Skip to main content
Version: 5.0 🚧

Multi-factor authentication

Overview​

Use the Multi-factor authentication settings page to control how PowerManage validates user sign-in with one-time passwords (OTP) sent by SMS.

Use this page when you need to:

  • Turn MFA on or off.
  • Select the SMS broker used to deliver verification codes.
  • Define OTP expiration, resend, retry, and blocking behavior.
  • Reduce account takeover risk by tightening verification and lockout controls.

This page helps you balance security and usability by controlling how long codes remain valid, how often users can request new codes, and when the system blocks or escalates repeated failures.

Before you begin​

Required permissions​

  • You must have permission to edit Resolve category settings in Server Settings.

Preconditions​

  • You are signed in with an account that can edit server settings.
  • At least one SMS broker is available if you plan to enable MFA.
  • You know the security policy your organization expects for OTP lifetime, retries, and blocking timeouts.

Dependencies​

  • MFA SMS delivery depends on a working SMS broker.
  • Numeric settings must remain within the accepted ranges shown in the dialog.
  • Users must have a valid mobile number if MFA is delivered by SMS.

Important limitations​

warning
  • If MFA is enabled without a working SMS broker, users will not receive verification codes.
  • Short OTP lifetimes or low retry limits can increase failed sign-in attempts.
  • Long block timeouts can prevent legitimate users from accessing the system until the timeout expires.

Page layout​

MFA settings dialog​

info

The MFA settings dialog is shown as separate screenshots by section. Use the tabs below to view each part of the dialog.

Multi-factor authentication settings (light)Multi-factor authentication settings (dark)
CalloutUI elementDescriptionWhen to use
1MFA statusControls whether MFA is active for the system.Use to enable or disable multi-factor authentication.
2SMS brokerSelects the SMS provider used to deliver OTP codes to users.Use when MFA is enabled and SMS delivery is required.
3OTP TTL, secondsSets how long an OTP remains valid after it is generated. Accepted values: 60-1200 seconds.Use to define how long users have to enter the code before it expires.
4OTP length, symbolsSets the number of characters in the OTP. Accepted values: 4-12 symbols.Use to balance code strength and usability.

How to use this page​

Enable MFA​

Goal:

  • Turn on MFA and select the SMS provider used for OTP delivery.

Steps:

  1. Open Settings.
  2. Select or scroll to Multi-factor authentication.
  3. Select the edit icon.
  4. Set MFA status to Enabled.
  5. Select an SMS broker.
  6. Review the remaining security settings.
  7. Select Save.

Expected result:

  • MFA is enabled and the system uses the selected SMS broker to deliver OTP codes.

Configure OTP lifetime and code length​

Goal:

  • Define how long verification codes remain valid and how long each code is.

Steps:

  1. Open the Multi-factor authentication edit dialog.
  2. Enter a value for OTP TTL, seconds between 60 and 1200.
  3. Enter a value for OTP length, symbols between 4 and 12.
  4. Review the values.
  5. Select Save.

Expected result:

  • The system saves the OTP expiration and code length settings.
note

A 6-character OTP is commonly used because it balances readability and security, but the correct value depends on your organization policy.

Configure resend and retry controls​

Goal:

  • Limit how often users can request new codes and reduce repeated verification abuse.

Steps:

  1. Open the Multi-factor authentication edit dialog.
  2. Set Resend timeout, seconds to a value between 30 and 600.
  3. Set Resend count, times to a value between 1 and 10.
  4. Set Verification sessions times, times to a value between 1 and 10.
  5. Select Save.

Expected result:

  • The system applies the new resend waiting time, resend limit, and failed verification session threshold.

Disable MFA​

Goal:

  • Turn off multi-factor authentication for the system.

Steps:

  1. Open the Multi-factor authentication edit dialog.
  2. Set MFA status to Disabled.
  3. Review the impact with your security policy.
  4. Select Save.

Expected result:

  • MFA is disabled for future sign-in attempts.
warning

Disabling MFA reduces account protection. Use this only when your organization allows password-only sign-in.

Tips​

tip
  • Select a working SMS broker before enabling MFA.
  • Keep OTP TTL long enough for users to receive and enter the code, but short enough to limit reuse risk.
  • Use a moderate Resend timeout to reduce SMS abuse without creating unnecessary friction.

Troubleshooting​

Users do not receive MFA codes​

Possible causes

  • No SMS broker is selected.
  • The selected broker is unavailable or not configured correctly.
  • The user does not have a valid mobile number.

What to do

  1. Open the Multi-factor authentication settings.
  2. Confirm that MFA status is enabled.
  3. Confirm that an SMS broker is selected.
  4. Verify the message broker configuration.
  5. Confirm that the affected user has a valid mobile number.

Users are blocked too quickly during verification​

Possible causes

  • Failed attempts count blocker, times is set too low.
  • Blocking timeout, seconds is too long for normal user behavior.
  • OTP TTL, seconds is too short and codes expire before users can enter them.

What to do

  1. Review the current lockout and expiration values.
  2. Increase Failed attempts count blocker, times if the policy allows it.
  3. Increase OTP TTL, seconds if users do not have enough time to enter the code.
  4. Reduce Blocking timeout, seconds if temporary lockouts are too disruptive.
info
Was this page helpful?