> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Multi-factor authentication

> Learn how to secure your Infisical account with MFA.

MFA requires users to provide multiple forms of identification to access their account.

## Email 2FA

If 2-factor authentication is enabled in the Personal settings page, email will be used for MFA by default.

![Email-based MFA](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/mfa-email.png)

## Mobile authenticator 2FA

You can use any mobile authenticator app (Authy, Google Authenticator, Duo, etc.) to secure your account. After registration with an authenticator, select **Mobile Authenticator** as your 2FA method.

![Authenticator-based MFA](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/mfa-authenticator.png)

## MFA for SSO logins

If your organization enforces MFA and your users sign in through [SAML or OIDC SSO](https://infisical.com/docs/documentation/platform/sso/overview.md), you can let the MFA they completed at your identity provider count, so Infisical doesn't prompt them again. Password, LDAP, and Google, GitHub, or GitLab logins are always prompted, so a break-glass account keeps Infisical MFA. The setting only takes effect while your organization enforces MFA, and then it also covers users who turned on MFA for their own account.

Infisical trusts a login only if the identity provider's signed response says MFA was completed:

* For OIDC, the ID token's `amr` claim includes `mfa`
* For SAML, the assertion's authentication context is a two-factor class, such as `MobileTwoFactorContract` or `SmartcardPKI`, or the MFA attribute includes `mfa` or `multipleauthn` (Infisical reads `authnmethodsreferences` for Entra ID and `amr` for every other provider)

Without a signal, Infisical prompts as usual. The `user-login` event in the [audit log](https://infisical.com/docs/documentation/platform/audit-logs.md#event-types) shows the values the identity provider sent, so you can see why a login was or wasn't prompted.

**Step 1**

Configure your identity provider to send the signal. Okta OIDC and Entra ID send it without extra configuration. For Okta SAML, add an attribute statement named `amr` with the value `session.amr`, as described in [Okta SAML](https://infisical.com/docs/documentation/platform/sso/okta.md).

**Step 2**

In your organization, go to **Settings** > **Security** and turn on **Enforce MFA**.

**Step 3**

Go to **Settings** > **Single Sign-On (SSO)** and, in the **Enforcement** card, turn on **Trust IdP MFA**.

> [!NOTE]
>
> If your identity provider lists the methods under another name, change **MFA claim name** in your OIDC configuration or **MFA attribute name** in your SAML configuration. If it uses other values or authentication contexts for MFA, add them under **Additional MFA claim values** or **Additional MFA authentication contexts**.

## Entra ID MFA

> [!NOTE]
>
> Before proceeding make sure you've enabled [SAML SSO for Entra ID](https://infisical.com/docs/documentation/platform/sso/azure.md).
>
> We also encourage you to have your team download and setup the
> [Microsoft Authenticator App](https://www.microsoft.com/en-us/security/mobile-authenticator-app) prior to enabling MFA.

**1. Open your Infisical Application in the Microsoft Entra Admin Center**

![Entra Infisical
app](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/mfa/entra/mfa_entra_infisical_app.png)

**2. Tap on Conditional Access under the Security Tab**

![conditional
access](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/mfa/entra/mfa_entra_conditional_access.png)

**3. Tap on Create New Policy from Templates**

![create policy](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/mfa/entra/mfa_entra_create_policy.png)

**4. Select Require MFA for All Users and Tap on Review + Create**

![require MFA and review
policy](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/mfa/entra/mfa_entra_review_policy.png)

> [!NOTE]
>
> By default all users except the configuring admin will be setup to require
> MFA. Microsoft encourages keeping at least one admin excluded from MFA to
> prevent accidental lockout.

**5. Set Policy State to Enabled and Tap on Create**

![enable policy and
confirm](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/mfa/entra/mfa_entra_confirm_policy.png)

**6. MFA is now Required When Accessing Infisical**

![mfa login](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/mfa/entra/mfa_entra_login.png)

> [!NOTE]
>
> If users haven't setup MFA for Entra / Azure they will be prompted to do
> so at this time.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.