Shared Warehouse Scanners vs an Org-Wide MFA Requirement

The ranking has to be driven by what the scanner browser can actually do, not by what reads best on a slide.

1. FIDO2 security keys (best end state). Phishing-resistant, no phone, no email, and the credential stays with the associate. Caveats: WebAuthn support on the rugged Android browser must be verified with one device before ordering 350, and NFC/BLE pairing behaviour varies by scanner model. If WebAuthn fails on the device, this option drops to third place regardless of its security properties.
2. TOTP in Okta Verify on a personal device. Technically strong enough, but blocked by two stated facts: no phones on the floor and no corporate email for enrollment. Do not quietly assume associates will use personal phones; that is a policy decision, not an admin decision.
3. Password plus an IP-restricted network zone, with device and physical controls, as a documented interim. Weak as an authenticator, but the risk is bounded by the warehouse egress IPs, the shared-device kiosk lockdown, and badge-controlled floor access. This is the only option that fits the five-week window.
4. Rejected outright: shared service accounts on the scanners (destroys attribution and is worse than password-only), inviting associates to enroll SMS (explicitly prohibited), and relaxing the org-wide policy for Everyone instead of scoping an exception.

The judgement the exam is testing: a scoped, compensated, time-boxed exception is defensible; an unscoped relaxation of the control is not, even if the short-term user experience looks identical.

Group first. Create a rule-driven group, Warehouse-Shared-Devices, matching employeeType=Warehouse. Never list 350 people by hand; the population churns weekly.

Enrollment policy. Create a group-scoped enrollment policy containing only Password, and place it above the Everyone policy in priority order. Then prove it: sign in as a test user who is in both groups and confirm which policy actually applied. Priority assumptions are the most common cause of accidental lockout.

App sign-on policy for WMS.

• Rule 1, priority 1: Warehouse-Shared-Devices, allow with password factor only, condition Network zone = Warehouse-Egress (an IP zone built from the three distribution-centre egress addresses). Without the zone condition the exception is global and indefensible.
• Rule 2: catch-all, require phishing-resistant authenticator. This keeps everyone else at full strength.

Session length. Set the app session to a defined lifetime that survives a scanner re-image where possible. Forty logins per shift is not just friction; it drives shared-password behaviour and shoulder-surfing, which is the actual risk.

Compensating controls to document alongside the policy: kiosk/MDM lock on the scanners, physical badge access to the floor, WMS-side audit logging per user, no local credential caching, and a signed risk acceptance with an expiry date tied to the FIDO2 rollout. Write the expiry into the exception record so the interim cannot become permanent by neglect.

An auditor will not accept 'we restricted it to the warehouse'. Give them artefacts they can verify independently.

Evidence pack:

• Exported policy configuration showing rule priority, the exact group, and the network zone membership (the three IPs, with owners).
• A negative test: sign in as a Warehouse-Shared-Devices member from outside the zone and show the System Log user.authentication.sso deny event. A control nobody has tested is a claim, not a control.
• A positive test: the same user from inside the zone succeeds, and a non-warehouse user is still challenged for MFA.
• MFA coverage reporting showing the exception population as a named, counted group rather than an unknown gap.
• The signed risk acceptance with the expiry date and the FIDO2 purchase order number, which is what makes this time-boxed rather than permanent.

Rollback plan:

• Keep the new enrollment policy deactivated but staged, so reverting is a single activation rather than a rebuild.
• Maintain two break-glass warehouse accounts with FIDO2 keys held by the shift supervisors, so a policy mistake does not stop the line at 03:00.
• Before cutover, confirm that deactivating the scoped policy returns those users to the Everyone MFA policy, and that the organisation knows the help-desk impact of that.
• Track a weekly metric during the interim: failed WMS logins per shift and the count of authentications originating outside the egress zone. Either trending upward means the exception is leaking and it is time to accelerate the key rollout.