Configure your MFA methods

MFA methods are the ways users confirm their identity at sign-in:

• Push notifications

• Authenticator apps (TOTP)

• USB keys (HOTP)

• FIDO2 security keys.

You enable them in ⚙️ Server settings ▸ MFA, under Authentication methods.

Each card shows how many users are enrolled with the method. Click this count to list them. The switch enables or disables the method.

Before you enable methods, keep in mind:

• MFA methods are enabled for the whole UserLock server. MFA access policies decide when users authenticate, not which method they use.

• Users choose among the enabled methods when they enroll.

• At least one method must stay enabled.

• Disabling a method doesn’t remove existing enrollments. Users already enrolled can still sign in with it, but new users can’t choose it.

• To move a user to another method, reset their MFA configuration. The user enrolls again at the next sign-in.

• A user can’t combine FIDO2 security keys with Push notifications or USB keys (HOTP).

1. In ⚙️ Server settings ▸ MFA, turn on Push notifications. UserLock connects to the IS Decisions push notification server.

2. Wait for Connection established!, then close the dialog.

3. Select Save.

If the activation fails, the dialog shows an error code. Check that the primary server has Internet access, and contact IS Decisions support if the error persists.

Users enroll with any TOTP authenticator app, such as Google Authenticator or Microsoft Authenticator, or with a Token2 programmable token..

1. In ⚙️ Server settings ▸ MFA, turn on Authenticator app (TOTP).

2. Select Save.

Users enroll a YubiKey or a Token2 HOTP key. They must enroll it from a session opened directly on the computer, not through Remote Desktop.

1. In ⚙️ Server settings ▸ MFA, turn on USB keys (HOTP).

2. Select Save.

Each key is bound to a relying-party ID (RP ID): a domain name that you choose when you enable FIDO2. Choose it according to where users sign in with their key:

• Windows sessions only: keep the domain UserLock proposes, or enter another domain of your choice.

• IIS applications or SSO: use the domain of the IIS MFA public URL, or one of its parent domains. For https://auth.example.com/ulmfa, use example.com.

The RP ID must be a domain name with at least one dot. It can’t be an IP address.

1. Go to ⚙️ Server settings ▸ MFA.

2. If users sign in to IIS applications or SSO, under MFA for websites on IIS servers, set the Public URL.

3. Turn on FIDO2 security keys. The Configure FIDO2 dialog opens.

4. In FIDO2 Relying Party ID, check the proposed domain and change it if needed.

5. Select Continue, then Save.

For other questions, such as PIN policy, Remote Desktop support, offline sign-in or lost keys, see FAQ > FIDO2 security keys.

A backup method lets users sign in when their main method is unavailable, for example when they forget their phone.

In ⚙️ Server settings ▸ MFA, under Enrollment & recovery, the Alternative MFA method setting has three options:

• Enabled: users can register a backup method if they want.

• Disabled: users can’t register a backup method.

• Force: users must register a backup method to complete enrollment.

Enabled and Force are available when at least two methods are enabled, or when only FIDO2 security keys is enabled, since users can then register a second key.

Recovery codes are single-use codes that users enter when their MFA method is unavailable. UserLock generates them at enrollment and shows them only once.

1. In ⚙️ Server settings ▸ MFA, under Enrollment & recovery, turn on Recovery codes.

2. In Codes per user, enter a number from 4 to 20.

3. Select Save.

Click View example to see the codes as users see them. Codes can’t be displayed again: if a user loses them, reset their MFA configuration.