MDU Access Control: Designing for 100 to 5,000 Units

Large MDU access control design follows a zoned architecture: perimeter (building entrance), vertical (lift/elevator floor access), and horizontal (corridor and unit door). For 500–5,000 units, the SIP intercom server must be sized for concurrent call load — typically 1–3% of units calling simultaneously at peak. A dedicated on-premise SIP server (Asterisk or 3CX) is preferred over cloud-only for buildings above 500 units to ensure reliability during internet outages. Lift integration using RS-485 or Wiegand output from the access control panel restricts floor access by credential. Visitor management at this scale requires a digital pre-authorization system — paper logbooks and guard discretion do not scale beyond 200 units.

The number of door stations depends on building entry points, not unit count. A single-entrance tower of 500 units needs one lobby door station; a podium development with multiple lobbies and parking entrances may need 4–8 door stations for the same unit count. Each door station is a separate SIP endpoint on the building's SIP server. For buildings with multiple wings or blocks sharing a common access control platform, each entrance requires its own door station with its own SIP extension — the SIP server routes calls to the correct resident extension regardless of which entrance the visitor uses. Specify door stations with apartment directory capacity matching your unit count: most models support 100–9,999 directory entries.

Lift integration restricts elevator floor access by credential, preventing visitors and unauthorized users from accessing residential floors directly. Integration methods: Wiegand or OSDP reader inside the lift cab connected to the access control panel, which enables only the floors the credential holder is authorized for after a valid badge or PIN. RS-485 integration with the lift controller allows the access control system to send floor enable commands directly to the lift's control board. For large MDU buildings, specify lift controllers with open protocol integration (Modbus, BACnet, or manufacturer API) to avoid proprietary middleware. Anti-tailgating on lifts requires occupancy sensors or camera-based detection to identify multiple people entering on one credential.

For MDU buildings above 500 units, digital pre-authorization is the only scalable visitor management approach. Residents generate a time-limited QR code or PIN via the building app and share it with their visitor before arrival. The visitor scans the QR code at the entrance intercom or enters the PIN, and the door releases automatically without calling the resident. This reduces guard intervention, eliminates intercom congestion during peak hours, and creates a complete audit trail of visitor access. The building management platform logs the invitation (which resident, which visitor, valid time window) and the actual entry event. Systems that require every visitor to call the resident and wait for manual release do not scale above 200 units without significant guard staffing.

Bulk provisioning at MDU move-in requires a platform that supports CSV import of resident data (name, unit number, phone number, move-in date) and automated credential distribution. The platform generates unique activation links or QR codes per unit, sent to residents via SMS or email — residents download the app and activate their credential without visiting the management office. For buildings with phased handover (floors or wings handed over at different dates), the platform must support activation scheduling tied to individual unit handover dates. Avoid platforms requiring manual credential creation per resident — at 1,000+ units, manual provisioning takes weeks and creates errors. Test the bulk provisioning flow with 50 test accounts before building launch.

100-unit MDU: cloud-hosted SIP server sufficient, 1–2 entrance door stations, smartphone app delivery eliminating indoor monitors, basic access log in cloud platform, single access control panel for entrance and common areas. 1,000-unit development: on-premise SIP server mandatory for reliability, 3–6 entrance points with dedicated door stations, lift integration for all residential floors, visitor pre-authorization platform, dedicated network VLAN for access control traffic, redundant server with failover. 5,000-unit development: distributed SIP server architecture per building block, central management platform aggregating all blocks, API integration with property management software, 24/7 NOC monitoring, dedicated fiber backbone between blocks, SLA-backed maintenance contract with 4-hour response time. Scale the architecture to match the operational complexity — over-engineering a 100-unit building and under-engineering a 5,000-unit development are equally costly mistakes.

The seven most common MDU access control installation mistakes: using Wi-Fi instead of wired PoE for entrance door stations (intermittent connectivity causes missed calls); assigning dynamic DHCP addresses to door stations and cameras (IP changes after lease renewal break connections); installing a single door station for a building with multiple lobby entrances (visitors at secondary entrances cannot call residents); choosing a cloud-only platform without offline fallback (internet outage locks all residents out); not testing lift integration before handover (floor restrictions fail silently); underestimating SIP server capacity for concurrent calls during peak move-in periods; and failing to document the network topology and device IP assignments for the property management team who will maintain the system after the installer leaves.