Preaching to the choir here, but I've been doing security for a long time and the only consistent way to make it work reliably is to make it invisible to the users it should apply to. It should add zero friction to what they would be doing anyway and ideally be the easier option. It's not always possible but having that as an end goal makes processes much more successful.