Multi-factor authentication

Multi-factor authentication (MFA) combines your password with an authenticator app or WebAuthn factor such as a passkey or security key.

Which policy applies

DotID applies security rules by human identity type:

Identity

Policy owner

Default

Account root user

FlexGalaxy platform

MFA is mandatory; authenticator app and WebAuthn are supported.

Platform administrator

FlexGalaxy platform

MFA is mandatory; authenticator app and WebAuthn are supported.

Locally managed workforce user

Organization

MFA is disabled by default until the Organization policy enables or requires it. The policy also selects allowed methods.

Externally managed workforce user

External identity provider

The provider owns password, MFA, recovery, and sign-in policy. DotID shows the effective state read-only.

Service user or workload identity

Account

Non-interactive; it has no Profile or human MFA flow.

An Organization administrator manages the workforce policy from Identity Center. Individual users see their effective policy in Profile.

Enrolling a factor

  1. Sign in and open the avatar menu.

  2. Choose Profile → Security.

  3. Under multi-factor authentication, choose an allowed method.

  4. Follow the hosted enrollment flow.

If your effective policy requires enrollment, DotID prompts during sign-in. If it blocks unenrolled users, complete enrollment before console access is granted.

Authenticator app

Install an authenticator app, scan the QR code, and enter the current six-digit code. Store recovery information according to your Organization’s policy.

WebAuthn

WebAuthn includes platform passkeys such as Touch ID or Windows Hello and cross-platform security keys such as YubiKey. The methods shown in Profile are the methods allowed for your identity type and Organization.

Lost or replaced MFA device

If another enrolled method remains available, choose Try another method during sign-in and then enroll a replacement from Profile.

If no method remains:

  • A locally managed workforce user contacts an authorized Organization administrator. The administrator opens Identity Center → Users, removes the lost device, and can require enrollment of an allowed replacement method.

  • An externally managed workforce user follows the identity provider’s recovery process. DotID cannot remove or reset provider-owned factors.

  • An Account root user contacts FlexGalaxy support.

  • A platform administrator follows the platform break-glass procedure.

Profile also provides I lost my MFA device for the supported self-service request flow. It sends a request; it does not silently disable MFA.

FAQ

Can I use SMS for MFA?

No. SMS-based MFA is not supported.

Can I skip MFA?

Root users and platform administrators cannot. Workforce behavior follows the effective Organization or external-provider policy.

Can an administrator remove every workforce factor?

For a locally managed user, removal is constrained by the Organization policy. When the policy requires MFA, the administrator must require fresh enrollment rather than leave the user permanently without a factor.

Can service users enroll MFA?

No. Service users are programmatic identities. They have no password, Profile, or console session.

Does enrollment revoke existing sessions?

No. Use Profile → Sessions to revoke sessions when a credential may be compromised.