Skip to content
DeviceQuest DeviceQuest DeviceQuest Docs User Documentation

Documentation

Multi-Factor Authentication

Require multi-factor authentication per role, see who has not enrolled yet, and reset MFA for people who lost their device.

Overview

The Multi-Factor Authentication page shows, role by role, whether DeviceQuest requires MFA and how many members have enrolled. Use it to switch the MFA requirement on or off for a role, to find the people who still need to enroll, and to reset MFA for someone who lost or replaced their authenticator. Open it from Admin → MFA (/admin/security/mfa).

You need roles:read to open the page and roles:write to change a policy or reset MFA. The History tab and the policy activity on the page read the audit log, which needs admin:manage.

Screen tour

  1. N roles required: how many roles currently require MFA.
  2. Total users, Enrolled and Outstanding: everyone in the tenant, how many have MFA enrolled, and how many have not.
  3. Enrollment coverage: the share of users who are enrolled, with a line such as 2 of 2 users still need to enroll. When everyone is enrolled it reads Every user on this tenant is enrolled.
  4. Summary sentence: N of M roles require MFA, N of M users enrolled and N outstanding. Click the roles part to show only required roles, or the outstanding part to show only roles with members who are not enrolled.
  5. Policy activity: a bar per day for MFA policy changes in the last 14 days. When there were changes since you last opened the page, a line such as 2 policy changes since your last visit appears below it; click the × to dismiss it.
  6. Search roles…: filters by role name or description.
  7. Policy filter: All, Required, Optional or Outstanding (roles with at least one member who is not enrolled). Each chip shows how many roles match.
  8. Sort: Name A–Z, Name Z–A, Most members or Most outstanding.
  9. Export: downloads mfa-inventory.csv with the columns Role ID, Name, Requires MFA, Member Count, Enrolled Count and Outstanding Count.
  10. Policy: Required or Optional for the role.
  11. Outstanding: how many members of the role are not enrolled. A dash means none.
  12. Open: opens the role’s details in a side panel. You can also click anywhere on the row.

Roles are grouped in two tables, Requires MFA and MFA optional, each with a count. Every row shows the Role (name and description), Policy, Members, Enrolled and Outstanding. Your search, filter and sort are kept in the page address, so you can bookmark or share a filtered view.

Open a role

Click a role row (or its arrow) to open the MFA Policy side panel.

  1. Role name, description and its current policy chip.
  2. Require MFA: the switch that turns the MFA requirement on or off for this role. Below it you see how many members have not enrolled, or MFA not required for this role.
  3. Open in RBAC: opens the role on the Roles and permissions page in a new tab, where you change its permissions and members.
  4. Copy ID: copies the role ID.
  5. Tabs: Overview, Members, Not enrolled (with the number of members who are not enrolled) and History.
  6. Enrollment: the role’s enrollment rate with Members, Enrolled and Outstanding.
  7. View N not enrolled and View all members: jump to the matching tab.

The Overview tab also lists the Role ID, the MFA policy, the Enrollment rate (for example 50% (1 / 2)) and the Description.

To close the panel, click × or press Esc.

Open a role on its own page

Each role also has a full-page view at /admin/security/mfa/<role ID>. Click Copy ID in the panel to get the ID. The page has the same header, Require MFA switch, actions and tabs as the panel, plus Back to MFA policy to return to the list.

Require MFA for a role

  1. Open the role.
  2. Click the Require MFA switch.
  3. Read the confirmation and click Enable MFA.

  1. What happens: users holding the role are prompted to enroll in MFA on their next login. This change takes effect on the next login for all affected users.
  2. Cancel: closes the dialog without changing anything.
  3. Enable MFA: saves the policy.

A toast confirms MFA policy updated and the role moves to the Requires MFA table. From their next sign-in, members who are not enrolled are taken to MFA enrollment before they can use DeviceQuest (see Multi-factor authentication). Every change is recorded in the audit log as a policy change.

To turn the requirement off, click the switch again and confirm with Disable MFA in the Disable MFA requirement dialog. Members are then no longer required to have MFA enrolled; people who already enrolled keep using MFA.

You can also switch the MFA requirement from a role’s details on the Roles and permissions page.

Find members who are not enrolled

  1. Open the role and click the Not enrolled tab.
  2. The tab lists every member without MFA, for example 2 users on this role have not enrolled in MFA.

  1. Not enrolled: the member’s enrollment state.
  2. Copy link: copies the link to the MFA enrollment page (/login/mfa-enrollment) so you can send it to the person. The button shows Copied for a moment.
  3. Reset MFA: clears the person’s MFA enrollment so they enroll again. See Reset MFA for a user.

When everyone is enrolled, the tab shows Everyone on this role is enrolled.

The Members tab lists all members of the role with Search members…, and shows Enrolled or Not enrolled for each person, with Reset MFA next to the member. When a role has no members, the tab offers Manage in RBAC → to assign people.

Reset MFA for a user

Reset MFA when someone lost their phone, replaced their authenticator, or you suspect their second factor is compromised.

  1. Open the role, then the Members or Not enrolled tab.
  2. Click Reset MFA next to the person.
  3. Optionally pick a reason and add notes.
  4. Click Reset MFA.

  1. Warning: This will clear the user’s MFA enrollment. They will need to re-enroll before accessing MFA-required roles.
  2. Reason (optional): Lost device, Compromised account or Other. Click a selected reason again to clear it.
  3. Notes (placeholder Additional notes (optional)): free text stored with the reset.
  4. Cancel: closes the dialog without resetting.
  5. Reset MFA: resets the enrollment. It shows Resetting… while it works.

After the reset, a toast shows MFA reset. Enrollment link copied to clipboard. The enrollment link is on your clipboard, ready to send to the person. They are prompted to enroll a new device on their next sign-in. The reset, with its reason and notes, is recorded in the audit log under the affected user, so it appears on the Audit tab of User details and in the Audit log.

Review policy history

The History tab lists role-wide MFA policy changes for the role, newest first.

  • Filter by period: 7 days, 30 days (default), 90 days or All time.
  • Each entry shows the action, such as Policy changed, how long ago it happened, and who made the change with their IP address.
  • Click Show details to see the recorded change, and Hide details to fold it again.
  • Click Load more to page further back.

Individual MFA resets are logged under the affected user’s own record, so they appear in the user’s audit trail rather than on this tab.

Fields

FieldWhereDescriptionRules
Require MFARole panel and pageWhether members of the role must have MFA enrolled.On or off. Each change asks for confirmation. Needs roles:write.
Reason (optional)Reset MFA dialogWhy you reset the user’s MFA.One of Lost device, Compromised account, Other, or none.
NotesReset MFA dialogPlaceholder Additional notes (optional): free text stored with the reset.Free text.
Search roles…Role listFilters roles by name or description.Case-insensitive.
Search members…Members tabFilters members by email or display name.Case-insensitive.

Statuses

StatusApplies toMeaningNext possible status
RequiredRole policyMembers must enroll in MFA; those who are not enrolled are sent to enrollment at sign-in.Optional
OptionalRole policyMFA is not required for this role.Required
EnrolledMemberThe person has MFA set up.Not enrolled (after a reset or if they turn MFA off)
Not enrolledMemberThe person has no MFA yet. Counted as outstanding.Enrolled

Keyboard shortcuts

KeyAction
/Focus Search roles….
j / kMove to the next or previous role row.
Enter or tOpen the focused role.
g then rJump to the Requires MFA table.
g then oJump to the MFA optional table.
← / →, Home / EndIn the side panel, move between tabs.
EscClose the side panel.