More control over TOTP and MFA recovery

A user who loses an authenticator used to leave operators without a clean recovery path. Administrators can now disable MFA on a user, and TOTP enrollment and verification are clearer — with MFA state visible in user management.

This is the longer note behind the June 23 changelog entry.

How it works

Three surfaces shipped together:

• An administrator action to disable MFA for a user
• Improved TOTP enroll and verify (prepare a secret, confirm a code, then activate)
• MFA state on the user record in user management, so you can see who is enrolled before you enforce a policy

Enrollment is not complete until verification succeeds. Disabling MFA deactivates the active TOTP secret and its backup codes. Factor behavior and recovery steps are in MFA.

Set it up

In the Authdog console:

1. Enable multi-factor authentication on the environment.
2. Enroll a test user through the hosted flow: scan the authenticator config, then verify a six-digit code.
3. Confirm MFA state on that user in Users.
4. To recover a lockout, verify the person out of band, disable MFA on the user, and have them enroll again.

Review audit logs after an administrator disable. Treat reset as a privileged recovery action.

Trust boundaries

Administrator disable is account recovery, not a user self-service. Limit who can perform it. TOTP is not phishing-resistant; a code can be relayed. Disabling MFA removes the second factor until the user enrolls again — do not leave production accounts in that state.

Environment MFA policy and per-user enrollment are separate. Enabling the environment setting does not enroll anyone.

Try it

Open a test user in Users, enroll TOTP, then disable MFA and enroll again. Details are in MFA. The original release note is in the changelog.