{"id":36651,"date":"2026-05-09T09:30:44","date_gmt":"2026-05-09T09:30:44","guid":{"rendered":"https:\/\/help.desk365.io\/en\/?post_type=docs&p=36651"},"modified":"2026-05-09T09:41:27","modified_gmt":"2026-05-09T09:41:27","slug":"setting-up-multi-factor-authentication","status":"publish","type":"docs","link":"https:\/\/help.desk365.io\/en\/articles\/setting-up-multi-factor-authentication\/","title":{"rendered":"Setting up Multi-Factor Authentication (MFA)"},"content":{"rendered":"\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t
\n Available with:<\/span>\n \n \n \n <\/circle>\n <\/path>\n <\/svg>\n Standard<\/span>\n <\/span>\n \n |<\/span>\n \n \n \n <\/circle>\n <\/path>\n <\/svg>\n Plus<\/span>\n <\/span>\n \n |<\/span>\n \n \n \n <\/circle>\n <\/path>\n <\/svg>\n Premium<\/span>\n <\/span>\n<\/div>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t

Multi-Factor Authentication (MFA) in Desk365 adds an extra layer of security to your helpdesk by requiring users to verify their identity using more than just a password. This helps protect both your agent portal and support portal from unauthorized access.<\/span>\u00a0<\/span><\/p>

With MFA enabled, users must complete a second verification step during login. This can be done using an authenticator app or a one-time password sent via email. MFA can be configured separately for agents and contacts, but the setup and experience remain the same.<\/span><\/p>

Please note that MFA applies only to email and password logins. If you’re using Microsoft Entra SSO, multi-factor authentication is handled directly by Microsoft, Desk365’s MFA settings will not apply in that case.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t

How MFA works in Desk365 <\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t

To get started, go to,\u00a0<\/span><\/span>Settings > Security and Compliance > Agent \/ Contact Authentication > MFA<\/span><\/span><\/strong>\u00a0<\/span><\/strong>
<\/span>\u00a0<\/span>
<\/span>On the MFA configuration screen, you can enable and manage multi-factor authentication for agents and contacts to add an extra layer of account security.<\/span><\/span>\u00a0<\/span><\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\"agent-authentication-using-multi-factor-authentication\"\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t

On this page, you will see two ways to enable MFA:<\/span><\/span>\u00a0<\/span><\/p>

  • Authenticator App –\u00a0<\/span><\/b>This option allows users to sign in using a verification code generated from an authenticator app such as\u00a0Microsoft\u00a0Authenticator, Google Authenticator, or Authy.<\/span>\u00a0<\/span><\/li>
  • Email OTP<\/span><\/b>\u00a0–\u00a0This option sends a one-time password to the user\u2019s registered email address during login.<\/span>\u00a0<\/span><\/li><\/ul>

    Once you enable MFA, users who sign in using email and password will be asked to complete an\u00a0additional\u00a0verification step after entering their credentials.<\/span>\u00a0<\/span><\/p>

    If both the authenticator app and email OTP are enabled<\/strong>, users will see both options during login. They can choose how they want to verify their identity. The authenticator app is typically used as the primary method, while email OTP acts as a backup when needed.<\/span>\u00a0<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

    \n\t\t\t\t
    \n\t\t\t

    Enabling MFA for agent authentication <\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t

    MFA for agents can be managed by admins and agents with the necessary <\/span>role<\/span>\u00a0permissions.<\/span>\u00a0Agents will only be able to use MFA after it has been set up at the admin level.<\/span><\/span>\u00a0<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

    \n\t\t\t\t
    \n\t\t\t

    1. Configure MFA using an Authenticator App <\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t

    Go to\u00a0agent\u00a0authentication settings and enable MFA using an authenticator app.<\/span>\u00a0<\/span><\/p>

    This allows agents to sign in using a time-based authentication code generated from apps like Microsoft Authenticator, Google Authenticator, etc.<\/span>\u00a0<\/span><\/p>

    You will be asked to specify an <\/span>Issuer Name<\/span><\/b>. This is the label that appears inside the authenticator app to help users\u00a0identify\u00a0their account.<\/span>\u00a0<\/span><\/p>

    For example, enter:<\/span>\u00a0<\/span><\/p>

    RTX Solutions – Agent App<\/span><\/b>\u00a0<\/span><\/p>

    Click\u00a0save.<\/span>\u00a0<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t\t\t\t\t\"configure-issuer-name-agent-authentication\"\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t

    Step 2: Apply the MFA policy <\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t

    After saving, a confirmation popup will appear asking when the policy should be applied.<\/span>\u00a0<\/span><\/p>

    • Immediately (all users will be logged out)\u00a0–\u00a0<\/span><\/b>All active sessions will\u00a0be ended. This ensures that MFA is enforced right away. The process may take up to 30 minutes.<\/span>\u00a0<\/span><\/li>
    • On next login\u00a0–\u00a0<\/span><\/b>The new settings will apply only when users log in again. Current sessions will continue until then.<\/span>\u00a0<\/span><\/li><\/ul>

      For this example, let\u2019s select ‘<\/span>Immediately’\u00a0and click save.<\/span>\u00a0<\/span><\/p>

      The MFA policy is now applied.<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

      \n\t\t\t\t
      \n\t\t\t\t\t\t\t\t\t\t\t\t\t\"mfa-settings-application-desk365\"\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t
      Step 3: Set up MFA (Agent experience) <\/h5>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t\t\t

      Once enabled, agents will be prompted to set up MFA when they log in.<\/span>\u00a0<\/span><\/p>

      They will see a QR code on the screen.<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

      \n\t\t\t\t
      \n\t\t\t\t\t\t\t\t\t\t\t\t\t\"agent-portal-mfa\"\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t\t\t

      Agents should scan this QR code using their authenticator app. If scanning is not possible, they can manually enter the key shown on the screen.<\/span>\u00a0<\/span><\/p>

      After scanning, the app will generate a verification code. Enter this code to complete\u00a0setup.<\/span>\u00a0<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

      \n\t\t\t\t
      \n\t\t\t\t\t\t\t\t\t\t\t\t\t\"entering-code-provided-by-authenticator-app\"\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t

      Step 4: Save recovery codes <\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t\t\t

      After successful verification, a set of recovery codes will be shown.<\/span><\/span>\u00a0<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

      \n\t\t\t\t
      \n\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t\t\t

      Recovery codes are backup codes that can be used if the user cannot access their authenticator app.<\/span>\u00a0<\/span><\/p>

      • You will receive 10 recovery codes<\/span>\u00a0<\/span><\/li>
      • Each code can be used only once<\/span>\u00a0<\/span><\/li>
      • These codes can be downloaded or copied<\/span>\u00a0<\/span><\/li><\/ul>

        Users must store these codes securely before continuing. Once done, click finish.<\/span>\u00a0<\/span><\/p>

        They will then be redirected to the agent portal.<\/span>\u00a0<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t
        \n\t\t\t

        2. Enabling email OTP for agents <\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
        \n\t\t\t\t
        \n\t\t\t\t\t\t\t

        Admins\u00a0or agents with role permissions\u00a0can also enable MFA using email OTP.<\/span>\u00a0<\/span><\/p>

        Turn on the Email OTP option and click save.<\/span>\u00a0<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t
        \n\t\t\t\t\t\t\t\t\t\t\t\t\t\"using-email-otp-for-agent-authentication\"\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
        \n\t\t\t\t
        \n\t\t\t\t\t\t\t

        You will again be asked when to apply the policy. Choose ‘<\/span><\/span>Immediately’<\/span><\/span> or ‘<\/span><\/span>On<\/span> next login’<\/span><\/span>. For this example, select ‘Immediately’ and save.<\/span><\/span>\u00a0<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t
        \n\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
        \n\t\t\t\t
        \n\t\t\t\t\t\t\t

        Once enabled, agents logging in will have the\u00a0<\/span>option<\/span>\u00a0to receive a one-time password via email.<\/span><\/span>\u00a0<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t
        \n\t\t\t

        Agent login using email OTP <\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
        \n\t\t\t\t
        \n\t\t\t\t\t\t\t

        When logging in, the agent must enter the OTP sent to their registered email address to complete verification.<\/p>

        A popup will appear asking them to enter the OTP sent to their registered email.<\/span><\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t
        \n\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
        \n\t\t\t\t
        \n\t\t\t\t\t\t\t

        Once entered correctly, the agent will be logged in.<\/span>\u00a0<\/span><\/p>

        Note:<\/span><\/i><\/b>\u00a0The OTP is valid for 10 minutes.<\/span> A new OTP can be requested after 30 seconds.<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t
        \n\t\t\t\t\t\t\t

        If both Authenticator App and Email OTP are enabled<\/strong>, the authenticator app will be used as the primary verification method during login. Users will first be prompted to enter the authentication code generated in their authenticator app.<\/p>

        If they are unable to access the app or retrieve the code, they can choose the \u201cEnter OTP received via email\u201d option on the login screen to verify their identity using an email OTP instead.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t
        \n\t\t\t\t\t\t\t\t\t\t\t\t\t\"both-authentication-options-selected\"\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
        \n\t\t\t\t\t
        \n\t\t\t\t
        \n\t\t\t\t
        \n\t\t\t

        MFA for contact authentication (Support portal) <\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
        \n\t\t\t\t
        \n\t\t\t\t\t\t\t

        MFA can also be enabled for contacts who access your support portal.<\/span>\u00a0<\/span><\/p>

        Your support portal may already support email login and\u00a0Microsoft\u00a0Entra\u00a0Single Sign-On.\u00a0<\/span>MFA applies only to\u00a0contacts\u00a0signing in with email and password.<\/span><\/b>\u00a0<\/span><\/p>

        When enabled, all contacts must complete an\u00a0additional\u00a0verification step during login.<\/span>\u00a0<\/span><\/p>

        If both authenticator app and email OTP are enabled, users can choose either method.<\/span>\u00a0<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t
        \n\t\t\t

        Enable MFA for contacts using authenticator app <\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
        \n\t\t\t\t
        \n\t\t\t\t\t\t\t

        Similar to\u00a0agent authentication, go to Contact Authentication settings and enable MFA via authenticator app.<\/span>\u00a0<\/span><\/p>

        Enter an issuer name to\u00a0identify\u00a0the account inside the app.<\/span>\u00a0<\/span><\/p>

        For example:<\/span>\u00a0<\/span><\/p>

        RTX – Support Portal<\/span><\/b>\u00a0<\/span><\/p>

        Save the settings and choose to apply the policy\u00a0immediately.<\/span>\u00a0<\/span><\/p>

        Now, when a contact logs in using email and password, they will be prompted to set up MFA.<\/span>\u00a0<\/span><\/p>

        The process is the same as agents:<\/span>\u00a0<\/span><\/p>

        • Scan the QR code using an authenticator app<\/span>\u00a0<\/span><\/li>
        • Enter the generated code<\/span>\u00a0<\/span><\/li>
        • Download or copy recovery codes<\/span>\u00a0<\/span><\/li>
        • Click finish<\/span>\u00a0<\/span><\/li><\/ul>

          Once completed,\u00a0MFA\u00a0is enabled for the contact.<\/span>\u00a0<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

          \n\t\t\t\t
          \n\t\t\t\t\t\t\t\t\t\t\t\t\t\"support-portal-authentication-desk365\"\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
          \n\t\t\t\t\t
          \n\t\t\t\t
          \n\t\t\t\t
          \n\t\t\t

          Role permissions for MFA <\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
          \n\t\t\t\t
          \n\t\t\t\t\t\t\t

          Access to MFA settings and management depends on role permissions.<\/span>\u00a0Only users with the right permissions will be able to view, configure, or manage MFA.<\/span><\/span>\u00a0<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

          \n\t\t\t\t
          \n\t\t\t\t\t\t\t\t\t\t\t\t\t\"role-access-for-mfa-in-desk365\"\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
          \n\t\t\t\t
          \n\t\t\t\t\t\t\t

          Only roles with the\u00a0<\/span>\u201cAccess to Agent Recovery Code and Reset MFA\u201d<\/span><\/b>\u00a0permission enabled can:<\/span>\u00a0<\/span><\/p>

          • View recovery codes for agents\u00a0<\/span>\u00a0<\/span><\/li>
          • Reset MFA for agents\u00a0<\/span>\u00a0<\/span><\/li><\/ul>

            If this permission is not enabled, the user will not be able to access recovery codes or help agents regain access to their accounts.<\/span>\u00a0<\/span><\/p>

            Roles with the\u00a0<\/span>\u201cAccess to Agent and Contact Authentication\u201d<\/span><\/b>\u00a0permission enabled can:<\/span>\u00a0<\/span><\/p>

            • Access the authentication settings page\u00a0<\/span>\u00a0<\/span><\/li>
            • Configure portal login options\u00a0<\/span>\u00a0<\/span><\/li>
            • Enable or disable MFA\u00a0<\/span>\u00a0<\/span><\/li>
            • Manage password policies for agents and contacts\u00a0<\/span>\u00a0<\/span><\/li><\/ul>

              If this permission is disabled, the user will not be able to see or\u00a0modify\u00a0any MFA or authentication-related settings.<\/span><\/p>

              In short, both permissions must be explicitly enabled in a role for users to manage MFA settings or\u00a0<\/span>assist<\/span>\u00a0others with recovery and access.<\/span><\/span>\u00a0<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

              \n\t\t\t\t
              \n\t\t\t

              Important notes <\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t\t\t
              • MFA applies only to email and password login, not\u00a0Microsoft\u00a0Entra\u00a0SSO<\/span>\u00a0<\/span><\/li>
              • Each user receives 10 recovery\u00a0codes\u00a0and each can be used only once<\/span>\u00a0<\/span><\/li>
              • Recovery codes can only be generated again after two hours from the\u00a0<\/span>previous<\/span> request<\/span><\/span><\/span><\/li>
              • Email OTP is valid for 10 minutes<\/span>\u00a0<\/span><\/li>
              • Authenticator app is the primary\u00a0method\u00a0and email OTP is a fallback<\/span>\u00a0<\/span><\/li><\/ul>

                MFA in Desk365 helps secure both your agent portal and support portal by adding an extra verification step during login. Whether using an authenticator app or\u00a0email\u00a0OTP, it ensures that only authorized users can access your system.<\/span>\u00a0<\/span><\/p>

                By enabling MFA and configuring the right permissions, admins can significantly improve the security of their helpdesk operations while keeping the login experience simple for users.<\/span>\u00a0<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"author":16,"featured_media":0,"parent":27663,"menu_order":7,"comment_status":"open","ping_status":"closed","template":"","doc_tag":[],"class_list":["post-36651","docs","type-docs","status-publish","hentry","no-post-thumbnail"],"comment_count":0,"_links":{"self":[{"href":"https:\/\/help.desk365.io\/en\/wp-json\/wp\/v2\/docs\/36651","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/help.desk365.io\/en\/wp-json\/wp\/v2\/docs"}],"about":[{"href":"https:\/\/help.desk365.io\/en\/wp-json\/wp\/v2\/types\/docs"}],"author":[{"embeddable":true,"href":"https:\/\/help.desk365.io\/en\/wp-json\/wp\/v2\/users\/16"}],"replies":[{"embeddable":true,"href":"https:\/\/help.desk365.io\/en\/wp-json\/wp\/v2\/comments?post=36651"}],"version-history":[{"count":73,"href":"https:\/\/help.desk365.io\/en\/wp-json\/wp\/v2\/docs\/36651\/revisions"}],"predecessor-version":[{"id":36833,"href":"https:\/\/help.desk365.io\/en\/wp-json\/wp\/v2\/docs\/36651\/revisions\/36833"}],"up":[{"embeddable":true,"href":"https:\/\/help.desk365.io\/en\/wp-json\/wp\/v2\/docs\/27663"}],"prev":[{"title":"Setting up agent authentication","link":"https:\/\/help.desk365.io\/en\/articles\/agent-authentication\/","href":"https:\/\/help.desk365.io\/en\/wp-json\/wp\/v2\/docs\/36634"}],"wp:attachment":[{"href":"https:\/\/help.desk365.io\/en\/wp-json\/wp\/v2\/media?parent=36651"}],"wp:term":[{"taxonomy":"doc_tag","embeddable":true,"href":"https:\/\/help.desk365.io\/en\/wp-json\/wp\/v2\/doc_tag?post=36651"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}