---
title: Multi-factor authentication
description: Require multi-factor authentication when users connect the PingOne Privilege app and when they run privileged commands.
component: privilege
page_id: privilege:human-privilege:configuration/multi-factor-authentication/index
canonical_url: https://docs.pingidentity.com/privilege/human-privilege/configuration/multi-factor-authentication/index.html
llms_txt: https://docs.pingidentity.com/privilege/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: September 10, 2026
page_aliases: ["configuration:multi-factor-authentication.adoc"]
---

# Multi-factor authentication

PingOne Privilege integrates with PingID multi-factor authentication (MFA) *(tooltip: \<div class="paragraph">
\<p>An electronic authentication method where a user is granted access only after presenting two or more verification factors for authentication.\</p>
\</div>)*, so users can authenticate with the MFA method their organization already uses. This section explains how to challenge users with MFA at two points:

* When users connect the PingOne Privilege app to the gateway in Endpoint Controller-based deployments.

* When users run `sudo` commands on Unix/Linux servers with just-in-time (JIT) access.

The following topics explain how to require MFA:

* [Requiring PingID MFA for PingOne Privilege app connections](pingid-mfa-app-connect.html)

  Challenge users with PingID MFA when they connect the PingOne Privilege app to the gateway.

* [Configuring step-up authentication for sudo commands](step-up-authentication-sudo.html)

  Require an MFA challenge when users run `sudo` commands on Unix/Linux servers with just-in-time (JIT) access.