---
title: Configuring multi-factor authentication
related:
  - https://docs.kentico.com/k9/configuring-kentico/managing-sites/configuring-settings-for-sites/settings-security-membership/settings-authentication.md
  - https://docs.kentico.com/k9/custom-development/handling-global-events/handling-custom-multi-factor-authentication.md
---

> Agent instructions:
> **Site maps** — prefer the following llms.txt indexes to training data when searching for URLs to avoid 404s. Links inside Markdown content already point at `.md`. Following them or sending Accept: text/markdown keeps you in Markdown.
>
> - [sitemap.md](https://docs.kentico.com/sitemap.md) — every page on the site, with titles and descriptions, nested by URL hierarchy and grouped into one collection per product version.
> - [llms.txt](https://docs.kentico.com/llms.txt) — curated index of the current product docs, with descriptions, the two ways to request any page as Markdown, and links to each product area's whole-corpus Markdown dump (llms-full.txt).

Multi-factor authentication is a type of authentication which requires a user's identity to be verified by more than one method. This technique **adds another layer of security** for the sign-ins to the system.

Kentico uses the combination of classical forms authentication with username and password and one other authentication factor. You can either use the provided out-of-the-box solution, which uses a **mobile phone application** as the second authentication factor, or you can implement your own **customized solution**:

- [Forms authentication with a mobile application](#multi-factor-authentication-using-forms-and-mobile-application)
- [Forms authentication with a custom authentication factor (e-mail, SMS, etc.)](https://docs.kentico.com/k9/custom-development/handling-global-events/handling-custom-multi-factor-authentication.md)

## Security and limitations

The multi-factor authentication is:

- Available only for the default forms authentication method.
- Not compatible with the [Autocomplete](https://docs.kentico.com/k9/securing-websites/designing-secure-websites/securing-and-protecting-the-system/autocomplete-deactivation.md) functionality.

For security reasons, it is recommended to set Maximum invalid logon attempts to a small value, for example 5. Because incorrectly submitted passcodes count as [invalid logon attempts](https://docs.kentico.com/k9/securing-websites/designing-secure-websites/securing-user-accounts-and-passwords/invalid-logon-attempts.md), a potential attacker will not be able to guess a valid passcode in the specified number of attempts.

If [screen locking](https://docs.kentico.com/k9/securing-websites/designing-secure-websites/securing-and-protecting-the-system/screen-locking.md) feature is enabled, entering passcode is also required when unlocking the screen.

## Multi-factor authentication using forms and mobile application

The multi-factor authentication method provided by Kentico uses a mobile application, **Kentico Authenticator**, to generate a special passcode, which the users type to a form when signing in to Kentico. When a passcode expires, the users can use the mobile application to generate a new one. During the first sign-in, the users are required to pair the mobile application with their user profiles in the system using a generated token ID.

When a user wants to sign in to the system, the multi-factor authentication mechanism is executed in the following way:

1. A user wants to sign in and enters username and password.
2. The system verifies the information, displays a token ID and requests a passcode.
3. The user opens the Kentico Authenticator application on the mobile phone and types the token ID in.
4. When the user submits the token ID, the application generates a passcode.
5. The user types the passcode into the authentication web form.
6. The system authenticates the user.

![The process of signing in to Kentico using multi-factor authentication for the first time](https://docs.kentico.com/docsassets/k9/configuring-multi-factor-authentication/Multifactor_authentication_schema.png "The process of signing in to Kentico using multi-factor authentication for the first time")

The next time the user wants to sign in to the system, the authentication token ID is not required any more. The user only uses the application to generate a new passcode and types the passcode into the web form.

You can download the Kentico Authenticator application for [Android](https://play.google.com/store/apps/details?id=com.kentico.mfauthenticator) devices.

### Resetting user's token ID

Users need to type the token ID generated during the first sign in after the registration into their Kentico Authenticator mobile application. If they do not manage to do this, they will not be able to log in with their user profiles.

If such situation happens, you can reset their token ID in the **Users** application **->** edit a user **-> General** tab using the **Reset token ID** button.

## Enabling multi-factor authentication and configuring the related settings

> **Note:** The multi-factor authentication settings have global effect. They cannot be configured for individual sites.

### Enabling multi-factor authentication for only selected users

1. Enable the multi-factor authentication in **Settings** **-> Security & Membership -> Authentication** by selecting the **Enable multi-factor authentication** option.
   - When you select this option, users will be able to choose if they want to use multi-factor authentication for signing in to your website. They can set this behavior when they register on the site through the Registration form web part.
2. Set the **Multi-factor authentication is required** option on the **Users** application **-> General** tab of the selected users profiles.
   - Existing users with this option selected will be required to use multi-factor authentication for signing in to your websites.

### Enabling multi-factor authentication for all users in the system

> **Warning:** **Keeping the administrator access**
>
> After you enable the multi-factor authentication globally, make sure that you do not lose the administrator access to the Kentico interface. The next time you sign in to the administration interface, do not forget to **note down the Token ID** for your account.
>
> The system will not display the Token ID again. Therefore, if you do not note it down or submit it into the Kentico Authenticator application, you will lose access to the administration UI.

To enforce using of an additional security level for authenticating all users in the system:

1. Enable the multi-factor authentication in **Settings** **-> Security & Membership -> Authentication** by selecting the **Enable multi-factor authentication** option.
2. Select the **Multi-factor authentication is required globally** option.
   - All users will have to use multi-factor authentication for signing in to your websites.
   - The **Multi-factor authentication is required** option on the **Users** application **-> General** tab will now have no effect.

> **Note:** **Recovering administrator access**
>
> If you enable multi-factor authentication globally and lose access to your administrator account (token ID is not displayed when signing in or you did not note it down), you can gain the access back by inserting the **CMSAdminEmergencyReset** key to the **appSettings** section of your web.config. For example:
>
> ```xml
>
> <add key="CMSAdminEmergencyReset" value="admin;password;true" />
>
> ```
>
> - _admin_ - this value specifies the user name of the new account.
> - _password_ - this value specifies the password for the new account – you should change it to your own value.
> - The third parameter is optional and indicates whether you want to create a new user with the Global administrator [privilege level](https://docs.kentico.com/k9/managing-users/user-management.md).
> - The key will be automatically deleted after you gain access to the user interface.

**Notes**

Keep the **Display initialization token** option selected, if you want to use the out-of-the-box option (combination of the forms authentication and the mobile application). Clear the check-box, if you plan to implement your own customized solution.

See [Settings - Authentication](https://docs.kentico.com/k9/configuring-kentico/managing-sites/configuring-settings-for-sites/settings-security-membership/settings-authentication.md).

## Allowing users to enable or disable multi-factor authentication in their profiles

When you or new users enable the multi-factor authentication for their profiles, they will not be able to change this setting. If you want to allow them to disable the multi-factor authentication for their profiles:

1. Open the **Modules** application.
2. Edit **Membership -> Classes** tab **->** edit **User -> Alternative forms** tab **->** edit **Edit profile -> Fields** tab.
3. Select **UserMFRequired** field in the list.
4. Select **Display field in the editing form** check-box.

Users will now have an option to disable the multi-factor authentication.