Authenticating with Push MFA
Authenticating with Push MFA
When a policy requires MFA, AuthNull sends a push request to the user's phone before the sign-in completes. The user approves or denies it in the app of the organisation's MFA provider:
| MFA provider (Settings → MFA Provider) | Where the user approves |
|---|---|
| AuthNull Authenticator | The AuthNull Authenticator app, after the device is registered. See Set Up the AuthNull Authenticator. |
| Duo Security | The Duo app, using your existing Duo deployment. |
| Okta Verify | The Okta Verify app, using your existing Okta org. |
Only one provider is active for an organisation at a time.
Where push MFA applies
A push is sent when the matching policy action is MFA Required (Require MFA for database policies):
- Active Directory - Windows and AD sign-ins seen by the DC Sensor.
- RADIUS - VPN and network device logins. The push is sent before the login completes.
- Database - database sessions. The session opens only after the push is approved.
Signing in
- Sign in to the resource as usual, for example log on to a domain-joined machine or connect to the VPN.
- A push request arrives on your phone.
- Check that the request matches what you are doing, then approve it. Deny any request you did not start.
- The sign-in completes once the request is approved.
warning
Requests are time limited. If you do not respond in time the request expires and you need to sign in again.
Not receiving push requests?
- Check the user's status on the Users page. If it shows Not enrolled or Invite pending, the device has not been registered. Issue a new invite with Register device or Re-issue invite.
- If the user has a new phone, register the new device with a fresh invite.
- If the organisation uses Duo Security or Okta Verify, check the user's enrolment in that service.