Retiring MFA Exceptions: Full-Workforce MFA with Avatier

An MFA exception policy decides which workers may sign in without the organization's standard second factor. Retiring those exceptions means giving every excepted worker a factor they can actually use, so the register shrinks instead of growing. Avatier's Identity Challenge Card™ is built for that: a printed grid of word pairs with "no phone, no app, no network," which policy can route a worker to wherever device MFA can't reach.

For scoring MFA across a whole program, see the MFA Implementation Self-Assessment. For Avatier's framing of the wider category, see What Is an Identity Continuity Layer? The register is narrower than either: a list of named groups who were told MFA didn't apply to them.

Why MFA exceptions get written

Device MFA needs a device. In Avatier's comparison, device-dependent MFA "Requires a phone, app, token, or hardware key." When a group of workers has none of those at sign-in, the policy still has to say something about them, and one answer is an exception.

Avatier names the groups: "device-based solutions exclude factory floors, shared workstations, field staff, and contractors." Three situations put workers on the register:

• No company phone. Frontline staff and contractors who carry no work phone, or won't put an authenticator on a personal one.
• Shared devices. Several workers on one workstation or virtual desktop, where a factor provisioned into the machine identifies the machine, not the person.
• Restricted sites. Areas where phones aren't allowed or there is no signal.

The exception register is the list of those decisions: who is exempt, why, who approved it and when it gets reviewed again. Each entry can be a reasonable call on its own. Together they become a standing gap.

How the register becomes the attack surface and an audit finding

Avatier puts it plainly: "Organizations write MFA exceptions for the workers they can't reach. Those exceptions are the attack surface cyber adversaries map first." Elsewhere: "Every MFA exception you've written is a gap an attacker can map."

An account on the register sits behind a password alone. A phished, reused or purchased password is the whole sign-in. Avatier's Identity Attack Ledger covers 2,242 California breach-notification filings dated 1 Jan 2023 to 30 Sep 2026. In that window, 53 incidents name a vector: phished or stolen credentials account for 30, and social engineering of a person for 12. The counts cover only California filings that name a vector; they are not a national rate.

The register is also an audit problem. An auditor testing an MFA requirement asks for the exception list, the reason for each entry, who approved it and what compensates for the missing factor, and every review cycle asks again. In Avatier's framing for CFOs, each uncovered frontline worker is "one stolen credential from a seven-figure incident, a denied cyber-policy claim, and an audit finding that pushes your next renewal."

What an auditor asks	With an exception register	With the card routed by policy
Who is covered?	Everyone except the listed groups	"MFA coverage for 100% of workers"
What protects the account?	A password alone	A one-time card coordinate, a private PIN and directory identity
How is the factor issued?	No factor to issue	"Every card is issued through the existing IGA workflow"
How does it end?	The entry is reviewed and renewed	"Revocation is immediate — no upstream device cleanup"
What is the evidence?	The register and its approvals	Issuance, expiration, re-enrollment and revocation "logged and policy-enforced"

The left column describes common practice; the right column quotes Avatier.

Before, the register lists who MFA skips; after, policy routes every group to a method and each card's life is logged.

How policy routes each worker to a method

Retiring an exception doesn't require replacing the MFA that already works. In Avatier's words, "The card sits alongside the MFA you already run, and policy routes each worker to the right method, even where device MFA can't reach." Staff with an approved device can keep their authenticator. The groups on the register are routed to the card.

Each of the three situations above maps to how the card works:

1. No company phone. The card needs "no phone, no app, no network." Avatier's login explainer runs: "Password accepted. The screen types out a coordinate. The worker reads the matching word off the printed grid, then adds the private PIN. Directory Identity resolves automatically, nothing to approve." For frontline teams, see MFA for Frontline Workers Without Phones.
2. Shared devices. Avatier says "Use it passwordless on shared workstations and virtual desktops, or keep the password and let the card answer the MFA challenge." The factor is "in the worker's pocket," not provisioned into the machine.
3. Restricted sites. Avatier lists "Air-gapped verification — no network attack surface," and the card works with no phone in hand.

Every answer is single-use. Avatier says "Each coordinate value is one-time," and used values "are permanently burned and never reused." The same card also covers password reset: "The card proves who they are before the password changes, so the reset needs no help desk call."

Retiring an exception, step by step

The steps below are general guidance for working through a register, with Avatier's capabilities named where they apply:

1. Inventory the register. List each entry, the group it covers and why device MFA couldn't reach them. The reason decides the routing.
2. Route each group by policy. Point the excepted group at the card in the same policy that sends everyone else to their authenticator.
3. Issue cards through IGA. Avatier states that "Every card is issued through the existing IGA workflow." Avatier's featured demo is titled "Self Enrollment or Auto Enroll Everyone at Once," and Avatier says "users are live within minutes of receiving their card."
4. Set expiry windows by policy. Avatier lists "Policy-enforced expiration and re-enrollment windows," and says "Admins set expiry windows; users receive automated reminders."
5. Close the exception entry. Once the group signs in with the card, remove the entry. The card's issuance record replaces the exemption as the evidence for that group.

Two controls keep the new method from becoming its own weak spot. Avatier lists "Separation of duties between issuer, approver, and auditor," and "Identity-verified re-issuance closes the social-engineering path" for a lost card. For lost-card handling end to end, see Issuing, Revoking and Replacing Avatier's Identity Challenge Card.

Five steps take a group off the exception register and onto a governed method, with each card issued and revoked by policy.

What auditors see after the register shrinks

The exception list was a set of reasons why the control didn't apply. What replaces it is a record per worker. Avatier states that "Card issuance, expiration, re-enrollment, and revocation are all logged and policy-enforced," and that "Every access event is traceable — no gaps in the audit trail." The identity anchor ties each challenge "to a specific human, with full audit trail," and every challenge and re-issue "lands in the identity governance you already run."

Avatier's claim for the end state: "The Challenge Card closes every exception, giving auditors complete coverage evidence with no asterisks." Keep the retired entries and the date each was closed, so the next review shows the register shrinking rather than starting over.

What Avatier ships toward this pattern

• Identity Challenge Card. Deviceless MFA a worker uses at login, at a password reset or at the service desk, "Deployed in under an hour" with "No MDM, no app, no hardware." Avatier ships it in 34 languages, with right-to-left and CJK scripts among them. For the product and its live three-factor challenge, see the Identity Challenge Card.
• Policy routing. The card sits alongside existing MFA, and policy routes each worker to the right method.
• Governed card lifecycle. Issuance through the existing IGA workflow, policy-enforced expiration and re-enrollment windows, identity-verified re-issuance and separation of duties, all logged.
• Security posture. Avatier is SOC 2 Type II audited with no exceptions noted and ISO/IEC 27001:2022 certified. For details, see the Avatier Trust Center.

Getting started

Avatier offers a 20-minute walkthrough in which, in its words, "we'll map your exceptions to a deployment plan before you leave the call." Pricing for Avatier Identity Anywhere 2027™ is Pay Per Identity Action™: customers pay only for completed, verified, policy-compliant outcomes. Getting started is free, deployment services are included, and a 45-day money-back guarantee applies. Pricing is shared with qualified organizations during the invitation-only preview. For the platform, see the Avatier Identity Anywhere 2027™ preview. For Avatier's full product line, see avatier.com.