Multi-factor authentication (MFA)

Multi-factor authentication (MFA) is a multi-step login process that helps to protect users' accounts on your Totara site by adding an extra layer of security. Totara's MFA requires users to use an authenticator app in addition to your password to access your account.

By combining an authenticator app with the password system, MFA makes it harder for someone to access as users' account and compromise your Totara site, even if they are able to obtain or guess a users' password. This helps to keep your site, as well as users' personal information, safe.

Enable MFA

To enable MFA on your site, follow these steps:

1. Go to Quick-access menu > Plugins > Multi-factor authentication > Manage multi-factor authentication.

2. Click the closed eye icon () next to Authenticator app.

3. The eye icon should now appear open (), indicating that the Authenticator app is enabled.

Set up MFA for your account

Users’ can then configure MFA for their account by following these steps:

1. Go to their User menu (your name in the top-right corner) > Preferences > Manage multi-factor authentication.

2. Click Add factor.

   

3. User needs to download an authenticator app such as Google or Microsoft Authenticator. Open the app on the mobile device and scan the QR code displayed on the Add an authentication app page in Totara. Alternatively you can manually enter the code into the authentication app which is displayed on the Add an authentication app page.

   

4. In Totara, enter the six-digit code provided by the authenticator app.

5. Click Save.

 Log in with MFA enabled

Once the user has set up MFA for their account, they can log in by following these steps:

1. Go to your Totara site.

2. Enter Username and Password.

3. Click Login.

4. Enter the six-digit code from the authenticator app, then click Verify.

5. The user should now be logged in to the Totara site.

Multi-factor authentication notifications

You can configure notifications for trigger events related to multi-factor authentication, and add placeholders to those notifications.

By default there are notifications sent to a user when an MFA factor for their account is created or deleted.

Reporting

You can create a user report to view users with MFA enabled. Within the User report source you can add a column and filter Has MFA enabled. This will give the report a column with Yes or No data.

Restoring access to an account with MFA

In the event that you are locked out of your Site Administrator account with MFA enabled (e.g. because you have lost the device with the authenticator app), another Site Administrator can revoke your registered MFA factor on the Manage user login page. To perform this action, the logged-in user needs to have the moodle/user:managelogin capability.

1. Go to Quick-access menu > Users and browse for the admin user whose MFA you need to revoke.

2. Click on the user's name to go to their profile.

3. Click Manage user login.

4. Under the Action heading, select Reset MFA.

5. Click Update to revoke the admin user's registered MFA factor.

Following this action, the user will need to complete the MFA registration process again.