Multi-factor authentication

Five second factors and email confirmation. What each one needs before you can switch it on, and what your users see.

Configure factors on Auth Factors in your console. Switching a factor on makes it available. It does not mean anybody has enrolled. To see how many people actually signed in with a second factor, use Coverage, which measures sign-ins rather than settings.

The Auth Factors page: the authenticator app is required, passkeys and recovery codes are on, and the captcha providers are listed below. — Auth Factors, with the captcha choice below it.

What each factor needs#

Check this first. Two factors need something outside VERISCO and will not work merely by being enabled.

Factor	On by default	Needs
Authenticator app (TOTP)	Always	Nothing. Users enrol at their next sign-in.
Passkeys	Yes	Nothing from you. Users register their own device or key.
Recovery codes	Yes	Nothing.
Email code	No	Outgoing email configured on the platform, and an email column mapped in your identity source.
SMS code	No	An SMS provider configured on the platform, and a phone number on the user's profile.
Email confirmation	No	The same as email codes.

A factor without its prerequisite looks like a broken login

If email codes are enabled and your identity source has no email column, the code has nowhere to go. To the user that is "I cannot sign in", not "a setting is missing". Check the mapping before you enable the factor.

Authenticator app#

A six-digit code that changes every 30 seconds, from any standard authenticator: Google Authenticator, Microsoft Authenticator, Authy, 1Password and others.

The user scans a QR code once, at their first sign-in after the factor is switched on. They can type the key by hand instead of scanning.

A code can be used once. If a user signs in twice within the same 30 seconds, the second attempt needs the next code.

Passkeys#

A passkey is a key pair held by the user's device or security key and unlocked with a fingerprint, a face or a PIN. It cannot be phished, because it is bound to your sign-in page's address.

Passkeys are an offer, not a requirement. After their authenticator step a user is asked Add a passkey? and can choose:

Set up a passkey, and register a platform authenticator (Touch ID, Windows Hello, Android) or a roaming one (a hardware security key);
Not now, and be asked again two weeks later.

Email and SMS codes#

A one-time code sent to the address or the number on the user's record. The user types it on the verification page. SMS codes are billed per message on paid plans; see Plans and billing.

Recovery codes#

A set of single-use codes for the day a user's phone is lost. They are shown once, after the user has a factor to recover, and the user is asked to save them.

A recovery code is offered at sign-in only to a user who has codes left.

Email confirmation#

Asks a user to confirm they control the email address on their record before their sign-in completes.

Losing a factor#

Situation	What to do
The user has recovery codes	They choose Try another way and enter one.
The user has another factor enrolled	They choose Try another way and use it.
The user has neither	They cannot complete sign-in. Contact us to have their factors reset; they enrol again at their next sign-in. Recovery codes exist so that this stays rare.

Measuring it#

Coverage shows, for the window you choose, how many of the people who signed in used a second factor, and lists those who did not. That list is the actionable half. See Monitoring.

Something missing or wrong on this page? Tell us and we will fix it.