# Authenticators (https://docs.idra.zone/docs/admin/authenticators)

Turn on and configure MFA methods, enrollment policies, account recovery and sign-in protection.

**Security → Authenticators** lists every method with its type, enrolled users and status. Inactive authenticators can't be enrolled **or used**, even by people who already set them up.

**Turning a method on doesn't require it**

  The default Global Session Policy is password-only. People are only asked for a second factor when
  a [policy](https://docs.idra.zone/docs/admin/policies) requires MFA. The default app authentication policy does
  require MFA, and administrators always need it.

## Methods

| Authenticator | Configuration |
| --- | --- |
| **Password** | [Password policies](#password-policies). |
| **Authenticator app** (TOTP), **Email**, **Passkeys** | Nothing beyond on/off. Only passkeys are phishing-resistant. |
| **IdRa Verify** (push) | ⚙ **Number challenge**: Never / Only for high-risk sign-ins / All push challenges. |
| **Phone (SMS)**, **Phone (voice call)** | **Phone settings** (Twilio): Account SID, Auth Token, and a From number or Messaging Service. Limits: 30 s resend cooldown, 5 per person and 5 per number per hour, 20 per IP per hour. |
| **Security question** | Nothing. Password + security question doesn't count as MFA. |
| **YubiKey OTP** | Yubico Client ID and Secret key, or a self-hosted validation URL. |
| **Duo Security** | Duo Web SDK app Client ID, secret and API hostname; callback `<BASE_URL>/api/factors/duo/callback`. **Test connection** runs Duo's health check. |
| **RSA SecurID** | Cloud Authentication Service host, client key, authentication agent, optional assurance policy. Next-tokencode mode is supported; new-PIN mode isn't. |

IdRa Verify is a web app at `/verify-app/` that people install on their phone (see [Security methods](https://docs.idra.zone/docs/end-users/mfa#idra-verify)). "No, it's not me" raises the person's risk to High.

## Enrollment policies

**Authenticators → Enrollment**: per group, mark each authenticator **Required** (set up right after sign-in; until then the person can't reach an app or the admin console), **Optional**, or **Disabled** (can't be set up or used by that group, including at sign-in, so someone whose only factor is disabled needs an admin to reset their authenticators). The **Default Policy** covers everyone else and makes everything optional.

## Password policies

**Security → Password Policies** are assigned to groups; the first active match applies, otherwise the Default Policy.

- **Complexity:** minimum length (12–256), lowercase, uppercase, number, symbol, no part of the username, no first or last name. Breached passwords are always refused.
- **Age:** password history (0–24), minimum age, expiry (days, 0 = never) and a warning before expiry.
- **Lockout:** lock after N failed attempts (default 10) and unlock automatically after N minutes (default 15; 0 = until an admin unlocks).
- **Account recovery:** which methods can start a reset (Email link, Phone (SMS), Phone (voice call), IdRa Verify) and an optional security question afterwards. Locked-out people can recover themselves; suspended or deactivated people can't.

## Sign-in protection (Security → General)

- **ThreatInsight:** Disabled / Log / Log and enforce (blocks before the password is checked), with exempt zones. Uses public feeds (FireHOL level1, Tor exits, Spamhaus DROP, refreshed hourly) plus a password-spray detector over your own failed sign-ins. Add your office/VPN zone as exempt before enforcing.
- **CAPTCHA:** Cloudflare Turnstile, hCaptcha or reCAPTCHA v2 on sign-in and/or password recovery.
- **Security notification emails:** new sign-on, password changed, authenticator enrolled, authenticator reset. Each email has an "I don't recognize this" link that raises the person's risk and alerts Super Administrators. Wording is in **Customizations → Emails**.