As of 13 August 2026, AI can only partly choose a multi-factor authentication app for your business.

What to actually do

1. Hand it to a person

   The route this page recommends

   A person who owns the outcome does this end to end, worth it when the failure is dear.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface, chat-fluent skill, and roughly 1 hour until you can act on the result.

   How to actually do it

   1. Open your identity provider, email administration console and device-management records, then write down the users, devices, operating systems, sign-in methods and integrations the app must support.
   2. Gather your current access policy, recovery process, accessibility requirements, contractor arrangements, offline-use needs and any customer or contractual security requirements.
   3. Paste those facts into the prompt, leaving unknown fields marked as unknown rather than asking the model to fill them in.
   4. Ask the model to produce a shortlist, evidence links, unresolved questions and a pilot plan, then remove any recommendation that relies on an unverified product claim.
   5. Open the official documentation for each remaining product and compare its supported identity provider, authentication methods, recovery controls, administration, audit logs and device-replacement process with the drafted table.
   6. Ask your IT or security owner to approve a small pilot using test accounts, then record enrolment, sign-in, recovery, lost-device and account-lockout results before selecting the app for wider deployment.

   Prompt

   Act as a cautious UK business IT adviser, not a sales representative. Help me choose a multi-factor authentication app for this business.
   
   Business context:
   - Business size and number of users: [insert]
   - User types, including office staff, remote workers, contractors and administrators: [insert]
   - Devices and operating systems: [insert]
   - Identity provider, email platform and important applications: [insert]
   - Existing password manager, single sign-on or device management: [insert]
   - Budget and procurement constraints: [insert]
   - Required deployment date and support capacity: [insert]
   - Accessibility, offline access, shared-device or phone-replacement requirements: [insert]
   - UK regulatory, contractual or customer requirements: [insert]
   
   Compare only products whose current documentation supports the integrations we need. If I have not provided enough information, ask the smallest set of questions needed before recommending anything. Create a shortlist and assess each option against compatibility, authentication methods, administration, recovery, device replacement, accessibility, audit logging, privacy, support, migration effort and likely failure points.
   
   Do not invent prices, certifications, security features, integrations or product limits. Mark each important statement as one of: supplied by me, verified in current official documentation, or needs confirmation. Prefer official vendor documentation and include a link for every product-specific claim. Separate facts from judgement. Give me a provisional recommendation only if the evidence supports one, explain what could change it, and list the exact checks and a small pilot I should complete before purchase or company-wide rollout. Do not ask me to paste passwords, recovery codes, enrolment secrets or other private credentials. Use UK English and state that the final decision remains with the business and its IT or security owner.

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.