I can get that the phone part is annoying but DuoPosh/TOTP and now the TouchID are probably the smoothest FMA solution for the enterprise I ever used.