Configuring MFA
MFA is configured in two stages from the Web Manager > Settings > Authentication section:
Stage 1 — Create a Two-Factor Method
Go to Two-Factor Authentication and select +Add. Select the method type (TOTP, DUO, or RADIUS MFA) and complete the required fields. Each method can be enabled or disabled independently.
For a detailed description of each field in the TOTP, DUO, and RADIUS MFA editors, see the Two-Factor Authentication Reference.
Stage 2 — Associate the Method with an Authentication Method
Go to Authentication Methods, edit the desired method (Directory Service, OAuth, SAML, or RADIUS), and set the 2FA field to the second-factor method created in Stage 1. This links Layer 3 to the specific login path.
A single second-factor method can be assigned to multiple Authentication Methods. For example, the same TOTP configuration can protect both the Directory Service login and an OAuth-based SSO method.
What Comes Next
With MFA configured, you can complete the security model with the final layer:
Passkeys (WebAuthn): Offer passwordless login as a primary method or as an additional factor, providing phishing-resistant authentication.
See the Authentication Schemes overview for guidance on combining layers.