Users & Factors

Enroll users and manage their authentication factors — authenticator apps, push, and passkeys.

Enroll a factor

1. Go to Network → MFA → Users & Factors and find the user.
2. Click Enroll and pick a factor:
   • TOTP — an authenticator app (Google Authenticator, 1Password, etc.); the user scans a QR code and confirms with a 6‑digit code (123456).
   • Push — approve sign‑ins from a registered phone (Device).
   • Passkey / WebAuthn — a hardware or platform authenticator.
3. Confirm to activate the factor.

Manage factors

• Reset — clear a user's factors so they can re‑enroll (e.g. lost phone).
• Revoke — remove a specific factor or device.
• Directory users can be enrolled too — send them an enrollment prompt.

tip

Encourage Push for everyday use (one tap) with TOTP as a backup factor — so a dead phone or no signal doesn't lock anyone out.