MFA Verification (after sign-in)

Multi-Factor Authentication (MFA) adds an extra layer of security to user accounts by requiring more than just a username and password. The goal is to verify a user’s identity using a combination of something they know (password), something they have (device, code, or token), and something they are (biometric).

In the SAL Training Modules Portal, the following MFA verification options are supported:

1. One-Time Passcodes (OTP)

• Delivered via Email.

• User enters a 6-digit code sent at login.

• Most basic MFA method, widely compatible, but can suffer from delivery delays or interception.

• Includes resend option and support for device trust (skip MFA for 14 days).

2. Time-Based One-Time Passwords (TOTP)

• Generated by an authenticator app (e.g., Microsoft Authenticator, Google Authenticator).

• Provides a rotating 6-digit code valid for ~20-30 seconds.

• Works offline and is more secure than OTP since codes are device-generated.

• Preferred method when available, with fallback to Email OTP.

3. Passkeys

• Uses biometric authentication (Face ID, Touch ID, fingerprint) or device PIN:

• Strongest form of MFA: phishing-resistant, fast user experience.

• Requires modern browser/device support.

• If unsupported, the portal falls back to TOTP or OTP.

4. Device Trust

• Users can choose to trust a device for 14 days after successful MFA.

• Trusted devices skip MFA during the trust period.

• Trust can expire or be revoked manually for security reasons.

5. Method Selection (Full Security Users)

• Users with all MFA methods enabled can select which method to use at login.

• Ensures flexibility and fallback if one method is unavailable.