How should organisations use MFA within a Zero Trust model to protect remote access without creating too much user friction?

How to apply MFA in Zero Trust without making remote access unbearable

Zero Trust changes the role of MFA from a one-time gate into part of an ongoing access decision. The practical aim is to increase challenge when risk is higher, then keep routine access smooth when device trust, user context, and session conditions are already strong. That balance matters because excessive prompting often teaches users to bypass controls or ignore warnings.

For remote access, MFA works best when paired with device posture, location signals, session controls, and clear trust boundaries. A user on an unmanaged laptop over a home network should face a much stronger challenge than a user on a managed device with a healthy posture and an established session. That is the same principle behind the Remote Access Identity Guide, which treats remote access as an identity problem first and a network problem second.

It also helps to distinguish first sign-in from step-up authentication. The first may need a phishing-resistant factor, while later prompts should be reserved for meaningful changes in risk, such as a new device, unusual geography, or access to a sensitive application. Good Zero Trust design reduces unnecessary friction by relying on verified device state and continuous evaluation rather than repeated blanket prompts.

When MFA reduces risk, and when it becomes a weak substitute

MFA is strongest when it blocks credential theft, password reuse, and opportunistic remote logins. It is much weaker when the organisation allows long-lived sessions, weak recovery paths, or fallback methods that are easier to abuse than the primary factor. In practice, the control should be assessed as a chain, not as a checkbox.

Attackers often target the remote access path because it is a high-value entry point with broad downstream reach. Valid credentials, push fatigue, token theft, and session replay can all defeat a poorly designed MFA deployment. The MFA Guide is useful here because it distinguishes phishing-resistant methods from weaker patterns and explains how attackers bypass MFA in real environments.

Zero Trust also means not trusting the session just because MFA was satisfied once. If the access path is remote and the user’s context changes, the organisation should be prepared to re-evaluate trust. That is why standards-based Zero Trust guidance emphasises continuous verification rather than static approval.

The practical lesson from incident history is that MFA failures are often really access-design failures. A compromised remote access account, a stale VPN profile, or an intercepted session can produce the same outcome as no MFA at all if the surrounding controls are weak. The correct response is to tighten the access path, not to add more prompts everywhere.

How to tune verification so users do not create workarounds

The best MFA policy is usually adaptive, not uniform. Users should not be challenged equally for low-risk and high-risk access, because that encourages friction fatigue and unsafe workarounds such as shared devices, repeated approvals, or shadow IT access methods. A better pattern is to make the challenge proportional to the confidence level of the device and the requested resource.

For example, sensitive applications, privileged actions, and unfamiliar endpoints should trigger stronger verification, while low-risk routine access can stay lightweight when the device is managed and the session is healthy. NIST SP 800-63 Digital Identity Guidelines are relevant because they frame authenticator strength, phishing resistance, and assurance levels as part of the access decision rather than as a single uniform requirement.

That same risk-based thinking aligns with Zero Trust architecture, where access decisions are based on explicit verification and least privilege. The organisation should also be ready to exempt only the right things, such as a managed device with a strong posture and a trusted session, not entire user groups or broad network ranges. NIST SP 800-207 Zero Trust Architecture is the clearest external reference for that model.

What matters most is consistency. If users cannot predict when an extra challenge appears, they are more likely to seek easier paths. If they can see that stronger prompts appear only when risk changes, they are more likely to accept the control as part of normal access.

Risk and Threat Considerations

Remote access MFA is frequently defeated by the space around the factor, not the factor itself. Stolen credentials, MFA fatigue, session theft, and weak recovery paths can all let an attacker reach internal systems even when MFA is formally enabled. The risk rises sharply when organisations treat the second factor as the whole defence instead of one control inside a broader access chain.

Failure mechanism: Attackers exploit weak prompts, replayed sessions, or fallback authentication paths to turn a valid login into durable access. If device trust and session controls are not part of the decision, the organisation can keep challenging the user while still leaving the real entry path exposed.

Impact: Remote access compromise can lead to lateral movement, privileged escalation, data theft, and ransomware staging. The business impact is often larger than the original account compromise because remote access is typically a gateway to multiple internal services.

Practitioner Guidance

What to verify: Confirm that MFA decisions are tied to device posture, application sensitivity, and session state, not just to username and password entry. If every user sees the same challenge pattern, the policy is probably too blunt for Zero Trust.

Decision rule: If the access attempt comes from an unmanaged or unfamiliar device, or from a high-risk location, require stronger verification and shorten the trust window. If the device is managed and the session is already well established, reduce prompts only where the residual risk is genuinely low.

Common mistake: Do not chase friction reduction by weakening the factor itself or by expanding blanket exceptions. The safer optimisation is to reduce unnecessary prompts for low-risk access while preserving strong challenge for risky access paths.

Practitioner takeaway: The goal is not to make MFA invisible, it is to make it risk-sensitive. Good Zero Trust design challenges the access that should worry you and stays quiet when the surrounding trust signals are already strong.

Related resources from NHI Mgmt Group

• Zero Trust Model
• User Friction
• Trust Model
• How should security teams use adaptive MFA to reduce brute-force password attacks without creating too much user friction?