Authentication Matrix

The table below outlines the authentication modes supported across different login methods. Availability of each mode depends on how authentication journeys are configured.

---

Supported Authentication Modes by Login Method

Login Method	Single Factor Authentication	Multi-Factor Authentication
FIDO Keys	✅	✅
LiveID	✅	✅
Behavioral Authentication	❌	✅
PIN	❌	✅
Service Account Login	❌	✅
Orion Desktop Authenticator	✅	✅
Hardware Tokens	❌	✅
QR	✅	✅
Push	✅	✅

How to Read This Matrix

• Single Factor Authentication Users can authenticate without entering a password, using a single secure method such as biometrics, passkeys, or device-based authentication.

• Multi-Factor Authentication (MFA) Users authenticate using a combination of factors, such as password + OTP, biometric + PIN, or device + approval.

Important Notes

Authentication methods are applied as part of configurable authentication journeys.

Some methods can be used independently for single factor authentication or combined with other login methods for multi-factor authentication.

PIN and OTP-based methods (including SMS, Email, Voice, app-generated codes, and hardware tokens) are reserved for use as second factors in two-factor (2FA) or multi-factor (MFA) authentication flows.