Multi-factor authentication

Note: Multi-factor authentication (MFA) for endpoints, VPNs, and SSO require the Professional edition of ADSelfService Plus with Endpoint MFA. Refer to the pricing page for more details.

ADSelfService Plus' MFA augments traditional username- and password-based authentication with an additional layer of authentication (for example, biometrics, TOTP codes, or FIDO Passkeys) to verify a user's identity. MFA provides a high level of identity assurance for access requests.

You can enable MFA in ADSelfService Plus to secure access via:

• Endpoint MFA for Windows, macOS, and Linux, including offline MFA for Windows and macOS machines
• SSO for enterprise applications
• MFA for VPNs and all endpoints supporting RADIUS authentication, like Citrix Gateway, VMWare Horizon, and Microsoft Remote Desktop Gateway
• MFA for Outlook on the web and the Exchange admin center (EAC)
• Self-service password resets and account unlocks, and logins to the ADSelfService Plus portal

To enable MFA for these events, follow these steps:

1. Configure the authentication methods you want to use for MFA.
2. Enable the MFA methods you've configured for the required resources.

Please refer to the authenticators page for the list of supported authentication methods and how to configure them.

Combined with Conditional Access, MFA for Endpoints can be enabled only for high-risk users, ensuring high-risk actions stay secure while minimizing the impact on the user experience overall. To learn more about Conditional Access, click here.

Enabling MFA for a specific sets of users

ADSelfService Plus enables you to configure MFA for two sets of users:

• Domain users
• Local users

Domain users

Domain users are part of an AD domain and are typically imported into ADSelfService Plus via the AD Synchronizer set up during domain configuration.

To configure MFA for domain users, first assign them to a policy. You can then apply MFA settings to that policy, and all the users under that policy will have MFA configured for them.

1. Go to Configuration > Self-Service > Policy Configuration, choose a policy of your choice, and click the Edit icon. You can also create a new policy by clicking the Add New Policy button.



2. Click the Select OUs/Groups button and select the specific set of users for whom you wish to enable MFA. Click OK.
Tip:Select the Don't inherit child OU(s) option to only select the parent OUs.



3. Select the password self-service features (Reset Password, Unlock Account, Self Update, or Change Password) that you wish to enable for the selected users. Click Save Policy.



4. Go to Configuration > Self-Service > Multi-factor Authentication > Authenticator Setup and select a policy from the Choose the Policy drop-down.
5. Configure the authentication methods that you want to enable for the selected policy.



6. Click Save.
Tip: You can choose to configure different authentication methods for different sets of policies. For instance, if Policy 1 can enforce YubiKey Authentication, Policy 2 can enforce SAML Authentication, and so on.

How to force enrollment for specific authentication methods

Domain users must enroll themselves by providing the necessary information, as per the enabled authentication methods, to be able to prove their identity. For example, if you have enabled biometric authentication, users must scan their fingerprint or face using the ADSelfService Plus mobile app, only after which they will be able to use their biometrics during password reset or endpoint logins.

To force enrollment for specific authentication methods:

1. Go to Configuration > Self-Service > Multi-factor Authentication > MFA Enrollment.
2. Select Force users to enroll when they log in to the end-user portal option. This will prevent users from accessing other features in the self-service portal before entering their enrollment information.
3. Select Enforce these authenticators during enrollment and choose the authenticators to be set as mandatory.



4. You can also choose to hide the Enrollment tab in the end-user portal for enrolled users.
5. Click Save Settings.

Local users

Note: Local User MFA is supported only on Windows machines and requires the Professional edition of ADSelfService Plus with Endpoint MFA.

Local users are accounts created directly on a specific computer and exist only on that machine. They are not managed through a network domain and authenticate using credentials stored locally. Local users can be present on both standalone and domain-joined machines, and are typically used for administrator access or for logging into Workgroup or offline systems that don’t rely on a central directory like AD. Click here to learn more.

Authenticators and functions supported by the various MFA types

This table provides detailed information on each MFA type, including the supported authenticators and the settings and options available to improve the functionality and security of the authentication process.

^*Local user MFA secures logins and peripheral access on standalone and domain-joined Windows machines, but cannot be used for self-service actions, cloud apps, or other domain-specific endpoints.

The following table outlines the capabilities and restrictions associated with each supported MFA type in ADSelfService Plus. It highlights whether idle timeouts and trusted device options are available, and explains how the product handles user access when MFA enrollment is incomplete. Use this as a reference to configure MFA policies based on your organization's security and usability requirements.

* Users do not have to enroll for these methods because they are automatically enrolled upon logging in the first time.

+ These authenticators are native to the mobile app and cannot be used in the mobile browser portal.

^*Local user MFA can be configured to secure logins to and peripheral connections from standalone (Workgroup) and domain-joined Windows machines. It cannot be configured for self-service actions, cloud applications, and other endpoints that can be secured for domain users.

Authenticators supported by the ADSelfService Plus mobile app and mobile browser portal

ADSelfService Plus offers 21 types of authenticators. Of these, eight basic authenticators are available with every edition of ADSelfService Plus. The other 13 are advanced authenticators, available only with the Professional edition of ADSelfService Plus.

This table provides detailed information on the basic and advanced authenticators supported for MFA in the ADSelfService Plus mobile app and mobile browser portal along with provisions for authenticator enrollment in the two consoles.

Note: This information pertains to domain users only. Local users will not be able to log in to the ADSelfService Plus mobile portal or app.

* Users do not have to enroll for these methods because they are automatically enrolled upon logging in the first time.

+ These authenticators are native to the mobile app and cannot be used in the mobile browser portal.