PingOne

Configuring an MFA policy for strong authentication

Configure the multi-factor authentication (MFA) policy. Here you can add and configure the relevant authentication methods. You can then add the MFA policy as a step to your authentication policy.

Before you begin

  • Optionally configure MFA general settings, including the maximum number of MFA methods allowed per user, authentication method selection, and account lockout settings. Learn more in MFA Settings.

  • You can only create multiple MFA policies in a Customer (PingOne MFA) environment.

  • (Customer only) Configure an authentication policy with an MFA step. Learn more in Authentication policies.

    In a Workforce environment, the authentication policy is created automatically.

  • Some authentication methods have configuration steps that you must complete in addition to configuring the MFA policy. Some of these additional configuration steps are compulsory (such as configuring an application for PingID mobile app or configuring a FIDO policy for FIDO2 authentication), and some are optional (such as configuring a notification template for SMS and voice authentication).

    Learn more about the configuration options, as well as any limitations or requirements for each authentication method, in Configuring strong authentication methods (MFA).

About this task

To create an MFA policy:

  • Configure the relevant MFA policy settings for the authentication methods that you want to enable.

  • If the authentication method requires additional configuration, make sure to complete the additional configuration steps, as outlined in this procedure.

Steps

  1. Go to Authentication > MFA.

  2. On the MFA Policies page, click the icon.

  3. In the Name field, enter a meaningful name for the policy.

    The maximum length is 256 characters.

  4. In the Method Selection list, for users with more than one paired device, define which device is presented to the user for authentication. Select one.

    Choose from:

    • User selected default: Allow the user to authenticate with the device they selected as their default device.

    • Prompt user to select: If more than one method is available, when prompted to authenticate, the user is prompted to choose a device from the authentication methods they have paired to their account. Only authentication methods permitted by the relevant authentication policy are shown.

    • (Workforce only) Always display devices: Even if the user has only one permitted authentication method paired with their account, the user is prompted to select an authentication method.

      The Method Selection setting isn’t applied if you have enabled device authorization and the user is accessing an application from a trusted mobile device. It’s also not applied if the user is trying to access the application with a browser that they have used for FIDO2 authentication in the past. In such cases, FIDO2 is used.

  5. In the Send notification when new device paired list, select how the user should be notified when a new device has been added to their account.

    Choose from:

    • No notification: User should not be notified.

    • By email, else SMS: By email (or by SMS if no email address available in the user profile).

    • By SMS, else email: By SMS (or by email if no phone number available in the user profile).

  6. Enable and configure the authentication methods you want to provide for your users:

    (Customer only) Mobile applications

    1. Click (Add Applications), select the name of the mobile application to use from those you have defined for the environment, and click Save. Learn more about creating an application in Applications.

      1. Define the following fields for the application:

        • OTP & Push: The mechanism that should be used to allow the user to authenticate.

          Choose from:

          • Push: Use only the standard push mechanism.

          • OTP: Use only OTPs.

          • Push & OTP: Use the standard push mechanism and allow OTP as a backup mechanism.

        • Push Notification Timeout: The amount of time that a user has to respond to a push notification before it expires.

        • Allow Pairing: To prevent users from pairing their device with this authentication method, clear the checkbox.

        • Device Integrity: Define how authentication and registration attempts should proceed in the event that a device integrity check yields inconclusive results. Select Permissive if you want to allow the process to continue. Select Restrictive if you want to block the user in such situations.

          The Permissive/Restrictive buttons are displayed only if device integrity checking is enabled for the application on the Authenticator tab of the Applications definition page.

    • Auto Enrollment: Auto Enrollment means that the user can authenticate from an unpaired device, and the successful authentication results in the pairing of the device for MFA. To enable, select the checkbox.

      To allow automatic enrollment even if the user does not have any existing paired devices, go to the authentication policy that you created. In the MFA step, verify that None or Incompatible Methods is set to Bypass. Learn more in Editing an authentication policy.

    • Device Authorization: When enabled, the trusted device handles the authentication automatically, and no user involvement is required. This automatic mechanism is used only if the user is requesting access from the same device. To enable, select the checkbox.

      Select the Device Authorization checkbox and then choose one of the following options for Extra Verification:

      • Disabled: Do not use an extra verification step.

      • Permissive: A push is sent to the device to be handled automatically. If the push is not received, access is granted nonetheless.

      • Restrictive: A push is sent to the device to be handled automatically. If the push is not received, access is not granted.

    • Pairing Key Lifetime: Indicate how much time an issued pairing key can be used until it expires.

    • Limit Push Notifications: Use this option to help you prevent attacks based on repeated push notifications that lead users to eventually accept the request. Define the number of consecutive push notifications that can be ignored or rejected by a user within a defined period before push notifications are blocked for the application:

      • Push Limit: The number of notifications that can be declined or ignored (1 - 50).

      • Time Period: Time period during which the notifications are counted towards the limit (1 minute - 120 minutes).

      • Lock Duration: Duration for which the device is blocked (2 - 30 minutes).

    (Workforce only) PingID mobile app

    If you haven’t already done so, configure the PingID mobile app. You can also do this after you finish configuring the MFA policy. Learn more in (Workforce Only) Configuring the PingID mobile application settings.

    1. In the Mobile Applications section, configure the following fields:

      • Passcode Failure Limit: Define the maximum number of times that a one-time passcode (OTP) entry can fail.

      • Lock Duration: Set the amount of time that the authentication method is locked if the Passcode Failure Limit is exceeded. Accepted values range from 2 - 30 minutes.

      • Rename device during pairing: Select the checkbox to allow users to define a device nickname during the pairing flow.

    2. Under Add Applications, PingID mobile, configure the following PingID mobile app-specific fields:

      • Authentication request timeout: Define the amount of time given before an authetication request times out.

        • Device Timeout: Defines the amount of time until the push notification reaches the device. The default is 25 seconds.

        • Total Timeout: Defines the amount of time the user has to complete the authentication request. The default is 40 seconds.

          Total Timeout must exceed Device Timeout by at least 15 seconds.

      • Pairing Key Lifetime: Indicate how much time an issued pairing key or QR code can be used until it expires. (Minimum 1 minute, maximum 48 hours).

      • Allow Pairing: Select the checkbox to allow users to pair PingID mobile app. To only allow users from specific IP addresses to pair PingID mobile application, in the list, select Only these addresses, and then enter the IP addresses in the format shown in the field.

    3. Limit Push Notifications: Use this option to help you prevent attacks based on repeated push notifications that lead users to eventually accept the request. Define the number of consecutive push notifications that can be ignored or rejected by a user within a defined period before push notifications are blocked for the application:

      1. Push Limit: Number of notifications that can be declined or ignored (1 - 50).

      2. Time Period: Time period during which the push notifications are counted towards the push limit (minimum 1 minute, maximum 120 minutes).

      3. Lock Duration: Duration for which the device is blocked from authenticating. (1 second - 120 minutes.)

        Limiting the number of push notifications that can be declined or ignored can reduce the likelihood of a user acknowledging a malicious push notification as part of an MFA fatigue attack.

    4. (Optional) Enable the following authentication options for users of PingID mobile app:

      Only the options that are enabled here are available as an Allowed Authentiation Method in PingID policy. You can find more information about PingID policy in Configuring PingID policy.

      • Push Notification: Send push notifications to the user’s device to notify them of an authentication request.

      • One-Time Passcode: Allow the user to use a one-time passcode (OTP) to authenticate. The OTP can be used to authenticate even when offline.

      • Biometrics: Allow the user to authenticate with their device biometrics, such as face or fingerprint authentication.

      • Number Matching: Allow the user to authenticate by matching the number displayed on the user’s accessing device with the corresponding number in PingID mobile app.

    Authenticator App (TOTP)

    • In the Allowed Authentication Methods section, select the Authenticator App checkbox and then configure the following fields:

      • Passcode Failure Limit: Define the maximum number of times that OTP entry can fail (1 - 7).

        • Authenticator App (TOTP) passcodes are valid for 30 seconds (refresh duration). However, to cover time synchronization issues, there is a grace period of 8 times the refresh duration in each direction. Taking the grace period into account, the passcode is valid for the base 30 seconds plus 8 x 30 = 240 seconds behind the time of issue and 240 seconds past the expiration time.

        • In authentication flows that implement one-time authentication with the PingOne MFA API, users are not blocked after exceeding the configured passcode failure limit, even if you specify a blocking period in the MFA policy.

      • Lock Duration: The amount of time this authentication method is locked if the Passcode Failure Limit is exceeded (2 - 30 minutes).

      • Allow Pairing: To prevent users from pairing their device with this authentication method, clear the checkbox.

      • Rename device during pairing: Select the checkbox to allow users to define a device nickname during the pairing flow.

      • Show application name: To help users recognize which application the OTP displayed in their authenticator app is for, select this option and provide the text that should be displayed alongside the OTP. If you’re using the same MFA policy for multiple applications, use a name that reflects the group of applications.

        If you provide an application name, remember that users see the name that was in the MFA policy when they paired their device. If you subsequently update the application name in the MFA policy, the new name will be seen only by users who paired their device after the change was made.
    (Workforce only) YubiKey OTP

    • In the Allowed Authentication Methods section, select the YubiKey checkbox and then configure the following fields:

      • Passcode Failure Limit: Define the maximum number of times that OTP entry can fail (1 - 7).

        In authentication flows that implement one time authentication with the PingOne MFA API, users are not blocked after exceeding the configured passcode failure limit, even if you specify a blocking period in the MFA policy.

      • Lock Duration: The amount of time this authentication method is locked if the Passcode Failure Limit is exceeded (2 - 30 minutes).

      • Allow Pairing: To prevent users from pairing their device with this authentication method, clear the checkbox.

      • Rename device during pairing: Select the checkbox to allow users to define a device nickname during the pairing flow.

    Email

    • In the Allowed Authentication Methods section, select the Email checkbox, and then configure the following fields:

      • Passcode Failure Limit: Define the maximum number of times that OTP entry can fail (1 - 7).

        In authentication flows that implement one-time authentication with the PingOne MFA API, users are not blocked after exceeding the configured passcode failure limit, even if you specify a blocking period in the MFA policy.

      • Lock Duration: The amount of time this authentication method is locked if the Passcode Failure Limit is exceeded (0 seconds - 30 minutes).

      • Passcode Lifetime: The amount of time the passcode is valid before it expires (maximum 30 minutes).

        An OTP is valid for 30 minutes by default (refresh duration).

      • (Customer only) Passcode Length: Configure the length of the OTP (6 - 10 digits). The default is 6.

      • Allow Pairing: To prevent users from pairing their device with this authentication method, clear the checkbox.

      • Rename device during pairing: Select the checkbox to allow users to define a device nickname during the pairing flow.

        The following options are available for Workforce (PingID) accounts only:
    SMS and Voice

    1. In the Allowed Authentication Methods section, select the checkbox for the relevant authentication method, and then configure the following fields for each method that you want to add:

      • Passcode Failure Limit: Define the maximum number of times that OTP entry can fail (1 - 7).

        In authentication flows that implement one-time authentication with the PingOne MFA API, users are not blocked after exceeding the configured passcode failure limit, even if you specify a blocking period in the MFA policy.

      • Lock Duration: The amount of time this authentication method is locked if the Passcode Failure Limit is exceeded (0 seconds - 30 minutes).

      • Passcode Lifetime: The amount of time the passcode is valid before it expires (maximum 30 minutes).

        An OTP is valid for 30 minutes by default (refresh duration).

      • (Customer only) Passcode Length: Configure the length of the OTP (6 - 10 digits). The default is 6.

      • Allow Pairing: To prevent users from pairing their device with this authentication method, clear the checkbox.

      • Rename device during pairing: Select the checkbox to allow users to define a device nickname during the pairing flow.

    2. Configure all other SMS or voice-related configurations, including creating notification templates, limiting the number of SMS or voice messages that a user can send, localizing messages, and creating a custom sender account. Learn more in Configuring SMS and voice authentication

    FIDO2

    • In the Allowed Authentication Methods section, select the FIDO2 checkbox, and then configure the following fields.

      Two FIDO policies are available out-of-the-box. You can modify an existing policy or create additional FIDO policies. Learn more in FIDO policies.

      • In the Allowed Authentication Methods section, select FIDO2 and in the FIDO Policy field, select the FIDO policy that you want to apply, or select Use the default policy to use the default FIDO policy.

      • Allow Pairing: To prevent users from pairing their device with this authentication method, clear the checkbox.

      • Rename device during pairing: Select the checkbox to allow users to define a nickname for the device during the pairing flow.

        If you are editing an existing MFA policy that is using a deprecated FIDO Biometrics or Security Key authentication method, you’ll need to replace it with the FIDO2 authentication method and reference an enhanced FIDO policy. Learn more in Updating an existing MFA policy to use FIDO2.
    (Workforce Only) PingID desktop app

    1. Configure the following fields:

      • Pairing Key Lifetime: Indicates the amount of time the pairing key and QR code remain valid before they expire. (Minimum 1 minute, maximum 48 hours).

      • Allow Pairing: Select the checkbox to allow users to pair PingID desktop app. To only allow users from specific IP addresses to pair PingID mobile application, in the list, select [.uicontrolOnly these addresses, and then enter the IP addresses in the format shown in the field.

      • Rename device during pairing: Select the checkbox to allow users to define a device nickname during the pairing flow.

    2. After you complete and save the MFA policy, add a proxy, and add a security PIN for PingID Desktop app in the PingID Desktop application settings. Learn more in (Workforce Only) Configuring the PingID desktop application.

    (Workforce only) OATH Token

    1. In the Allowed Authentication Methods section, select the OATH Token checkbox, and then configure the following fields:

      • Passcode Failure Limit: Define the maximum number of times that OTP entry can fail (1 - 7).

      • Lock Duration: The amount of time this authentication method is locked if the Passcode Failure Limit is exceeded (0 seconds - 30 minutes).

      • Allow Pairing: To prevent users from pairing their device with this authentication method, clear the check box.

      • Rename device during pairing: Select the checkbox to allow users to define a device nickname during the pairing flow.

    2. Click the Configure OATH tokens link. The OATH token configurations panel opens, showing a list of previously saved tokens. To add an OATH token, do the following:

      1. Click Import Token.

      2. In the Import OATH Token popup window, click Choose File, and navigate to the token seed file. For information about the token seed format, see Configuring OATH token authentication.

      3. Select the Token Type.

        The token type and OTP length are applied to all entries in the imported file.

      4. If you selected a TOTP Token Type, select the Algorithm you want to use and the Refresh Interval.

        The algorithm and refresh interval are applied to all entries in the imported file.

      5. Click Import. The new tokens appear in the list.

        • You can find a list of prerequisites and supported OATH tokens in Configuring OATH token authentication.

        • Make sure your OATH seed token is valid and is not already in use. If your seed file contains entries that duplicate an existing token, you’ll see an Incomplete Token Report error.

        • To revoke one or more OATH tokens, select the checkbox next to the tokens you want to revoke, and then click Revoke.

        • To export token details to a downloadable .CSV file, select the checkbox next to the tokens you want to revoke, and then click Export CSV.

  7. Click Save.

    Result:

    The policy is added to the Policy list.

    In the Policy list, click a policy to see a summary of the policy details in the right pane or edit an existing policy.

Next steps