Identity MFA

Identity adds MFA to Windows sign-ins in Active Directory. It also syncs users from Active Directory and EntraID.

Users keep signing in the way they do today. A small sensor on each Domain Controller asks AuthNull about every authentication. AuthNull checks your policies and, when a policy requires it, sends an MFA push to the user's phone.

MFA pushes go through Duo Security or Okta Verify.

note

AuthNull Authenticator is coming soon. It is not available as an MFA provider yet.

Open Identity

In the console, open Switch product and choose Identity ("Directories, users and Windows sign-in MFA").

The Identity sidebar has five items:

Sidebar item	What it is for
Dashboard	Setup checklist, tenant status and authentication activity.
Identity Sources	Your connected Active Directory domains and EntraID tenants, with sensor, mode and sync state. See Identity Sources.
Users	Users synced from your identity sources. See Identity Sources.
Policies	Rules that decide Allow, MFA Required or Deny. See Policies.
Logs	Raw authentication events from your sensors. See Logs.

Settings opens from the account menu in the top right.

The Dashboard

The Dashboard is titled Authentication Monitoring Dashboard.

While setup is incomplete, a setup checklist shows at the top. Follow it to connect a directory, install the sensor and create a policy.

Tenant Status cards:

Card	Shows
Compliance Mode	The tenant mode: Audit, Policy or Live.
Active Policies	Number of active policies.
Directory Users	Number of synced directory users.
Total Endpoints	Number of endpoints.
Endpoint Users	Number of endpoint users.

Total Authentications shows a sparkline and a breakdown into Allowed, Denied and MFA required. Click View all access logs to open Logs.

The AD Authentication Activity chart shows authentication activity over all time.

How it works

User signs in (Kerberos / NTLM / LDAP / SMB)
        │
        ▼
Domain Controller ──► AuthNull DC Sensor
                            │  asks AuthNull about this authentication
                            ▼
                      AuthNull checks Policies
                            │
              ┌─────────────┼──────────────┐
              ▼             ▼              ▼
            Allow     MFA Required        Deny
                            │
                            ▼
                 Push to Duo / Okta Verify
                            │
                            ▼
              Verdict back to the sensor
                            │
                            ▼
        Domain Controller completes or blocks the sign-in

1. The DC Sensor runs on every Domain Controller.
2. For each authentication, the sensor asks AuthNull for a decision.
3. AuthNull finds the matching policy.
4. If the policy says MFA Required, AuthNull sends a push. The sensor waits up to 60 seconds.
5. AuthNull returns a verdict. The Domain Controller completes or blocks the sign-in.

An approved push is remembered for 5 minutes, so users are not pushed for every Kerberos ticket.

For protocol details, see the DC Sensor Reference.

Key behaviours

Read this before you enforce

• Monitor vs Enforce is set per identity source. You change it in the Mode column on Identity Sources. In Monitor, every sign-in is allowed and no push is sent.
• No matching policy means allowed. If no policy matches a sign-in, it is allowed. This is true in Monitor and in Enforce.
• Fallback also applies to failed pushes. The Fallback setting is used when AuthNull is unreachable. It is also used when a push is denied, expires or times out. With Fallback = Allow, a denied push can still let the user in.

Set up

Follow these pages in order:

1. Connect Identities — add an Active Directory domain or EntraID tenant.
2. Install the DC Sensor — install the sensor on every Domain Controller.
3. Identity Sources — check sensors, switch to Enforce, review users.
4. Policies — decide who gets MFA, and for what.
5. Logs — see each authentication and its decision.

For how the sensor works in depth, see the DC Sensor Reference.