Configures Time-based One-Time Password (TOTP) two-factor authentication, compatible with apps such as Microsoft Authenticator, Google Authenticator, Authy, and any RFC 6238-compliant app.

Settings

Issuer

The name displayed in the authenticator app alongside the TOTP entry. Use your application or organisation name so users can easily identify the account (e.g. Acme Corp).

Allow Login Registration

When enabled, users who do not yet have an authenticator enrolled will be prompted to set one up during their first login. Disable to require pre-enrolment by an administrator.

Allow Skip

When enabled, users can skip TOTP enrolment for a limited number of logins (see Maximum Skips). Useful during initial roll-out to allow a grace period.

Maximum Skips

The maximum number of times a user can skip TOTP enrolment before it becomes mandatory. Default is 5.

Instructions

Custom instructions shown to users on the TOTP enrolment page. Explain how to scan the QR code with their authenticator app.

How TOTP Works

During enrolment a QR code is displayed. The user scans this with their authenticator app, which then generates a new 6-digit code every 30 seconds. This code must be entered at login as a second factor.