How should organisations choose MFA methods for different workforce segments?

How to match MFA method to workforce segment

The right method depends on how people actually work, what devices they use, and how much interruption the business can tolerate. A strong programme does not force every segment onto the same factor mix. It balances phishing resistance, enrolment burden, recovery, device ownership, and the risk of account takeover for each population.

For desk workers, app-based approvals, passkeys, and security keys are usually practical because the user has a managed device and a stable workflow. For frontline workers, shared-device and deviceless flows are often easier to operate than push prompts tied to a single handset. For contractors and short-term users, the design should favour rapid joiner-mover-leaver handling over long-lived enrolment.

Customers are different again. They often need step-up authentication that is low-friction for routine use but stronger at higher-risk moments, such as password resets, profile changes, or payment actions. The key question is not which method is “best” in the abstract, but which method fits the segment’s access pattern and failure tolerance.

Why one MFA method rarely fits every workforce segment

Method choice changes the user experience and the attack surface at the same time. A push-based method can be workable for office staff, but it is a poor fit if users are on kiosks, air-gapped terminals, or devices they do not control. Passkeys and security keys can improve phishing resistance, but they require enrolment, recovery, and device support that not every group has in the same measure.

Organisations should also separate workforce MFA from customer MFA. Workforce users usually need strong authentication tied to managed access and lifecycle controls. Customer identities usually need scalable sign-in with selective step-up, because forcing every customer into the same high-friction method can hurt adoption without proportionate security benefit. NIST SP 800-63 Digital Identity Guidelines are useful when you need to align authenticator strength and assurance level to the access scenario rather than to a single corporate default.

It is also worth treating MFA as part of a wider identity control set, not as a standalone defence. If recovery, enrolment, and revocation are weak, a “strong” method can still be bypassed through account recovery abuse, stolen sessions, or help desk compromise. That is why method selection should be reviewed alongside onboarding, reset, and offboarding handling. For practical guidance on phishing-resistant options and rollout trade-offs, Workforce Identity Security Guide is a useful companion resource, and Passwordless and Passkeys Guide helps when passkeys are one of the candidate methods.

Segment-specific design choices that usually work best

Desk workers are usually the simplest population to standardise because they tend to have managed endpoints, reliable connectivity, and predictable support channels. In that segment, app-based MFA can be a sensible baseline, while passkeys or security keys are better when phishing resistance is a higher priority. Push approval works operationally, but only if the organisation has strong anti-fatigue protections and a clear response path for unexpected prompts.

Frontline workers need a different pattern because their operational reality is often shared devices, shift work, or fast task switching. Deviceless methods, shared-device sign-in, or kiosk-friendly flows may be more workable than a method that assumes one personal phone and uninterrupted access to it. For these users, the decisive factor is often speed and simplicity at shift change, not the theoretical elegance of the factor.

Contractors are a lifecycle problem as much as an authentication problem. The best method is the one that can be issued quickly, bound to a bounded scope, and revoked without delay when the engagement ends. If a contractor can enrol once and keep using the method after the project ends, the organisation has created unnecessary residual access risk. In practice, this is where method choice must be paired with rapid deprovisioning and short validity windows.

For customers, low-friction step-up usually beats blanket high-friction MFA. Use stronger checks when the action is sensitive, but keep routine sign-in proportionate to the customer journey. The control should protect high-risk events without turning everyday use into a support burden or conversion problem.

Practitioner Guidance

What to prioritise: Start by segmenting users by device ownership, workflow stability, and revocation speed, then choose the method that fits that segment’s reality. If the group is highly mobile or shared-device based, favour methods that do not depend on a single personal handset.

What to verify: Test the full lifecycle, not just sign-in. The chosen method should have a clean enrolment path, a reliable recovery path, and a fast revocation path, otherwise the control may look strong while the operational process remains fragile.

Common mistake: Treating one MFA standard as universal. That usually creates avoidable friction for frontline users and unnecessary risk for contractors, while still failing to address the real weak points in recovery and offboarding.

Practitioner takeaway: Good MFA design is segment design, the strongest method is the one the relevant population can use consistently, recover safely, and lose immediately when access should end.

Related resources from NHI Mgmt Group

• How should security teams choose MFA methods for different user environments and risk levels?
• How should organisations choose passwordless methods for different user types?
• How should security teams choose between passwordless and MFA for workforce login?
• Why do conventional MFA methods struggle in workforce identity attacks?