NAVIGATION

Multi-Factor Authentication (MFA) is a protective system that confirms a user's identity by demanding two or more separate verification methods, thereby introducing an additional security layer beyond a standard password. In this setup, the secondary verification step relies on a time-based one-time code produced by an authenticator application.

1. Objectives

Current Limitations: Previous security was limited to single-factor password authentication.
The Opportunity: Enhance account security by requiring a second distinct form of authentication via TOTP.
Target Persona: All users in organizations where MFA is enabled.

2. Feature grasp

A technical breakdown of the MFA feature.

Component	Description	Impact	Requirements & Details
TOTP Integration	Time-based one-time codes generated by apps like Google Authenticator or Authy.	Critical security layer requiring a physical device.	Code: 6 digits, Expiry: 30s. Requires a device with automatic time sync.
QR Code Setup	Visual scan to quickly link the Mindox account to the authenticator app.	Simplified enrollment process.	Requires a mobile device with a camera and a TOTP app like Google Authenticator.
Device Trust	"Remember this device" option during sign-in to reduce MFA prompt frequency on trusted browsers.	Improved user experience without compromising safety.	Tied to specific browser/device storage, lost if browser data is cleared.
Manual Setup Key	Alternative to QR scanning where users manually enter a secret key into their authenticator app.	Ensures accessibility if the camera is unavailable.	The key is displayed under the QR code in the Mindox window.

Key User Story

As a Mindox user, I require a secondary layer of authentication following the entry of my credentials, utilizing a personal trusted device, so that my account remains secure even if my password is compromised.

3. Practical Use Cases

Scenario A: External Access

Context: While working remotely at a coffee shop, an employee attempts to log into Mindox from an unfamiliar device over a public Wi-Fi network.
Application:Once the user provides their password at sign-in, the system evaluates the connection and requests a TOTP code from their mobile device if a new location, browser, or device is recognized.
Outcome: The account remains protected even if the public network connection is compromised or the password is intercepted.

Scenario B: Stolen credential

Context: An event takes place in which the login credentials of a user become compromised.
Application: An unauthorized party attempts to log in with the stolen password but cannot provide the required MFA token.
Outcome: The login attempt is blocked, allowing users to reset their passwords accordingly.

4. Step-by-Step Instructions

Once MFA is activated at the organizational level, users can configure it independently via their Account settings. Additionally, organization administrators will gain the ability to reset MFA configurations for members through the Members settings panel.

Sign in with your username and password, then navigate to Account Settings.
Click "Set up 2FA" to display the QR code and manual setup key.
Open your authenticator app (e.g., Google Authenticator) and scan the QR code.
Enter the 6-digit code generated by the app into the Mindox window to complete setup.

5. Understanding the MFA

MFA after setup
Component	Description
Administrative reset	Through the Members settings panel, administrators have the ability to reset MFA setups for users. This acts as an alternative recovery route should a member lose their device or authenticator application. Note that administrators are restricted to resetting users who belong exclusively to their own organization.
Self-Service MFA deletion	Through Account Settings, users can independently delete their own MFA enrollment to switch TOTP applications or update their device. This process requires an active sign-in session and will revoke all previously trusted devices upon completion.

MFA Troubleshooting
Issue Scenario	Recommended Solution
The code is rejected	Enter the latest 6-digit code and ensure automatic time is enabled on your device with authenticator application to sync TOTP codes.
QR code will not scan	Increase screen brightness or zoom in. Alternatively, use the manual setup key found under the QR code.
Persistent MFA prompts	Ensure "remember this device" is selected during sign-in and avoid using private/incognito modes.
Lost authenticator app	Contact your organization administrator to reset your MFA configuration through the Members settings.
No MFA prompts during login	Confirm the organization has enabled MFA and that the device was not previously remembered.
Changed devices	Enter current TOTP code and select "remember this device" on the new device if desired.
Old device trusted after reset	Sign out of all sessions and clear browser site data to remove cached trust states.
Cannot delete own MFA	Check if MFA is already deleted or contact an admin to reset your MFA configuration through the Members settings.
Admin cannot reset MFA	Verify permissions, admins can only reset users within their own organization.

6. Preview

</aside>