Multi Factor Authentication (MFA) provides an additional layer of security beyond username and password authentication.

When MFA is enabled, users must complete one or more additional verification steps before access is granted.

This helps protect accounts even if passwords are compromised.

Fixiam supports MFA at two levels:

• Organization Level MFA
• Application Level MFA

---

How MFA Works

A typical authentication flow follows these steps:

1. User enters username and password.
2. Fixiam validates the credentials.
3. Organization level MFA requirements are evaluated.
4. Application level MFA requirements are evaluated.
5. User completes all required verification factors.
6. Access is granted.

---

Supported MFA Factors

Fixiam supports the following authentication methods.

One Time Password (OTP)

A time based verification code generated from an authenticator application.

Example

1. User enters username and password.
2. User enters a valid six digit OTP code.
3. Authentication succeeds.

---

Fingerprint Verification

Uses a registered fingerprint to verify user identity.

Example

1. User enters username and password.
2. User scans a fingerprint.
3. Authentication succeeds.

---

Portrait Verification

Uses a live facial capture to verify user identity.

Example

1. User enters username and password.
2. User completes facial verification.
3. Authentication succeeds.

---

Organization Level MFA

Organization level MFA requirements apply across the entire organization.

Navigate to:

Settings → User Management Settings → MFA Factors

>

---

Applying MFA Policies

Administrators can choose who MFA applies to.

Admins Only

Require MFA only for administrative users.

Example

This option is commonly used when organizations want stronger protection for privileged accounts.

---

All Users

Require MFA for every user within the organization.

Example

This provides the highest level of protection.

---

Configuring MFA Factors

Administrators can enable one or more authentication factors.

Available options include:

• One Time Password (OTP)
• Fingerprint
• Portrait Verification

The selected factors become part of the organization's authentication requirements.

---

Example

Organization Configuration:

• OTP Enabled
• Applies To: All Users

Result:

Every user must successfully complete OTP verification after entering their password.

---

Application Level MFA

Applications can define additional authentication requirements beyond the organization's MFA policy.

Navigate to:

Applications → Select Application → Login Flow

>

---

Organization MFA Inheritance

Applications automatically recognize MFA requirements configured at the organization level.

Organization level factors are displayed within the application configuration screen so administrators can understand what requirements already exist.

Example

Organization Level MFA:

• OTP Enabled

Application MFA:

• No Additional Factors

Result:

User completes OTP verification once.

---

Adding Additional MFA Factors

Applications can require additional authentication factors beyond organization requirements.

Example

Organization Level MFA:

• OTP

Application Level MFA:

• Portrait

Resulting Authentication Flow:

1. Username and Password
2. OTP Verification
3. Portrait Verification
4. Access Granted

The application specific factor is added after the organization level requirement.

---

Duplicate MFA Prevention

Fixiam automatically prevents duplicate MFA challenges.

Example

Organization Level MFA:

• OTP

Application Level MFA:

• OTP

Result:

The user completes OTP only once.

The same authentication factor is never presented twice during a single authentication session.

---

Example MFA Scenarios

Scenario 1: Organization MFA Only

Organization:

• OTP

Application:

• No Additional MFA

Result:

Password → OTP → Access Granted

---

Scenario 2: Application Adds Additional Security

Organization:

• OTP

Application:

• Portrait

Result:

Password → OTP → Portrait → Access Granted

---

Scenario 3: High Security Application

Organization:

• OTP

Application:

• Fingerprint
• Portrait

Result:

Password → OTP → Fingerprint → Portrait → Access Granted

---

Common Scenarios

User Is Not Prompted For MFA

Possible causes include:

• MFA is disabled.
• User is outside the configured MFA scope.
• No MFA factors have been enabled.

---

User Cannot Complete MFA

Verify:

• Authenticator application is working correctly.
• Fingerprint reader is available.
• Camera permissions are enabled for portrait verification.

---

User Receives Multiple MFA Challenges

This is expected when additional application level factors have been configured.

Each configured factor must be completed successfully before access is granted.

---

Best Practices

• Enable MFA for all administrative accounts.
• Use OTP as the minimum MFA requirement.
• Use biometric factors for sensitive applications.
• Avoid unnecessary MFA layers that negatively impact user experience.
• Review MFA policies regularly.
• Apply stronger MFA controls to high risk applications.

---

Related Topics

• Password Authentication
• Login Controls
• Adaptive Risk Authentication
• Trusted Devices
• Application Login Flow