# MFA management

> Multi-factor authentication (MFA) enhances security and provides better control over user access

---

Site [llms.txt](/llms.txt)

---

MFA adds an additional layer of authentication using time-based one-time passwords (TOTP), typically via an authenticator app.

## Prerequisites

- SSH access to the Cloud Management Platform (CMP) appliance with sudo/root privileges
- A TOTP-based authenticator app (for example, Microsoft Authenticator or Google Authenticator)

## Enable multi-factor authentication (MFA)

1. **Modify `customer_settings.py`**
   - SSH into the CMP appliance.
   - Open the settings file `/var/opt/cloudbolt/proserv/customer_settings.py`.
   - Add the following lines to enable MFA:

     ```python
     from settings import FEATURE_REGISTRY

     FEATURE_REGISTRY["authentication::mfa"] = True
     ```

1. **Reset the feature list and restart the HTTP service**
   - Run the following command to apply changes:

     ```bash
     /opt/cloudbolt/manage.py features --reset && systemctl restart httpd
     ```

1. **Verify that MFA is active**
   - Check the features list:

     ```bash
     /opt/cloudbolt/manage.py features --list
     ```

## UI setup and user configuration

1. **Confirm MFA in the Admin UI**
   - Log in to CMP.
   - Go to **Admin**.
   - Confirm that the **MFA Management** option is now visible.
1. **Enable MFA for users**
   - Go to **Admin** > **MFA Management**.
   - Select one or more users, select the shield icon (**Enable MFA For Select Users**), then select **Enforce MFA**.
1. **User MFA setup**
   - When a user with MFA enabled logs in to CMP, they are prompted to set up MFA using an app.
   - Select **Set up using an app** to display a QR code.
1. **Scan the QR code and authenticate**
   - Open a TOTP-based authenticator app.
   - Scan the QR code.
   - Enter the six-digit code generated by the app and select **Verify**.
   - After validation succeeds, the user is logged in.