Password + OTP

Users authenticate by entering their Active Directory password followed by a one-time passcode. This is the most common MFA configuration for organisations transitioning away from password-only login.

---

Admin Setup

Before users can authenticate with Password + OTP, configure an Adaptive Auth Journey in AdminX.

1. Log in to AdminX as a community administrator.

2. Navigate to Applications > Windows MFA > Adaptive Auth Journeys.

3. Click Add new adaptive auth journey.

4. Provide a journey name and define conditions (by user, group, or machine name).

5. Set the Action to MFA Required.

6. Select one of the following authentication methods depending on which OTP source you want to allow:

Method	OTP Source
Password & any OTP	1Kosmos app TOTP, SMS, Email, or Voice call
Password & 1Kosmos App Codes	1Kosmos mobile app TOTP only
Password & SMS OTP	SMS to registered mobile number
Password & Email OTP	Email to registered email address
Password & Voice OTP	Voice call to registered phone number

1. Click Save.

For SMS, Email, and Voice OTP, the user's phone number or email address must be present on their Active Directory profile. If the attribute is missing, the option will not be presented to the user at login.

User Guide — Logging in with Password + OTP

1. On the Windows login screen, click the 1Kosmos tile.

2. If using the Other User tile, enter your username and click Submit.

3. On the Choose an authentication method screen, click Password.

4. Enter your Active Directory password and click the arrow to proceed.

5. On the Enter your verification code screen, enter the OTP from your chosen source:

   • 1Kosmos app — open the app and use the TOTP code displayed

   • SMS — click Send Code via SMS and enter the code received

   • Email — click Send Code via Email and enter the code received

   • Voice — click Send Code via Call and enter the code received

6. Press Enter. You will be logged into Windows.

If you enter an incorrect OTP more than the maximum number of attempts configured by your administrator, your account will be locked. Contact your help desk to unlock it.

Troubleshooting

Issue	Likely Cause	Resolution
OTP option not appearing at login	No journey configured, or journey does not include OTP method	Check AdminX auth journey configuration
SMS / Email / Voice option not appearing	Phone number or email not on AD profile	Add the attribute to the user's AD profile
OTP code rejected	Code expired (TOTP codes are time-sensitive)	Generate a new code and try again immediately
Account locked after failed attempts	Max OTP attempts exceeded	Contact help desk to unlock