Earlier quoted context omitted.
Look into Windows Hello for Business. It's very nice in the enterprise for all of this. Native facial recognition or fingerprint, and various other factors can be added.
Causes all sorts of hell with Remote Desktop, however. But it’s the right direction. For those with a Mac and an Apple Watch you can make the watch automatically lock and unlock based on Bluetooth distance.
I deployed WHfB at our $LARGE_ENTERPRISE and opted against using BT RSSI as a trusted signal because it's just too unpredictable. Probably because the Windows space is much more varied, but an RSSI that'd work for one device at ~8' away would fail to lock another when two cube rows away. Meaning, we knew users would start to depend on it, but it wouldn't work as they thought.
Thus, still policies of locking machines, it's now just easier to unlock. (And arguably more secure because now less password typing means far fewer chances for keyloggers to get network-usable credentials.)