---
sourceDocument: Australia Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/platform-security

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# MFA verification methods

# Multi-factor authentication verification methods {#ariaid-title1}

Release version: Australia  
Updated March 12, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Multi-factor authentication verification methods

ServiceNow's Multi-factor Authentication (MFA) supports various verification methods to enhance login security.
These methods provide additional authentication factors beyond username and password, helping customers protect their instances effectively.
Show full answer Show less  

## Verification Methods

* **Authenticator Applications:** Third-party apps like Google Authenticator and Microsoft Authenticator generate temporary passcodes used alongside passwords for MFA. Users must install these apps on their mobile devices and configure them by scanning a QR code.
* **Hardware Keys and Biometric Scanners (Web Authentication):** Enabled via the Web Authentication plugin, these include physical hardware keys and biometric readers (fingerprint or facial recognition). Users can register and use these authenticators for secure login.
* **Passkey:** A passwordless login method where users unlock their device with a biometric sensor, PIN, or pattern to authenticate securely.
* **SMS-based One-Time Password (OTP):** Administrators can require users to verify login attempts by entering a six-digit code sent via SMS to their registered mobile number.
* **Email-based OTP:** Similar to SMS OTP, users receive a six-digit verification code via email to authenticate their login.

## Practical Benefits for ServiceNow Customers

These MFA verification methods allow ServiceNow customers to customize and strengthen user authentication according to their security policies and user preferences. Customers can independently set up and manage factors such as authenticator apps, biometric devices, hardware keys, SMS, and email OTPs. This flexibility supports compliance requirements and enhances protection against unauthorized access.  
ServiceNow's MFA supports verification methods such as Authenticator App, Fast IDentity Online 2 (FIDO2) and Time-based One-Time Password (TOTP).

The users can use the following options in addition to their user name and password to fulfill multi-factor authentication requirements. The users can setup MFA factors such as Authenticator applications, Biometric scanners, Hardware
Keys, and SMS independently.

## Authenticator applications {#mfa-methods__section_klr_nvd_bdc}

An authenticator application is third-party software that generates temporary passcodes. Users can use these passcodes along with their password to log in into an instance that requires multi-factor authentication (MFA). For more
detail on these applications, see [Authenticator applications](https://www.servicenow.com/docs/rFAMITyVvPRoQ71V30X7RA "Use third party authenticator applications to generate temporary MFA pass codes.").

<br />

Note:  
Install an authenticator app such as Google Authenticator or Microsoft Authenticator on your mobile device before scanning the QR code. The QR code configures your authenticator app for this account; it does not install the app.

## Hardware Keys and Biometric scanners (Web Authentication) {#mfa-methods__section_zrp_pvd_bdc}

The Integration - Web Authentication (com.snc.integration.webauthn) plugin allows hardware key or biometric reader authentication on your instance.

Biometric authenticators use fingerprint or facial recognition to identify users. Your users can use these authenticators on their devices as part of the multi-factor login process. For details on registering biometric authenticators,
see [Register a biometric authenticator](https://www.servicenow.com/docs/zA4c2P_j6LIWvEo_ycWgyA "Register a biometric authenticator to use as part of your MFA login.").

<br />

Hardware keys are physical hardware that you can use to authenticate. Hardware keys are inserted into a port on your device to provide authentication. For details on registering hardware keys, see [Register a hardware security key](https://www.servicenow.com/docs/9CC2Jh_QFLlIQkCqf8HRNQ "Register a hardware key to use as part of your MFA login.").

![Hardware key icon]()

## Passkey {#mfa-methods__section_ity_g1m_ndc}

Passkey authentication is a secure, password less method of log in, where the users use a passkey by unlocking their device with a biometric sensor, PIN, or pattern.

## SMS {#mfa-methods__section_m4g_svd_bdc}

Admin can configure ServiceNow instance to require users who attempt to log in to the instance using SMS based OTP.

When users attempt to log in to ServiceNow, SMS OTP is sent to the mobile number associated with the sys_user record. Users can enter the six-digit verification code that it sent to the mobile device and verify their identity. For more
information, see [SMS as an MFA factor](https://www.servicenow.com/docs/pehlaoyoVnRnfC7ai9f9Zg "Multi-factor authentication (MFA) with SMS as a factor for your authentication.").

![SMS]()

## Email {#mfa-methods__section_dc4_5vd_bdc}

Admin can configure ServiceNow instance to require users who attempt to log in to the instance using Email based OTP.

When users attempt to log in to ServiceNow, Email OTP is sent to the email address of the user. Users can enter the six-digit verification code that it sent to the email address and verify their identity. For more information, see [Email as an MFA factor](https://www.servicenow.com/docs/iUQsZDkp9ddfPMD76uJIAw "Multi-factor authentication (MFA) with Email as a factor for your authentication.").

![Email]()

**Related concepts**   

* [Web Authentication - MFA](https://www.servicenow.com/docs/CHV7OFMEJtUXVqKHvOVr0A "Use the Integration - Web Authentication (com.snc.integration.webauthn) to allow hardware key or biometric reader authentication on your instance.")
* [Multi-factor authentication verification methods](https://www.servicenow.com/docs/Us69pQt3nz5RVACkOu3RzQ "ServiceNow's MFA supports verification methods such as Authenticator App, Fast IDentity Online 2 (FIDO2) and Time-based One-Time Password (TOTP).")
* [Email as an MFA factor](https://www.servicenow.com/docs/iUQsZDkp9ddfPMD76uJIAw "Multi-factor authentication (MFA) with Email as a factor for your authentication.")