Skip to main content

MFA Activity

The event log for everything MFA — verifications, challenges, enrollments, and policy changes — for troubleshooting and audit.

What's logged​

Each event is labeled and color‑coded:

  • Verified / Failed — a verification succeeded or was rejected
  • Challenge sent — a factor was triggered
  • Enrollment started / Enrolled — a user set up a factor
  • Factor removed — a factor/device was revoked
  • Policy change — an MFA policy was edited

Using it​

  1. Go to Network → MFA → Activity.
  2. During a support call, look for the user's recent Failed or Challenge sent events to see exactly where the flow broke (wrong code, expired challenge, no enrolled factor).
tip

A run of Failed with no Verified usually means the user's device clock has drifted (TOTP) or they're approving on the wrong phone — check their enrolled factors under Users & Factors.