Skip to main content

MFA methods

XFA adds multi-factor authentication (MFA) to an integration with three methods: Built-in passkey, TOTP and passkeys. You can enable one or more of them per integration. This page compares the methods and explains which one users get when several are enabled.

Compare the methods

Built-in passkeyTOTPPasskey
What the user doesUsually nothing on a trusted device. With Double Identity Verification, XFA checks identity again, and the available method determines whether the user needs to act. A new device may be approved in the XFA App or by emailEnters a 6-digit code from an authenticator appConfirms with a fingerprint, face, screen lock or security key
What it provesThe user is on a device they trusted with XFAThe user has their authenticator appThe user holds the passkey and unlocked it with a fingerprint, face, screen lock or PIN
Needs the XFA AppYesNoNo
Tied to one deviceYes, each device is trusted separatelyNoNo, unless the passkey is kept on a single device or security key

For setup and user experience per method, see Built-in passkey, TOTP and Passkeys.

Enable a method

  1. Go to the XFA Dashboard and navigate to Enforcement
  2. Click Manage on the integration you want to configure
  3. Under Multi-Factor Authentication, switch on the methods you want:
    • Built-in Passkey for Built-in passkey
    • Passkey for passkeys
    • Time-based One-Time Password (Authenticator app) for TOTP

MFA is not available for OpenID Connect (OAuth 2.0) integrations, IdP applications or Discovery connections. When creating an integration, turning off the last enabled method asks for confirmation. When editing an existing integration, save or discard the change using the unsaved-changes bar.

Which method users get

When an integration has one method enabled, users go straight to it.

When it has more than one:

  • A user who already chose a method in this browser goes straight to it.
  • Otherwise, a user who has already set up a method is sent to it. Built-in passkey comes first, then TOTP, then passkeys.
  • A user who has not set up any method sees Choose verification method and picks one. The browser remembers that choice for next time.

On the verification screen, users can switch to another method with Set one up, next to Want to use a different method?. In the XFA mobile app, this is Use a different method.

Reset a user's MFA

  • In Devices, open the People tab, open the actions menu next to the user and choose Manage MFA. Choose Reset all MFA to remove all their MFA methods, or Remove beside a method to remove only that registration. The user sets up any removed method again when needed.
  • On the Devices tab, open the device actions menu and choose Remove Built-in passkey, under MFA when that submenu is present. This removes Built-in passkey for that device only; other devices, TOTP and passkeys stay in place.