Push notification MFA

During the multi-factor authentication (MFA) enrollment step, customers can register their mobile device as an authenticator so future sign-ins can be approved with a push notification in your brand's mobile app.

Customers can enroll a device at three points:

• During registration, as part of the MFA enrollment step.
• Through progressive profiling on a later login.
• From the My Account portal, under Security settings > Multi-factor authentication (MFA) > Add new method.

What customers experience

1. The customer is shown the Register a mobile device screen with a QR code, and is asked to scan it with their device's camera.
2. Scanning the QR code opens your brand's mobile app:
   1. If the customer isn't logged in to the app, they're prompted to log in first.
   2. If the app isn't installed, the customer is redirected to the appropriate app store download for their device.
3. Once logged in, the app shows the enroll device screen, and the customer confirms the enrollment.
4. The device is registered with a default name based on its make and model (for example, "Motorola - Moto G55"). The customer can rename it during enrollment.
5. The customer sees a confirmation that their mobile device is registered and can now receive push notifications as an authentication method. If they enrolled from a browser, they return to their original device to continue.

Managing enrolled devices

Customers can enroll more than one device. In the My Account portal, under Security settings, they can:

• rename an enrolled device,
• remove an enrolled device, or
• add another device with the same QR code flow.

Settings that affect this step

• Adaptive Access policy: Controls whether push notification MFA is available and whether enrollment is optional or mandatory.
• Push notification configuration: A saved delivery service configuration is required before the method can be offered.
• Branding policy: Controls the appearance and text of the enrollment screens.

What happens next

After enrollment, the customer continues to the next step of their journey. Their device shows up as an available method on the MFA selection screen at their next login. See push notification MFA in the login journey for the authentication experience.