> For the complete documentation index, see [llms.txt](https://docs.cloud.olakrutrim.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cloud.olakrutrim.com/basics/identity-access-management/multi-factor-authentication-mfa.md).
# Multi-Factor Authentication (MFA)
### What Is Multi-Factor Authentication (MFA)?
Multi-Factor Authentication (MFA) adds an extra layer of security to your Krutrim Cloud account by requiring a second form of verification in addition to your password.
After entering your password, you must provide a 4-digit verification code generated by an authenticator application. This helps protect your account even if your password is compromised.
MFA is available for both Root Users and IAM Users.
### How MFA Works
Krutrim Cloud uses the Time-based One-Time Password (TOTP) standard.
During MFA setup:
1. Krutrim Cloud generates a unique MFA secret.
2. The secret is converted into a QR code.
3. You scan the QR code using a compatible authenticator application.
4. The authenticator app generates a new six-digit code every 30 seconds.
5. Enter the OTP to complete MFA enrollment.
Once enrolled, MFA verification is required whenever your account requests additional authentication.
\
MFA Lifecycle
Setup MFA
↓
Scan QR Code
↓
Verify OTP
↓
Enrollment Complete
↓
Backup Codes Generated
↓
MFA Verification
↓
(Optional)
Un-enroll
### MFA Features
Krutrim Cloud supports the following MFA capabilities:
| Feature | Description |
| ----------------------- | ----------------------------------------------------------------------------------------------- |
| Setup MFA | Generates an MFA secret and QR code for enrollment |
| Enrollment Confirmation | Verifies the first OTP and completes enrollment |
| OTP Verification | Validates authenticator app codes |
| Backup Codes | Provides one-time recovery codes for emergency login |
| Un-enrollment | Removes MFA from the account after successful verification using either an OTP or a backup code |
| MFA Information | Retrieves the current MFA status |
### Setting Up MFA
To enable MFA:
1. Navigate to My account → Multi-Factor Authentication
2. Select Enable MFA
3. Scan the QR code using your authenticator application.
4. Enter the generated OTP.
5. Complete MFA enrollment.
After successful enrollment:
* MFA becomes active.
* Ten backup codes are generated.
* Backup codes are displayed only once.
* Backup codes should be stored securely for future recovery.
### Backup Codes
Backup codes provide emergency access when your authenticator device is unavailable.
Characteristics:
* 10 backup codes are generated after successful enrollment.
* Backup codes are not generated during MFA setup.
* They are generated only after successful enrollment confirmation.
* Each backup code can be used only once.
* Used backup codes become permanently invalid.
* Backup codes do not expire but remain valid until used, regenerated, or MFA is reset.
### Un-enrolling MFA
Un-enrollment allows you to permanently remove Multi-Factor Authentication from your account.
To un-enroll MFA, you must authenticate using either:
* A valid OTP generated by your authenticator application, or
* A valid unused backup code.
Upon successful un-enrollment:
* MFA is disabled for the account.
* The stored MFA secret is removed.
* All backup codes are deleted.
* The MFA enrollment status is reset.
* MFA verification status is cleared from all active sessions.
If you want to enable MFA again in the future, you must perform the complete MFA setup and enrollment process.
### Security Considerations
Krutrim Cloud follows several security practices for MFA:
* MFA secrets are generated uniquely per user.
* Backup codes are single-use.
* OTPs expire automatically based on the TOTP time window.
* Previously used OTPs cannot be reused.
* MFA verification is required before sensitive MFA operations.
* Password policy can enforce mandatory MFA across an organization.
### Audit Logging
For security and compliance purposes, MFA-related activities are recorded in the audit trail.
Examples include:
* MFA setup
* Enrollment confirmation
* OTP verification
* MFA enable or disable operations
* MFA un-enrollment
### Best Practices
Recommended practices:
* Store backup codes in a secure location.
* Complete MFA enrollment immediately after setup.
* Keep your authenticator application on a trusted device.
* Save your backup codes before leaving the enrollment page.
* Never share your MFA secret or backup codes.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.cloud.olakrutrim.com/basics/identity-access-management/multi-factor-authentication-mfa.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.