Setup Multi-Factor Authentication

This page provides you detail on how to enable Multi factor authentication (MFA) through AdminX Portal.

---

Login with one-time passcodes

Users provide a password to their account. After password verification, users can receive an email message, text, or phone call containing a one-time passcode (OTP). This passcode is used as the second authentication factor for users to log in.

Enabling OTP authentication

1. Log in to your tenant as a community administrator.

2. Navigate to Authentication > Multi-factor Authentication.

3. Turn on the Login with One-Time Codes toggle to enable OTP authentication.

4. Expand the setting to view and configure additional options.

5. Click Save.

OTP delivery channels

Select the OTP delivery channels that users can use to receive one-time passcodes:

• Receive OTP using Email — users receive a passcode at their registered email address.

• Receive OTP using Text Message — users receive a passcode on their registered mobile number.

• Receive OTP using Phone Call — users receive a passcode via a voice call.

• Use passcodes from hardware tokens — users generate a passcode using their linked OneSpan Token.

Caution: Community administrators must configure their email, SMS, and Voice gateways before enabling OTP delivery through these channels.

OneSpan Token configuration

If your organization uses OneSpan tokens to generate one-time passcodes, additional configuration is required before they can be used in your tenant.

Prerequisites — ensure you have:

• OneSpan domain

• OneSpan service URL

Tip: Your OneSpan domain can be found in the Organization section of the OneSpan administration panel, under Domains and Organizational Units.

Enabling OneSpan Token as an OTP delivery method:

1. Navigate to OTP Delivery Channels.

2. Select Use passcodes from hardware tokens.

3. (Optional) Update the Passcode Text Description to instruct users to enter the OTP from their OneSpan token.

Configuring OneSpan Token settings:

1. Navigate to OneSpan Token Configuration.

2. Enter the following details:

   • Domain — your OneSpan domain (for example, master)

   • URL — your OneSpan service URL (for example, yourdomain.onespan.cloud)

3. Click Test Connection.

Verifying configuration:

1. Enter your OneSpan username.

2. Enter the OTP displayed on your OneSpan token.

3. Click Test.

A message indicates whether the connection was successful.

OneSpan event logs: Administrators and Help Desk Admins can audit the tenant Event Logs for OneSpan token activity. The E_OTP_VERIFIED and E_LOGIN_SUCCEEDED events show OneSpan activity as "otp_type":"hardware".

Enforce account lockout for incorrect passcodes

When enabled, the OTP account lockout policy locks a user account after a specified number of incorrect passcode attempts. The account is automatically unlocked after the configured lockout duration.

Account lockout threshold and time period

• Threshold — the number of incorrect OTP attempts allowed before the account is locked.

• Lockout time period — the number of minutes the account remains locked before it is automatically unlocked.

After the lockout duration expires, the user can attempt to sign in again. Administrators can track account lockouts caused by incorrect one-time passcodes from the Event Logs page; the E_OTP_LOCKED event captures details about the locked account.

Configuring OTP rate limiting

Community administrators can configure per-user rate limits for OTP requests to prevent excessive or abusive authentication attempts.

1. Log in to your tenant as a community administrator.

2. Navigate to Authentication > Multi-factor Authentication.

3. Enable Limit OTP Requests.

4. Enter the maximum number of OTP requests allowed per user within the defined time window.

   Note: Minimum allowed value is 10 requests.

5. Click Save.

OTP rate limiting behavior

When the configured OTP request limit is reached:

• OTP request actions (including Resend Code) are disabled.

• A countdown timer indicates when the next request can be made.

• The user sees a message that OTP requests are temporarily unavailable.

• The restriction applies across sessions and browser tabs for the same user.

Applicable scenarios

OTP rate limiting applies to all flows where OTP verification is used, including:

• User login with OTP

• Passcode generation from My Profile

• Adding or updating a phone number

• Step-up authentication and additional verification flows

Note: An E_OTP_RATE_LIMIT_HIT event is generated when the limit is exceeded. For more information, see Event Logs.

What happens after the cooldown period

• OTP requests are automatically re-enabled after the cooldown period.

• The Resend Code option becomes available again.

• Users can resume normal authentication flows.