, they are more likely to reuse passwords, defer enrolment, approve prompts reflexively, or route around controls.
It also affects governance. Authentication policy that is too strict for every scenario can create unnecessary exceptions, but policy that is too loose can leave high-value access paths under-protected. The practical goal is to match the level of friction to the sensitivity of the action, the trustworthiness of the device, and the exposure of the account.
When authentication is central to the control model, login friction becomes part of the organisation’s assurance posture. NIST SP 800-63 Digital Identity Guidelines is a useful reference for thinking about assurance, authenticator strength, and the relationship between stronger verification and user burden.
How Organisations Reduce Friction Without Weakening Control
The best reductions come from removing avoidable repetition, not from stripping away verification. Typical improvements include better session lifetimes, fewer redundant prompts, clearer recovery paths, and authentication methods that fit the user population and device mix.
For broader access design, organisations often align sign-in decisions with risk and privilege rather than forcing one universal experience. That is why NIST SP 800-207 Zero Trust Architecture is relevant here: it frames access as a continuous decision, which helps teams justify when extra checks are warranted and when they are simply noise.
Friction should also be measured in context. A login path that feels tolerable for a quarterly administrative task may be excessive for a daily workflow, while a lightweight flow that is acceptable for low-risk access may be too permissive for privileged or sensitive operations.
How to Recognise Problematic Login Friction
Problematic friction shows up as repeated help desk tickets, high abandonment during sign-in, prompt fatigue, or users developing informal shortcuts. It may also appear in telemetry as unusually frequent resets, challenge loops, or abnormal failures at the same point in the authentication journey.
The key question is whether the extra effort is buying meaningful assurance. If the control only creates delay, but does not improve confidence in the identity or the session, then it is usually a design problem rather than a security win.
At the same time, organisations should be careful not to treat every complaint as evidence of bad control. Some friction is the necessary cost of protecting higher-risk access, especially where the authentication event is the main line of defense.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-63 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | Digital Identity Guidelines | Defines assurance and authenticator strength that directly shape login friction. |
| Recommendation — Align sign-in strength to identity assurance and reduce unnecessary verification steps where risk is low. | ||
| NIST Zero Trust (SP 800-207) | Zero Trust Architecture | Frames access as continuous verification, which explains when extra login checks are justified. |
| Recommendation — Use risk-based continuous verification to add friction only where access conditions warrant it. | ||
Related resources from NHI Mgmt Group
- How should retailers reduce login friction without increasing account takeover risk?
- How should security teams reduce login friction without weakening identity security?
- How should government teams reduce resident account takeover without adding too much login friction?
- How should teams reduce password sharing without creating too much login friction?