Multi-factor authentication (MFA)
Multi-factor authentication (MFA) is an authentication technique that requires users to provide multiple forms of identification when logging in to Advanced Identity Cloud.
MFA provides a more secure method for users to access their accounts with the help of a device.
|
In this section, device means a piece of equipment that can display a one-time password (OTP), that supports push notifications, or that authenticates users with WebAuthn. Devices are most commonly mobile phones with authenticator applications that support the OATH protocol or push notifications, but could also include security keys and built-in biometric authenticators that store passkeys. |
The following is an example scenario of MFA in Advanced Identity Cloud:
-
In the Advanced Identity Cloud admin console, configure an authentication journey to capture the user’s username and password and to create OTPs.
-
An end user authenticates to Advanced Identity Cloud using that authentication journey.
-
Advanced Identity Cloud prompts the user to enter the username and password, the first factor in MFA.
-
If the user ID and password are correct, Advanced Identity Cloud sends the user an email with an OTP.
-
The user provides the OTP to Advanced Identity Cloud to successfully complete authentication, the second factor in MFA.
Common use cases
Choose a second factor that works with your users' devices and meets the assurance requirements of the protected resources:
-
Workforce MFA: Users sign on with a username and password, then approve a push notification on their registered phone. One-tap approval suits users who already carry a smartphone and want a quick second factor.
-
Passwordless or passkey sign-on: A passkey, such as Face ID or Touch ID, replaces the password with a phishing-resistant credential. Use passkeys to remove passwords from the sign-on experience entirely.
-
Push approval on a separate device: A user signs on in a browser on their laptop and approves the notification on their phone. This suits shared or locked-down workstations where typing a second factor is awkward.
-
One-time password fallback: OATH one-time passwords don’t require push delivery, so they suit users whose devices can’t receive push notifications. Time-based one-time passwords (TOTP) work in any authenticator app that supports the standard.
-
Recovery after a lost device: Users who lose their registered device sign on with recovery codes and register a replacement. Learn more in Recover after replacing a lost device.
Advanced Identity Cloud supports the following MFA protocols:
-
Use codes from an authenticator app using OATH to enable OTP authentication.
-
Authenticate using push notification to receive push notifications in a device as part of the authentication process.
-
Authenticate using a device with WebAuthn and passkeys to enable authentication using an authenticator device, such as a fingerprint scanner, or using passkeys for passwordless and usernameless authentication.