u/blogsymcblogsalot

We have a client that has multiple locations spread out over a large geographic area with a lot of employee turnover and employees who "float" between locations. Their Windows 11 machines are Entra-joined using a location-specific shared account, and our MFA solution for them has been to set their MFA to call their location's main number.

However, with Microsoft retiring SMS and voice as MFA options, we're looking for solutions. Microsoft Authenticator isn't a very feasible option due to the turnover. FIDO2 keys could potentially work, but they could get expensive (not to mention the strong probability they'd get lost - A LOT).

What solutions have you come across that could work?