PingAM

Multi-factor authentication (MFA)

Multi-factor authentication (MFA) is an authentication technique that requires users to provide multiple forms of identification when signing on to AM.

Multi-factor authentication provides a more secure method for users to access their accounts with the help of a device. In this section, device means a piece of equipment that can display a one-time password, that supports push notifications, or that authenticates users with WebAuthn. Devices are most commonly mobile phones with authenticator apps that support the OATH protocol or push notifications, but could also include security keys and built-in biometric authenticators that store passkeys.

The following is an example scenario of multi-factor authentication in AM:

  1. An AM administrator configures an authentication tree to capture the user’s username and password and to create one-time passwords.

  2. An end user authenticates to AM using that authentication tree.

  3. AM prompts the user to enter the username and password—the first factor in multi-factor authentication.

  4. If the user ID and password were correct, AM sends the user an email with a one-time password.

  5. The user provides the one-time password to AM to successfully complete authentication—the second factor in multi-factor authentication.

Common use cases

Choose a second factor that works with your users' devices and meets the assurance requirements of the protected resources:

  • Workforce MFA: Users sign on with a username and password, then approve a push notification on their registered phone. One-tap approval suits users who already carry a smartphone and want a quick second factor.

  • Passwordless or passkey sign-on: A passkey, such as Face ID or Touch ID, replaces the password with a phishing-resistant credential. Use passkeys to remove passwords from the sign-on experience entirely.

  • Push approval on a separate device: A user signs on in a browser on their laptop and approves the notification on their phone. This suits shared or locked-down workstations where typing a second factor is awkward.

  • One-time password fallback: OATH one-time passwords don’t require push delivery, so they suit users whose devices can’t receive push notifications. Time-based one-time passwords (TOTP) work in any authenticator app that supports the standard.

  • Recovery after a lost device: Users who lose their registered device sign on with recovery codes and register a replacement. Learn more in Recover after replacing a lost device.

AM supports the following multi-factor authentication protocols: