Authenticators
Turn on and configure MFA methods, enrollment policies, account recovery and sign-in protection.
Security → Authenticators lists every method with its type, enrolled users and status. Inactive authenticators can't be enrolled or used, even by people who already set them up.
Turning a method on doesn't require it
The default Global Session Policy is password-only. People are only asked for a second factor when a policy requires MFA. The default app authentication policy does require MFA, and administrators always need it.
Methods
| Authenticator | Configuration |
|---|---|
| Password | Password policies. |
| Authenticator app (TOTP), Email, Passkeys | Nothing beyond on/off. Only passkeys are phishing-resistant. |
| IdRa Verify (push) | ⚙ Number challenge: Never / Only for high-risk sign-ins / All push challenges. |
| Phone (SMS), Phone (voice call) | Phone settings (Twilio): Account SID, Auth Token, and a From number or Messaging Service. Limits: 30 s resend cooldown, 5 per person and 5 per number per hour, 20 per IP per hour. |
| Security question | Nothing. Password + security question doesn't count as MFA. |
| YubiKey OTP | Yubico Client ID and Secret key, or a self-hosted validation URL. |
| Duo Security | Duo Web SDK app Client ID, secret and API hostname; callback <BASE_URL>/api/factors/duo/callback. Test connection runs Duo's health check. |
| RSA SecurID | Cloud Authentication Service host, client key, authentication agent, optional assurance policy. Next-tokencode mode is supported; new-PIN mode isn't. |
IdRa Verify is a web app at /verify-app/ that people install on their phone (see Security methods). "No, it's not me" raises the person's risk to High.
Enrollment policies
Authenticators → Enrollment: per group, mark each authenticator Required (set up right after sign-in; until then the person can't reach an app or the admin console), Optional, or Disabled (can't be set up or used by that group, including at sign-in, so someone whose only factor is disabled needs an admin to reset their authenticators). The Default Policy covers everyone else and makes everything optional.
Password policies
Security → Password Policies are assigned to groups; the first active match applies, otherwise the Default Policy.
- Complexity: minimum length (12–256), lowercase, uppercase, number, symbol, no part of the username, no first or last name. Breached passwords are always refused.
- Age: password history (0–24), minimum age, expiry (days, 0 = never) and a warning before expiry.
- Lockout: lock after N failed attempts (default 10) and unlock automatically after N minutes (default 15; 0 = until an admin unlocks).
- Account recovery: which methods can start a reset (Email link, Phone (SMS), Phone (voice call), IdRa Verify) and an optional security question afterwards. Locked-out people can recover themselves; suspended or deactivated people can't.
Sign-in protection (Security → General)
- ThreatInsight: Disabled / Log / Log and enforce (blocks before the password is checked), with exempt zones. Uses public feeds (FireHOL level1, Tor exits, Spamhaus DROP, refreshed hourly) plus a password-spray detector over your own failed sign-ins. Add your office/VPN zone as exempt before enforcing.
- CAPTCHA: Cloudflare Turnstile, hCaptcha or reCAPTCHA v2 on sign-in and/or password recovery.
- Security notification emails: new sign-on, password changed, authenticator enrolled, authenticator reset. Each email has an "I don't recognize this" link that raises the person's risk and alerts Super Administrators. Wording is in Customizations → Emails.