How to Enable Multi-Factor Authentication for Your App

Enable Multi-Factor Authentication (MFA) protects users from attacks that leverage stolen credentials. Strong password policies are the first line of defense, but MFA offers additional protections like time-based one-time codes sent via SMS or automated phone calls.

Some apps require MFA, especially those that store sensitive data or process payments. Others allow users to choose to enroll in MFA from their account settings or as part of the registration process.

Security

Multi-factor authentication adds an extra layer of security to your app by requiring users to prove their identity with more than just their username and password. It ensures that even if the primary credentials are stolen, cyber criminals will not be able to access the account or the data stored on it.

Typical MFA solutions use SMS, automated phone calls, or hardware or software tokens on mobile devices to request the second factor of verification. For example, if you are using Authenticator, the user will be prompted to enter a code that is generated and texted to them. This demonstrates that they have the mobile device in their possession, which is a physical thing that only the legitimate user would possess.

To enable MFA in your app, set the required Authentication Factors from the Auth0 Dashboard. Then, catch the auth/multi-factor-auth-required error when the sign-in method is either sign In With Popup() or sign In With Redirect(). This will display a list of the available second factors to the user and ask them which they would like to use.

Adaptive MFA

Adaptive MFA uses multifaceted authentication to assess the risk a user poses at whatever point they demand access to a device or data. This combines various contextual factors like the day and time of the login attempt, the geolocation, or other variables like the employee’s device to determine the level of security required. Google

A better end-user experience: Unlike traditional MFA, adaptive MFA only prompts additional authentication if it detects a risky situation. This means users don’t have to go through a lengthy process every time they login, but only when the system detects unusual behavior.

Customizable rules: Adaptive MFA can be configured to create different rules depending on the context of the login. This can include requiring more security measures when a user logs in from an unsecure network or from a remote location, and bypassing MFA for low-risk policies when the employee is logged in to their home computer. This is especially important for distributed workforces who have the flexibility to work from any location.

Contextual MFA

MFA requires users to enter two types of verification factors – something they know (password) and something they have (one-time code generated by an authenticator app or sent to a phone). By eliminating passwords as the primary authentication factor, this approach makes it almost impossible for bad actors to gain unauthorized access.

However, relying solely on MFA doesn’t prevent phishing or other attacks from succeeding. And, as the threat landscape continues to evolve, organizations need a flexible security solution that adapts to the risks and user behavior. That’s where contextual MFA comes in.

Time-based MFA

TOTP adds a second factor to bolster security for your app. Typically, users sign in with a username and password, then enter an OTP code from their TOTP authenticator app to complete the authentication process.

TOTP works by combining the knowledge factor (something the user knows) with the possession factor (something the user owns). Because of the dependency on device time, you must ensure that your TOTP authenticator apps sync correctly and that your hardware devices support the TOTP protocol.

In Access Server 2.11.1 and newer, you can enable TOTP MFA by creating a group and enforcing the MFA setting for the group. You can also enable TOTP MFA for individual users and groups from the Admin Web UI. When enabled, Auth0 presents the MFA options to users when they first sign in and enables them to select a factor. They can later customize the Enable Multi-Factor Authentication flow using post-login Actions to require specific factors or combinations of factors.