<iframe src="https://www.googletagmanager.com/ns.html?id=GTM-M74D8PB" height="0" width="0" style="display:none;visibility:hidden">
Loading
Skip to NavigationSkip to Main Content
System Status
Announcements
Announcements
Search
Search
Select Language
Knowledge Base
Knowledge Articles
Support Videos ↗
Documentation
Product Documentation ↗
Developer Documentation ↗
Product Release Notes ↗
Community
Events & Webinars
Okta Ideas ↗
Resources
Product Hub
Customer Success Hub
Product Release Update
Learning
Okta Learning ↗
Get Support
Open a Case
HomeCommunityForum
0D50Z00008G7UxGSAVOkta Classic EngineMulti-Factor AuthenticationAnswered2024-04-30T09:18:25.000Z2016-10-02T13:10:10.000Z2017-11-06T18:47:14.000Z

4n37d (4n37d) asked a question.

Edited by varun.kavoori1.5210444522562532E12 September 5, 2018 at 1:19 AM
Force MFA policy based on being in an Administrator Role
Can I apply an MFA policy based on someone being in an Administrator Role?

 

It would provide greater security for anyone granted Administrator access to be automatically assigned to a pre-defined MFA policy. All I've been able to find so far is that it appears to be a two step process during user setup when a user is added to an Administrator role they also need to be placed in a group that has an MFA policy.

 

Is there some way this can be automated with a setup option within the MFA policy so it is also role based and not just group based? Or am I missing somewhere that a group can be automatically built off people in an Administrator role?

 

Thanks.
  • 2 answers
  • 936 views

  • j5v7c (j5v7c)

    Currently this is only possible the way you have described it, to add administrative roles, and then apply those people to a group to require MFA.

     

    It does however sound like a good idea for a Request for Enhancement. In the community if you select "Ideas (https://support.okta.com/help/ideas/ideaList.apexp)" from the top right hand corner you can submit a suggestion, and then community members can vote up the those ideas that are popular. I'd certainly vote that one up as it makes sense for a good security enhancement.
    Expand Post

  • 4n37d (4n37d)

    Thanks Kevin.

     

    I see another idea to prompt for MFA ahead of the elevation to Admin rights (upon clicking the admin button) that has been out for a year. I'll consider putting this one out there as well, but having the prompt upon moving to the Admin functions would work just as well too.
    Expand Post
This question is closed.
Loading
Force MFA policy based on being in an Administrator Role