Multi-factor methods for administrative accounts

Add multi-factor authentication methods to the authentication journey for your administrative staff to enroll in.

Multi-factor method configuration tabMulti-factor method configuration tab

Authentication methods & factors

One-time passcode & Magic Links

You can enable temporary one-time authentication factors that admins can receive via email, SMS, or voice call.

Email authenticator

Email authenticator settingsEmail authenticator settings

Phone authenticator

Phone authenticator settingsPhone authenticator settings

Email factors

  • Passcodes via email: sends a one-time passcode.
  • Magic links via email: sends an expirable link.

Phone factors

  • Passcode via text message or voice call: sends a one-time passcode by default, or initiates a voice call per request. Admins can ask for a voice call in their authentication workflow.
  • Magic links via text message: sends an expirable link.

Factor restriction

At each method, select which factors can be used for secondary authentication.

Authenticator restriction checkboxes

You can restrict admins to enroll only the email address(es) or phone number(s) as authenticators that are already added to their accounts.

Parameters

Passcode and Magic Link settingsPasscode and Magic Link settings

Passcode Lengths

You can specify the character length of the one-time passcodes for both email and phone number based methods in this field.

Recommended minimum length: 6 characters (digits) by default. Maximum length: 8 characters.

Passcode Lifetimes

You can specify the character length of the one-time passcodes for both email and phone number based methods in this field.

Recommended minimum length: 6 characters (digits) by default. Maximum length: 8 characters.

Magic Link Lifetime

You can enter the lifetime of Magic Links for both email and phone-based methods here.

The lifetime of a Magic Link starts from the time the passcode has been sent out. Strivacity Fusion invalidates the Magic Link once its lifetime has been exceeded. In this case, admins will have to restart the login process.

Soft token authenticator apps

You can enable the Google Authenticator or other soft token authenticator apps as an additional authenticator option for your administrative staff. Renewable one-time passcodes will be available via the application.

Soft token authenticator settingsSoft token authenticator settings

Label name

You can add a display name that will appear above the soft token in the authenticator application. This label helps admins in finding the right passcode in the authenticator app.

FIDO2 support

You can offer FIDO2-based authentication options for your admins by enabling platform biometric authentication or security key enrollment.

Platform biometric authenticator

If enabled, you allow admins to enroll the biometric information stored on their personal devices as an authenticator.

Platform biometric authenticator settingsPlatform biometric authenticator settings

🚧

The customer's enrollment and authentication experience will slightly vary depending on the biometric security system they have installed in their devices.

Security key

If enabled, you allow customers to enroll a roaming authenticator such as a security key (YubiKey, Titan Security Key) or a FIDO-compliant mobile device as an authenticator.

Security key authenticator settingsSecurity key authenticator settings

🚧

The customer's enrollment and authentication experience will slightly vary depending on the browser and OS the customer is using.

MFA enrollment configuration

Multi-factor method controls allow you to various enrollment options for admins or requrie them to in one or multiple authentication methods.

Optional MFA

You can leave it up entirely to admins to switch on MFA in their accounts by leaving enabled MFA methods optional.

🚧

One multi-factor method always needs to be enabled for your adaptive MFA workflow.

Admins can manage factors for each enrolled authentication method on their 'My Account' page:

MFA management in an administrative accountMFA management in an administrative account

Make at least one optional method mandatory at next login or registration

When selected, admins will be required to enroll in one of the optional authentication methods.

Make at least one optional method mandatory at next login or registrationMake at least one optional method mandatory at next login or registration

📘

This option is only available if there are no mandatory methods selected.

Mandatory MFA

You can require admins to enroll in specific MFA methods to enhance the security of their accounts.

📘

If multiple MFA methods are mandatory, admins will be required to enroll in each method in the following order: email authentication first, then phone authentication if mandatory, then soft token authentication if mandatory, etc.

After successful enrollment for each mandatory method, admins will only be stepped up to one of the enrolled methods during future logins.