Skip to content
For most of the last thirty plus years, the access credential was a plastic card.
The card format was simple, durable, and well-understood. Employees collected their card at reception, carried it in a wallet or on a lanyard, and presented it to a reader. When they left the organisation, the card was returned or, more commonly, was not returned, and was deactivated when HR updated the system.
The card is not going away immediately. But in new developments, refurbishment projects, and premium office environments, it is being replaced with something the employee already carries: their smartphone.
Mobile credentials where a smartphone, smartwatch, or wearable device replaces the physical access card have moved from a premium feature to an expected standard in a growing proportion of enterprise and commercial property environments. Understanding what they require, what they deliver, and where the implementation pitfalls lie is now a relevant question for most organisations managing physical access to multiple sites.
What mobile credentials are
A mobile credential is a digitally issued access token that resides on a mobile device and communicates with an access control reader using near-field communication (NFC) or Bluetooth Low Energy (BLE). When an employee presents their device to a reader either by tapping it or simply by holding it within range the reader authenticates the credential and grants or denies access.
The credential itself is managed through a platform like HID Mobile Access, Sharry, SwiftConnect, Gallagher Mobile Connect, or similar and is provisioned to a device by the administrator rather than physically distributed. This means credential issuance and revocation can happen instantly, remotely, and without any physical interaction.
The most seamless implementation currently available for Apple and Android device users is integration with Apple or Google Wallet where the access credential lives natively in the Wallet app alongside payment cards and boarding passes. Access is granted by holding the Phone or Watch near the reader, including when the device is off or out of battery through Express Mode. There is no app to open, no PIN to enter, and no Bluetooth pairing sequence.
What your buildings need
Mobile credentials require reader hardware that supports NFC and/or BLE communication. Older proximity card readers (usually using 125kHz technology) do not support mobile credentials and must be replaced. Smart card readers using 13.56MHz MIFARE or DESFire technology may support mobile credentials with a firmware update, or may require replacement depending on the manufacturer and model.
This is the single most significant infrastructure consideration in a mobile credential deployment. An organisation with a large estate of older readers faces a substantial hardware replacement programme before mobile credentials can be deployed. Understanding the hardware position across your estate is the first practical step and requires a physical survey, not an assumption.
The back-end infrastructure also requires attention. The credential management platform needs to be integrated with your identity management system such as Active Directory, Entra ID, or your HR platform so that credential issuance and revocation can be automated rather than managed manually. The access control server needs to be running a current software version that supports the credential management platform’s API. And the network infrastructure needs to support the communication between readers, controllers, and the server without firewall rules blocking the relevant ports.
What your organisation needs
The technology requirement is straightforward relative to the organisational requirement. Mobile credential deployment touches device management policy, data protection obligations, IT governance, and HR processes in ways that a physical card programme does not.
Device management policy: whose devices are eligible to receive a credential? Personal devices, company devices, or both? If personal devices are in scope (which is a practical approach for some organisations) what governance applies to the credential installed on a device the organisation does not manage?
Data protection: a mobile credential is linked to an identifiable individual and their device. The provisioning process creates a data processing relationship between the credential management platform, the access control system, and the individual’s device. Under GDPR and the UK Data Protection Act, this requires a lawful basis for processing, a documented retention period, and a process for revoking and deleting credential data when an employee leaves.
IT governance: the credential management platform is a software system that requires patching, access controls, and inclusion in your information security management framework. If your organisation holds ISO 27001, the credential management platform should appear in your asset register and your risk assessment.
Where mobile credentials deliver the most value
Mobile credentials deliver the clearest return in three specific contexts.
High-turnover environments where credential issuance and revocation is a daily administrative burden benefit immediately from the automation that mobile credential management enables. Hospitality, professional services, and campus environments with frequent staff and contractor changes are strong candidates.
Premium commercial property where the tenant experience is a differentiator in attracting and retaining occupiers benefits from the friction reduction that mobile credentials provide. An employee who accesses their office building, calls the lift to their floor, and unlocks their smart locker without touching a card or pressing a button is experiencing a building that performs at a different standard to one requiring a physical credential for each of those interactions.
High-security environments with strict visitor management requirements benefit from the instant revocation capability that mobile credentials provide. A visitor credential provisioned for a two-hour site visit can be automatically expired at the agreed time, without any physical card collection requirement.
The conversation to have before you specify
If you are specifying access control for a new development, a refurbishment, or a system replacement, mobile credentials should be on the agenda before technology decisions are made. The reader hardware you specify, the access control platform you select, and the credential management platform you integrate with should all be chosen with mobile credential capability as a baseline requirement rather than an afterthought.
Evolution is an authorised reseller of Sharry, SwiftConnect and an accredited partner of HID, Gallagher, and Lenel, all of whom offer mobile credential platforms with broad reader compatibility.
If you would like to understand what a mobile credential deployment would require for your specific estate and organisation, we would welcome a conversation.