Before you begin
- Install a time-based authenticator such as Google Authenticator, Microsoft Authenticator, 1Password, or Authy.
- Keep a password manager or another secure location ready for the one-time recovery codes.
- Make sure the phone and computer clocks are set automatically; time drift causes valid-looking codes to fail.
Set up MFA in four steps
- Open Profile and choose Start MFA setup, or follow the setup prompt shown at sign-in.
- Scan the QR code. If scanning fails, enter the manual key displayed beside it.
- Enter the current six-digit code and choose Confirm MFA.
- Save every recovery code and confirm that you stored them before continuing.
Recovery codes
Recovery codes are shown once after setup. Store them with your internal account recovery process. Each code can be used once in place of an authenticator code.
SSO behavior
If a user signs in with Google Workspace, Okta, or Azure AD and BlackShield MFA is enabled, BlackShield asks for the platform authenticator code after the identity provider sign-in succeeds.
Tenant admins configure Okta in /identity, validate the OIDC discovery document, save and enable the provider, then share the tenant-specific URL shown by BlackShield, such as /login?tenant=acme-security&provider=okta. That URL uses the saved tenant configuration and does not require a frontend redeploy.
If a code is rejected
Wait for the next code, confirm automatic time is enabled on the authenticator device, and make sure you selected the BlackShield entry for the correct account. Use an unused recovery code if the authenticator is unavailable.