Methods and apparatus for controlling user access to a computing environment. In one embodiment, a user gains access to at least one computing device at a first time by providing credential information to authenticate the user's identity; presents to a first user interface for the at least one computing device a physical device comprising identifying information to associate the device with the authenticated user; and gains access at a second time by presenting the physical device to the first user interface or a different user interface without providing the credential information. In another embodiment, in response to a user seeking access by presenting a physical device comprising identifying information, granting access only when the device was previously associated with a user who, within a grace period, provided credential information to authenticate the user's identity.