Multi-factor authentication (MFA)
Who this is for
Security teams, tenant admins, and end users who need to understand when Owlie requests a second factor during sign-in.
Goal
Understand how tenant MFA settings determine enrollment, sign-in challenges, and factor availability.
Prereqs
- Know which primary sign-in methods your tenant allows, such as Secure Password or SSO.
- Tenant admins should know which users are expected to use MFA.
Success criteria
- You can predict whether a user will finish sign-in, receive an MFA challenge, or enter enrollment.
- You understand the difference between Disabled, User choice, and Required.
- You can distinguish sign-in MFA from step-up authentication inside an active session.
How MFA fits into sign-in
Owlie treats an authenticator-app code or passkey as a second factor. A user first completes one of the tenant's primary sign-in methods. Owlie then evaluates the tenant's MFA policy before creating the session and continuing to the dashboard.
The decision flow is:
Primary sign-in succeeds
|
+-- MFA is Disabled ------------------------------> Complete sign-in
|
+-- User has an enrolled, enabled MFA method -----> Challenge with that method
|
+-- MFA is Required for this user ----------------> Enroll an enabled method
| (skip only during a grace period)
|
+-- Otherwise ------------------------------------> Complete sign-in
If both methods are enabled and enrolled, the user can choose either one at the challenge. Owlie processes MFA before any other configured post-login steps.
The two policy controls
Tenant admins configure MFA under Settings → Login settings → MFA. Two controls work together:
- Methods determines which factor types users may enroll and use.
- MFA Enforcement determines whether sign-in skips MFA, lets users opt in, or requires enrollment.
A factor is usable only when MFA Enforcement is not Disabled and its method is enabled.
Allowed methods
| Method | Sign-in experience |
|---|---|
| Authenticator App (OTP) | The user enters the current six-digit code from a time-based authenticator app. |
| Passkey | The user confirms with WebAuthn, using a device biometric, PIN, or security key as configured. |
Passkeys are second factors in Owlie. They do not replace the tenant's primary sign-in method.
Enforcement modes
| MFA Enforcement | User without an enabled, enrolled method | User with an enabled, enrolled method |
|---|---|---|
| Disabled | No MFA prompt. New enrollment is unavailable. | No MFA prompt. The factor is inactive. |
| User choice | No MFA prompt. The user may enroll an enabled method from My Settings. | MFA challenge at every sign-in. |
| Required | Enrollment is added to sign-in when the user is in scope. | MFA challenge at every sign-in. |
User choice controls enrollment, not challenge frequency. After a user chooses to enroll, that enabled factor is required on every later sign-in.
Owlie rejects a Required configuration unless at least one method is enabled.
Required scope and grace period
When enforcement is Required, admins choose a scope:
- All users requires MFA for every user.
- Admins only requires MFA for users with the admin or owner role. Other users follow the User choice behavior: no enrollment prompt when they have no factor, but a challenge at every sign-in after they enroll.
A grace period lets an in-scope user skip required enrollment until the period ends. It does not skip challenges for users who already have an enabled factor. When the grace period expires, an unenrolled in-scope user must enroll before sign-in can finish.
What happens to existing factors
Changing policy does not silently delete credentials:
- Setting enforcement to Disabled keeps existing authenticators and passkeys stored but inactive.
- Turning off one method makes credentials of that type inactive, even if enforcement remains enabled.
- Inactive factors remain visible in My Settings and can be removed.
- Re-enabling the same method makes a retained factor usable again.
If MFA is Required and a user's only stored factor belongs to a disabled method, Owlie treats the user as unenrolled and offers the currently enabled methods.
Where users manage factors
Users open their profile menu, select My Settings, then use:
- Security → MFA - Authenticator for an authenticator app.
- Security → MFA - Passkeys for passkeys.
Enrollment options appear only when the tenant policy makes that method available. A stored but inactive factor is labeled Inactive and still offers a removal action.
Sign-in MFA versus step-up authentication
Sign-in MFA runs after primary sign-in and before Owlie creates the session. Step-up authentication runs later, when a signed-in user starts a sensitive action and the session's proof is missing or too old.
Both use only methods currently permitted by tenant policy, but they answer different questions:
- Sign-in MFA asks whether this login must prove a second factor.
- Step-up asks whether this already signed-in session has sufficiently recent proof for a specific action.
See Step-up authentication for protected actions, freshness windows, and method selection.
Default configuration
An unconfigured tenant behaves as Disabled, with no MFA methods available. This avoids locking users into enrollment before an admin selects a supported method.
Before changing to Required, enable at least one method, choose the intended scope, and review the grace period. The dashboard initially offers a 14-day grace period when Required is selected; choose None when enrollment must be immediate.
Example
Acme enables Authenticator App (OTP) and Passkey, then selects User choice. Maya has not enrolled a factor, so her next sign-in finishes after SSO. She later adds a passkey under My Settings. From then on, Owlie asks for that passkey after every successful SSO sign-in.
Acme later changes enforcement to Required, selects All users, and uses a 14-day grace period. Maya continues to receive her passkey challenge immediately. An unenrolled colleague sees the enrollment step and may skip it until the grace period expires.
Impact and risks
- User choice is persistent opt-in: enrolled users cannot skip their enabled factor at sign-in.
- Disabling enforcement or a method takes stored factors out of both sign-in and step-up method selection without deleting them.
- A grace period delays enrollment only; it does not relax MFA for users who already enrolled.
- Removing every usable factor while enforcement is Required causes enrollment to return at the next sign-in.
- MFA proves possession of a second factor. It does not grant roles, permissions, or access.
Troubleshooting
An enrolled user is not prompted during sign-in
Confirm that MFA Enforcement is User choice or Required and that the user's method is still enabled. A stored factor is intentionally ignored while enforcement or its method is disabled.
A stored factor is labeled Inactive
The tenant has disabled MFA enforcement or that factor type. Remove the factor if it should be retired, or ask a tenant admin to re-enable the method.
Required cannot be saved
Enable Authenticator App (OTP), Passkey, or both. Required enforcement cannot operate with no allowed enrollment method.
A user sees enrollment despite having a factor
The stored factor's method is no longer enabled. The user must enroll one of the methods currently offered, or a tenant admin must restore the previous method.
Skip is not available during enrollment
The grace period is set to None or has expired. Users who already have a factor receive a challenge rather than the enrollment screen, so the grace-period skip does not apply.
Limitations
- Owlie currently supports authenticator-app OTP and passkeys as second factors.
- Passkeys are not primary sign-in credentials in Owlie.
- The MFA flow applies to browser sign-ins. API keys use the separate API authentication model.
- Emergency administrator recovery restores a primary sign-in method; it does not bypass MFA in a normal login.