Do you allow access to workday/HR application outside of InTune or another MDM tool? What is your policy for hourly employees accessing Workday ‘off hours’? How is this policy managed?

We use Dayforce, so I hope my feedback is relevant.

We allow access off-premises and at any time; however, access is restricted through the mobile app for Users to view and modify their HR documentation (such as statements, tax information, and benefits), and shift/hourly workers can use it for scheduling purposes only, Managers have a limited set of actions as well, including approving PTO, approving schedule changes, etc.

We also have SSO and MFA enabled for all users.

We have been discussing this as well as some of our workers do not have laptops but will need access to the portal for their HR documentation. We are working out the best way for them to utilize MFA to still access it securely and will probably go that route if possible.