Employee MFA Friction & Recovery Assessment

Welcome! This survey takes approximately 10 minutes and asks about your recent experience with multi-factor authentication (MFA), backup sign-in methods, and step-up authentication. Your participation is voluntary and you may stop at any time. There are no right or wrong answers — we are interested in your honest opinions. All responses are confidential and will be reported only in aggregate to improve authentication usability. Please click 'Next' to begin.

On a typical workday in the past 7 days, approximately how many MFA prompts did you complete?

• 0
• 1–2
• 3–5
• 6–10
• 11–15
• More than 15

How clear are your backup sign-in options if your primary MFA device is unavailable?

How clearly can you tell which actions will trigger step-up authentication before you begin them?

Please rank the following improvements by how much they would reduce MFA fatigue for you. Drag to reorder; top = highest priority.

1. Fewer prompts on trusted devices
2. Clearer explanation of why a prompt occurs
3. Shorter or faster prompt (e.g., biometric or one-tap)
4. Longer session duration before re-prompt
5. Better offline or travel fallback
6. More consistent experience across apps and services

Based on your responses in this survey, is there anything else you would like to share about your MFA, backup sign-in, or step-up authentication experience?

What is your primary department or function?

• Engineering / Development
• IT / Operations / SRE
• Security / Compliance
• Product / Design
• Finance / Accounting
• HR / People
• Sales / Marketing
• Customer Support / Services
• Other
• Prefer not to say

Thank you for your time and insights. Your feedback will directly inform improvements to our authentication experience. If you have any questions, please contact [security-ux@company.com].

How disruptive were MFA prompts to your workflow in the past 7 days?

Which fallback or recovery methods have you used in the past 12 months, if any? Select all that apply.

• Backup codes
• SMS text code
• Phone call code
• Security key (e.g., YubiKey)
• Authenticator app on a secondary device
• Helpdesk-assisted temporary access
• Recovery email link
• Other (please specify)
• None — I have not needed a fallback method

How clear is it why step-up authentication is required when it occurs (e.g., accessing sensitive data, logging in from a new location)?

Thank you for your answers so far. We'd like to explore a couple of your experiences in a bit more depth. Please share as much or as little detail as you'd like.

Which best describes your role level?

• Individual contributor
• People manager
• Executive / Senior leadership
• Prefer not to say

Overall, how satisfied are you with the current MFA sign-in experience?

If you lost your primary MFA device today, how confident are you that you could regain access to your accounts within 10 minutes?

When step-up authentication occurs, how disruptive is it to completing your task?

How long have you worked at the company?

• Less than 1 year
• 1–2 years
• 3–5 years
• 6–10 years
• More than 10 years
• Prefer not to say

In which of the following situations have you encountered an MFA prompt in the past 30 days? Select all that apply.

• Signing into email or productivity apps
• Connecting to VPN or remote desktop
• Accessing sensitive data or admin tools
• Logging in from a new device or location
• Returning after a session timeout
• Performing a financial or compliance-related action
• Other (please specify)
• I don't recall / Not sure

The situations that trigger step-up authentication feel appropriate for the level of risk involved.

What is your primary work arrangement?

• Onsite
• Hybrid
• Remote
• Prefer not to say

In the past 30 days, which of the following, if any, have you done in response to MFA prompts? Select all that apply.

• Delayed responding to MFA until a break
• Approved a prompt without reading all details
• Declined a prompt that looked unfamiliar
• Waited for a push instead of entering a code
• Used a trusted device to reduce extra steps
• Contacted support for assistance (e.g., reset or temporary access)
• Other (please specify)
• None of the above

Which region do you primarily work in?

• Americas
• EMEA
• APAC
• Prefer not to say