MFA and Passkeys

Verdictan supports two MFA methods. You can use a TOTP authenticator app or a passkey. Setup also gives one-time backup codes for recovery.

An account can have one MFA method. To change the method, first disable it in Profile settings. Then, enroll the new method.

Select a method

Method	Good fit	Requirements
Authenticator app	Broad device compatibility and offline one-time codes	A TOTP-compatible app and correct device time
Passkey	Device or hardware-key verification that resists phishing	Browser or platform WebAuthn support and an available registered authenticator
Backup code	Recovery when you cannot use the primary method	One code that was not used. Keep it in a safe location.

Backup codes are recovery credentials, not the usual login method.

Example MFA and passkey options.

Enroll an authenticator app

1. Open Settings → Profile.
2. Find Two-factor authentication.
3. Select Set up next to Authenticator app.
4. Use the selected authenticator app to read the QR code.
5. Type the generated six-digit code.
6. Copy the backup codes before you exit the setup page.
7. Store the codes in a location that is not on the authenticator device.
8. Sign out.
9. Complete a new login test.

Do not make a screenshot of the QR secret. Do not paste the secret into a shared system. An unauthorized person can use an exposed secret.

If codes fail, verify the automatic time setting on the device. Then, start enrollment again.

Enroll a passkey

1. Use a browser and device that support passkeys.
2. Open Settings → Profile.
3. Find Two-factor authentication.
4. Select Set up next to Passkey.
5. Complete the browser prompt with the selected device credential or hardware security key.
6. Save the displayed backup codes.
7. Sign out.
8. Test passkey login.
9. Test a backup code through the MFA challenge path.

Use a supported platform authenticator or security key. If passkey verification fails, use a stored backup code.

Save backup codes safely

Backup codes are one-time secrets. Follow these rules:

• Store them in an approved password manager or protected offline location.
• Keep them isolated from the primary authenticator.
• Do not put them in tickets, source control, or chat.
• Mark a used code as consumed.
• Replace the MFA setup when an unauthorized person gets recovery material.
• Replace the MFA setup when no recovery material is available.

Save the codes before you exit the setup page. Without the codes, account recovery can be hard.

Organization MFA policy

Open Settings → Organization. Use MFA Policy to set the minimum MFA requirement for administrators and members.

Before you increase the policy requirement:

1. Review the Members directory for active enrollment.
2. Contact unenrolled owners and administrators first.
3. Make sure that help-desk identity checks and recovery ownership are correct.
4. Test TOTP and passkey flows on representative supported devices.
5. Save the policy during a monitored window.
6. Verify login with a non-owner who must use MFA.
7. Review Trail.

An MFA requirement does not replace SSO assurance, role structure, session review, or recovery controls.

Disable or switch MFA

Profile settings can disable the active MFA method. After you disable MFA, the account uses its other login controls.

Use a monitored switch:

1. Make sure that the session is authenticated.
2. Make sure that the backup recovery path operates correctly.
3. Disable the configured method.
4. Immediately enroll the replacement.
5. Verify the replacement.
6. Save new backup codes.
7. Complete a new sign-in.

A privileged account must have MFA after you complete the supported switch.

Unavailable device or failed challenge

1. Use one backup code that was not used.
2. Replace the MFA method from the authenticated session.
3. If no backup code is available, follow the organization's approved identity recovery process.
4. Review active sessions, tokens, OAuth clients, and recent Trail events.
5. Replace other credentials after possible unauthorized access.

A user must not give an authenticator code, passkey private material, QR seed, or backup code to support personnel.

Next steps

• Identity and Access
• Members and Teams
• SSO and SCIM
• Roles and IAM Policies