--- sourceDocument: Australia Platform security sourceDocumentLink: https://www.servicenow.com/docs/r/australia/platform-security Release : - australia ft:locale : - en-US ft:publication_title : - Australia Platform security ft:clusterId : - psec bundleId : - psec workflow : - Platform --- # Exploring MFA # Exploring Multi-factor Authentication {#ariaid-title1} Release version: Australia Updated March 12, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Exploring Multi-factor Authentication Multi-factor Authentication (MFA) enhances security by requiring users to provide two or more verification factors beyond just a username and password. This additional layer significantly reduces the risk of unauthorized access and protects against cyberthreats such as phishing and identity theft. ServiceNow activates MFA by default, ensuring stronger protection for user accounts. Show full answer Show less ## Verification Factors and Their Security Levels MFA verification factors are categorized based on their security strength: * **Secured Factors:** * **FIDO (Fast Identity Online):** Uses hardware tokens or biometric authentication, confirming identity with a physical device or biometric trait. * **TOTP (Time-Based One-time Password):** Generates short-lived codes (usually every 30 seconds) via mobile apps, requiring access to a specific device. * **Less-Secured Factors:** * **Email:** Sends verification codes or links via email, which is more vulnerable to compromise. * **SMS:** Sends codes via text message, vulnerable to SIM swapping and mobile threats. For stronger security, ServiceNow recommends prioritizing secured factors like FIDO and TOTP over less-secured methods. ## ServiceNow MFA Features * **Activation:** MFA is enabled by default via the `glide.authenticate.multifactor` property. Disabling MFA requires a formal business justification. * **Supported Verification Methods:** * **Authenticator App:** Generates temporary verification codes (e.g., Okta, Google Authenticator, Microsoft Authenticator). * **FIDO2:** Physical hardware keys or biometric devices like YubiKey or Apple Touch ID. * **Passkey:** Device unlocking via biometrics, PIN, or patterns used for login. * **OTP:** One-time passwords generated based on secret key and time, including SMS and email OTPs. * **Integration:** MFA can be used with ServiceNow's local database authentication, LDAP, and Single Sign-On (SSO) protocols such as SAML or OIDC. ## Practical Implications for ServiceNow Customers By leveraging ServiceNow's MFA capabilities, customers can strengthen their security posture, reduce unauthorized access risks, and comply with security best practices. The default activation ensures immediate protection, while flexible verification methods and integration options allow seamless adoption within existing authentication workflows. Multi-factor Authentication (MFA) is an authentication method that requires users to provide information other than their basic credentials. MFA is a security process that requires a user to provide two or more different verification factors to access a service or account. It adds an extra security layer of protection to your service beyond just a password, which makes it harder for unauthorized individuals to gain access. By requiring multiple factors, MFA significantly enhances security and helps protect against various cyberthreats, including phishing and identity theft. Here's some insight about how MFA works: * First factor: The user using their user name and password for login. * Second factor: The user is prompted for a second factor that's with the user (An identity verification method such as an authenticator app or security key). {#explore-mfa__ul_pnn_2nn_zcc} Further, these factors can be typically categorized into secured and less-secured based on their level of protection against common security threats. * Secured Factors: * FIDO (Fast Identity Online): This factor uses hardware tokens or biometric authentication methods, providing a high level of security by confirming that the user has a physical device or unique biometric trait to verify their identity. * **TOTP (Time-Based One-time Password):** This factor generates a one-time password that is valid for a short period, usually 30 seconds. It's typically delivered through a mobile app, adding an extra layer of security by requiring the user to have access to a specific device and app. {#explore-mfa__ul_w2q_wcf_3fc} * Less-Secured Factors: * **EMAIL:** This factor sends a verification code or link to the user's email address. While convenient, it's less secure because email accounts can be compromised. * **SMS:** This factor sends a verification code via text message to the user's phone number. It's also less secure due to the potential for SIM swapping and other mobile phone vulnerabilities. {#explore-mfa__ul_x2q_wcf_3fc} {#explore-mfa__ul_pvl_ycf_3fc} To enhance security, it's recommended to prioritize the use of secured factors like FIDO and TOTP over less-secured factors like EMAIL and SMS. Note: * MFA is activated by default on ServiceNow. * MFA is enabled using glide.authenticate.multifactor property. If you want to disable this property, you must provide a business justification about why you want to disable MFA. {#explore-mfa__ul_xq1_yzl_ndc}
ServiceNow's MFA supports verification methods such as Authenticator App, Fast IDentity Online 2 (FIDO2), Passkey, and time-based One-time Password (OTP). Following are the details of available verification methods: * Authenticator App: Apps that generate unique, temporary verification codes. For example: Okta, Google Authenticator, Microsoft Authenticator, and so on * FIDO2: Physical devices that use public-key cryptography to validate user identities. For example: Hardware Keys (YubiKey), Biometric scanners (Apple's Touch ID). * Passkey: Log in with a passkey by unlocking the device with a biometric sensor, PIN, or pattern. * OTP: The secret key and the current time to generate a unique password that is only valid for a short period. For example: SMS (OTP) and Email (OTP). {#explore-mfa__ul_c4j_fjn_zcc} You can use MFA along with the following: * Local Database Authentication (native ServiceNow authentication) or [Lightweight Directory Access Protocol integration](https://www.servicenow.com/docs/22PBKvfFbT4zZ0ssS6MXLw "An LDAP integration allows your instance to use your existing LDAP server as the primary source of user data.") * SSO SAML or SSO OIDC. For more information, see [Multi-Provider single sign-on (SSO)](https://www.servicenow.com/docs/1dL2d_G_dUyzIgq7qYUjqQ "External SSO allows organizations to use several SSO identity providers (IdPs) to manage authentication as well as retain local database (basic) authentication."). {#explore-mfa__ul_wxr_jn4_jx} **Related concepts** * [Multi-factor authentication verification methods](https://www.servicenow.com/docs/Us69pQt3nz5RVACkOu3RzQ "ServiceNow's MFA supports verification methods such as Authenticator App, Fast IDentity Online 2 (FIDO2) and Time-based One-Time Password (TOTP).") **Related reference** * [Multi-factor Authentication system properties](https://www.servicenow.com/docs/NLiA8LMkaB~p9jANR0BowQ "Use system properties to enable and customize MFA to meet your security requirements.")