MFA Providers
When a sign-in needs MFA, AuthNull sends a push to the user's phone through your organization's MFA provider. AuthNull supports three:
| Provider | Push app | Best for |
|---|---|---|
 AuthNull Authenticator | AuthNull's own mobile app | Getting started with no other service to set up |
 Duo Security | Duo Mobile | Organizations that already use Duo |
 Okta Verify | Okta Verify | Organizations that already use Okta |
One provider is active per organization, and it is used for every product: Active Directory, Database, RADIUS, and PAM.
Choose a Provider
Go to Settings → MFA Provider and select a provider card.
AuthNull Authenticator
No credentials are needed. Once it is active, enrol each user's phone with a device invite - see Set Up the AuthNull Authenticator.
Duo Security
Enter the details of your Duo application:
| Field | Example |
|---|---|
| API hostname | api-XXXXXXXX.duosecurity.com |
| Integration key | DI... |
| Secret key | Your Duo secret key |
Users must be enrolled in Duo Mobile before you enforce MFA.
Okta Verify
Enter your Okta organization's details:
| Field | Example |
|---|---|
| Okta org URL | acme.okta.com |
| API token | An Okta API token (00T...) |
Users must have Okta Verify enrolled in your Okta organization.
For Duo and Okta, AuthNull finds the user by email address. Each user's email in AuthNull must match their Duo or Okta account, or the push cannot be delivered and the sign-in is reported as not enrolled.
Provider Status
The MFA Provider page shows the provider's status:
| Status | Meaning |
|---|---|
| Active | Configured for this organization; credentials are stored encrypted per organization |
| Deployment default | Not configured for this organization - inherited from the deployment's default setting |
| Incomplete | Saved, but some required details are missing |
How Users Sign In to the Console
The MFA provider is used for pushes to protected systems. Signing in to the AuthNull console itself uses a password plus an authenticator app code (TOTP) or a passkey, which each user sets up on first sign-in. See End-User Console Access.