---
sourceDocument: Australia Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/platform-security
Release :
- australia
ft:locale :
- en-US
ft:publication_title :
- Australia Platform security
ft:clusterId :
- psec
bundleId :
- psec
workflow :
- Platform
---
# MFA system properties
# Multi-factor Authentication system properties {#ariaid-title1}
Release version: Australia
Updated March 12, 2026
 2 minutes to read
Summarize
 Summarized using AI
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.
## Summary of Multi-factor Authentication system properties
ServiceNow's Multi-factor Authentication (MFA) system properties enable customers to activate and tailor MFA to their organization's security needs.
These properties provide control over enforcement, setup experience, code validity, browser trust, and additional authentication methods, ensuring flexibility and enhanced security for user authentication.
Show full answer Show less
## Key Features
* **Enable MFA:** The `glide.authenticate.multifactor` property activates MFA. For API users, `glide.authenticate.multifactor.forintegrations` can enforce MFA on integrations. Note that MFA is enforced only for users who have already enrolled.
* **Setup Bypass Limit:** Configure how many times users can skip MFA setup using `glide.authenticate.multifactor.setup.bypass.count`, defaulting to zero skips.
* **One-Time Passcode (OTP) Validity:** Control the email OTP validity period via `glide.multifactor.onetime.code.validity` (default 5 minutes) and allow clock skew adjustments with `glide.authenticate.multifactor.clockskew` (default 10 seconds, max 60 seconds) to accommodate timing discrepancies during code entry.
* **Remember Browser Feature:** Enable users to bypass MFA prompts on trusted browsers with `glide.authenticate.multifactor.remember.browser.enable` (default enabled). The trusted browser status duration is set by `glide.authenticate.multifactor.browser.fingerprint.validity` (default 8 hours), and the maximum number of remembered browsers per user is controlled by `glide.authenticate.multifactor.remembered.browser.max.count`. The default checked state of the "remember this browser" option is set via `glide.authenticate.multifactor.remember.browser.default`.
* **Passwordless Authentication:** Optionally enable FIDO2-based passwordless MFA methods (hardware keys, biometrics) using `glide.webauthn.enabled`.
* **Email OTP Factor:** Enable email-based OTP as an MFA method with `glide.authenticate.multifactor.email.otp.enable`.
* **MFA UI Flexibility:** Allow users to use MFA factors without an authenticator app using `glide.auth.mfa.ui.v2.enabled`.
## Practical Impact for ServiceNow Customers
By configuring these system properties, ServiceNow customers can enforce MFA tailored to their security policies, improve user experience with flexible setup and browser trust options, and support modern authentication methods such as passwordless login and email OTP. Proper tuning of OTP validity and clock skew reduces login friction, while browser fingerprinting balances usability and security by remembering trusted devices.
Use system properties to enable and customize MFA to meet your security
requirements.
{#mfa-properties__table_lxg_qcz_bs__entry__2}
| Property | Description |
|-|-|
| glide.authenticate.multifactor | Enable Multi-factor Authentication. Note: To enforce MFA for API authentication, set the `glide.authenticate.multifactor.for_integrations` system property to `true`. MFA is enforced only for users who have already enrolled in MFA. Users who have not enrolled are not affected. Note: An upgrade to Zurich can set this property to `true` automatically. See [Changes due to the Multi-factor Authentication enforcement](https://www.servicenow.com/docs/oerSmoZiJQ7zeOMge5SS8g "Information about the changes that are expected due to the MFA enforcement."). |
| glide.authenticate.multifactor.setup.bypass.count | Number of times that a user can choose to skip the setup of MFA. The default is 0. |
| glide.multifactor.onetime.code.validity | Number of minutes that the reset code is valid. See [Log in with Multi-factor Authentication](https://www.servicenow.com/docs/W6OSEM2Pvv55kt~_9CZfvA "Login with MFA when it is enabled by your administrator on your instance."). The default is 5. Note: This property is for email OTP validation time. |
| glide.authenticate.multifactor.clock_skew | Number of additional seconds that the reset code is valid. The maximum is 60. The default is 10. The instance validates the code entered by the user against the single app-generated code that is generated at the `current time`. You can skew the time window with this property and allow one or more codes to be generated during a time window to be considered valid. The property's value is used in the following calculation: `current time - X/2` and `current time + X/2`, where `X` is the value of this property. If you use the value of `10`, for example, the instance considers any codes that the app generates within the time range `[the current time - 5 seconds]` and `[current time + 5 seconds]` to be valid. Use this property to prevent login issues where the user is unable to enter the correct code in the default time allotted. |
| glide.authenticate.multifactor.remember.browser.enable | Enables "remember this browser" for multi-factor authentication. When enabled, a user who has completed MFA on a given browser or device isn't prompted again on subseSets how long a remembered browser stays trusted after MFA is completed. Within this period, the user isn't challenged for MFA again in the same browser. Default: 8 hours. Note: Browser trust relies on a browser fingerprint (BFP) --- a hash computed from a set of browser and device parameters. If one of those parameters changes during the validity period --- for example, screen resolution changes when an external monitor is connected or disconnected --- the fingerprint no longer matches the one recorded when MFA was last completed, and the user is challenged for MFA again earlier than the validity period would suggest. a new browser or device. Default: true. |
| glide.authenticate.multifactor.browser.fingerprint.validity | After MFA remembers the browser, the user is not challenged for MFA in the same browser for this duration. The default is 8 hours. |
| glide.authenticate.multifactor.remembered.browser.max.count | The number of browsers MFA remembers for this user. |
| glide.authenticate.multifactor.remember.browser.default | Default value of the remember-browser check box in the validate multi-factor page. |
| glide.webauthn.enabled) | Option to enable passwordless authentication (FIDO2 based MFA) methods such as hardware key and biometric authentication. |
| glide.authenticate.multifactor.email.otp.enable | Option to enable email based OTP as a factor for MFA. |
| glide.auth.mfa.ui.v2.enabled | Option to enable MFA factor independently for the users without setting up an authenticator app. |
[Table 1. Multi-factor Authentication properties]
{#mfa-properties__table_lxg_qcz_bs}