Administration — MFA

Organization-wide multi-factor authentication policy — enforcement, permitted authenticator app, and enrollment coverage.

i Open Administration → MFA from the Administration navigation • Personal enrollment: My Profile • Per-user MFA actions: Roles & Access → Users

What it does

Administrators with identity:manage configure:

  • Whether MFA is required for all organization members
  • Which single authenticator app members may use (Google or Microsoft Authenticator — TOTP)
  • Enrollment coverage KPIs for internal users
  • Operational alerts when enforcement or enrollment needs attention

This page is org policy — not where users enroll their own MFA (see My Profile).

Permissions

Action Permission
Open MFA policy page identity:manage
View / update org MFA policy (API) identity:manage
Reset / disable / force re-enroll user MFA org:members:manage (from Users — separate from this page)
♢

MFA policy overview

Banner at the top of the page shows:

  • Enrolled count vs internal user total, permitted methods, last updated timestamp
  • Chips: Enforcement required / optional, N% enrolled, selected authenticator name
  • Clickable KPIs: Members, MFA enrolled, Pending enrollment, Coverage
  • Refresh reloads policy and internal user MFA summaries
♙

MFA adoption

Calculated from internal users returned by the admin user directory, not synced IdP-only accounts.

Pending enrollment includes users with enrollmentRequired or policy-enforced users without MFA enabled.

Coverage = enrolled ÷ total internal users (rounded percentage).

Require MFA for all members

Toggle: Require MFA for all members (enforced on the org policy).

  • When enabled, every member must enroll MFA before accessing Axio. Members without MFA are prompted at next sign-in.
  • Existing sessions may continue until expiry.
  • When disabled, MFA becomes optional at the organization level. Turning enforcement off also clears MFA enrollments for all organization members (MFA records are removed server-side).

Disabling enforcement is destructive: member MFA enrollments for this organization are reset. Plan communications before toggling enforcement off in production.

The enforcement toggle is staged in the UI — click Save policy in the sticky bar to apply. You cannot save enforcement while zero authenticator methods are permitted.

Organization authenticator app

Select the single authenticator app members use during MFA enrollment. This is a radio choice — not multiple independent toggles.

✣

Google Authenticator (TOTP)

Recommended

Time-based one-time passwords using Google Authenticator or compatible apps.

Selected for enrollment when chosen (radio checked)
●

Microsoft Authenticator (TOTP)

Recommended

Enterprise-friendly authenticator support via Microsoft Authenticator.

Selected for enrollment when chosen (radio checked)

SMS and Email OTP methods are not configurable on this page today. The API persists allowSms: false and allowEmail: false. Only TOTP authenticator apps are supported for org policy and personal enrollment.

Changing the authenticator app saves immediately when you select a card (unlike the enforcement toggle).

Member MFA management

The side panel provides Manage user MFA under Roles & Access → Users. From there, administrators with org:members:manage can reset MFA, force re-enrollment, disable MFA, or invalidate recovery codes for individual users (audit reason required).

Operational alerts

The overview banner may surface:

  • Error: Enforcement enabled but no permitted methods selected
  • Warning: Members still need to enroll under enforced policy
  • Info: Optional MFA with less than 100% coverage — suggests considering enforcement
i

Prefer directory / SSO MFA?

Enforce MFA at your identity provider and configure SSO under Administration → Integrations → Identity Providers. Axio org MFA policy applies to native Axio sign-in and enrollment flows.

♙

Personal enrollment

Each user enrolls MFA on My Profile using the authenticator app selected on this page.