---
title: One Time Password (OTP) and Multi-Factor Authentication
slug: one-time-password-otp-and-multi-factor-authentication
createdAt: 2025-06-11T20:26:21.328Z
---

Activate supports **multi-factor authentication (MFA)** for password reset and login using **One Time Passwords (OTP)**.
 An OTP is a time-based passcode generated from a secure algorithm, commonly used in authenticator apps such as **Microsoft Authenticator** or **Google Authenticator**.

This provides an additional layer of security beyond traditional email or SMS verification.

# Authenticator Apps

Users can install any app that supports standard OTP algorithms (TOTP). Common options include:

| Application                 | iOS       | Android     |
| --------------------------- | --------- | ----------- |
| **Microsoft Authenticator** | App Store | Google Play |
| **Google Authenticator**    | App Store | Google Play |

# Configuration

To enable multi-factor authentication for password resets:

1. Set the parameter
    //Resources/Configuration/Passwords/RequirePin
    to **true**.
    This enforces a second-factor requirement during password reset. 
2. The default registration task (//Tasks/Passwords/Set Password Questions) allows selection of **Email**, **SMS**, or **One Time Password** as verification methods.
    You can disable email and SMS options in the form if they are not permitted. 
3. Optionally, disable shared secrets by setting toSet and toReset to **0**.
    This enforces OTP-only authentication without security questions. 

# Registration Process

Users register for OTP through the standard **Password Reset Registration** process by selecting *One Time Password* as their second-factor method.

They are presented with a **QR Code**, which can be scanned using their authenticator app.
 The registration information is securely encrypted and stored within Activate.

# Password Reset

When resetting a password, instead of receiving a PIN by email or SMS, users enter the **One Time Password** generated by their registered app.

OTP-based authentication is supported across:

- **Activate Internal Web Reset** 
- **Activate Anywhere Password Reset** 
- **Activate Windows Credential Provider** 

# Activate Anywhere Login

Once registered for MFA, users can also be required to use their OTP when logging into **Activate Anywhere**.

## Configuration Parameters

| Parameter                      | Description                                                                                                                              | Example                                  |
| ------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------- |
| MultiFactor.LoginRequiredUsers | Defines which users must use MFA for login. This uses an *AvailableUsers*-style parameter and can reference one or more roles.           | Contractors, Everyone                    |
| MultiFactor.RegisterTask       | References the registration task used for MFA enrollment. If not set, unregistered users required to use MFA will not be able to log in. | //Tasks/Passwords/Set Password Questions |

# Securing Sensitive Tasks

MFA can also be required when executing sensitive web tasks.
 To enforce this, include a **MultiFactorCode** control in the task’s web form.

:::BlockQuote
\<MultiFactorCode ID="Pin1" Label="Code" />
:::

The form cannot be submitted until a valid OTP is entered, providing an extra layer of security for critical actions.