---
locale: "en"
updated_at: "2026-04-10T13:01:54.857Z"
canonical: "https://www.isdecisions.com/en/userlock/docs/reference/server-settings/mfa"
---

# MFA settings

Allowed methods, MFA for IIS, enrollment options.

> **Note**
>
> - To access this page, go to **Server settings ▸ MFA**.
> - You need at least *read* [permission](/userlock/docs/reference/server-settings/permissions) on Server settings to view this page.

## MFA methods

![](https://a.storyblok.com/f/122374/1359x748/551ee9a48b/server-settings-mfa-methods.png)

Select which MFA methods are available to users. 

Multiple methods can be activated at the same time to increase flexibility and security.

| Method | Description |
| --- | --- |
| **Push notifications** | Requires the *UserLock Push* mobile app (iOS/Android). Users receive a prompt on their smartphone to approve or deny login attempts. |
| **Authenticator App** | Compatible with any TOTP-based app (e.g., Google Authenticator, Microsoft Authenticator, Authy). Users enroll by scanning a QR code and then use a time-based code for each login. Or useful for **Programmable Hardware tokens** (e.g., Token2) generating TOTP codes, pre-programmed during setup. Suitable for environments where mobile devices are restricted. |
| **USB keys** | - **HOTP tokens**: one-time password tokens based on a counter (e.g., Token2 HOTP). Each use increments the code. - **YubiKey (OTP mode)**: Supported YubiKeys can generate one-time passwords. The user inserts the key and taps it to input the MFA code. |
| **Alternative MFA method** | Allows or forces users to register a secondary MFA method in case the primary one is unavailable. |

## Recovery codes

![](https://a.storyblok.com/f/122374/1365x356/a788c631ef/server-settings-mfa-recovery-codes.png)

Provide users with backup access when their primary MFA method is unavailable.

- Each user receives a set of single-use codes (between 4 and 20) during MFA enrollment.
- Codes are generated automatically and must be stored securely by the user.
- Each code can only be used once and acts as a temporary substitute for the second factor.

## MFA for websites on IIS servers

![](https://a.storyblok.com/f/122374/1367x359/dfb4fe4c3a/server-settings-mfa-iis.png)

UserLock can enforce MFA for web applications hosted on Microsoft IIS using its integrated UserLock [IIS Agent](/userlock/docs/core-concepts/agents#iis-agent).

- Adds a second layer of authentication after Windows authentication without modifying the application itself.
- Users are prompted for MFA based on configured policies.
- The IIS Agent must be installed and configured on the web server.
- MFA must be enabled for the targeted users in UserLock.

## "Ask for help" button

![](https://a.storyblok.com/f/122374/1365x445/823075d48d/server-settings-mfa-ask-help.png)

The **Ask for help** button lets users request administrator assistance if they cannot complete MFA verification *(e.g., lost device, no network access)*.

This option is available directly on MFA prompts and during enrollment.

- Sends a notification (email or popup, depending on configuration) to UserLock administrators.
- Admin recipients can be defined manually (via LDAP search for machine names or email addresses).

Requests appear on the [MFA help requests](/userlock/docs/reference/activity#mfa-help-requests) page in the *Activity* section, where administrators can:

- Temporarily disable MFA for the user.
- Reset the user’s MFA configuration.
- Mark the request as resolved once the issue is handled.