Multi-factor authentication policies are a subset of overall authentication policies.

The first decision choice: which methods are suitable for my company? The two choices available: TOTP (time-based one time password), and WebAuthn.

TOTP will work with a variety of applications (Authy, Google Authenticator, Microsoft Authenticator). No network access is required, it is strictly synced via time and the user typing in a code.

WebAuthn provides a variety of sub-methods:

  • Computer Trusted Platform Module (TPM)
  • Phone-based push (“was this you?”)
  • USB-based FIDO2 devices (e.g. YubiKey)
  • PassKey

Use a preset authentication policy as a starting point for the majority of the parameters.