Organisation-Level MFA allows organisations in Access Evo to enforce multi-factor authentication (MFA) requirements on their users, independently of and in addition to the existing domain security policy.
This means each organisation can set its own minimum authentication requirement that applies specifically to its users, regardless of whether the domain itself enforces MFA. The Organisation Administrator configures this in the Security Options page within Organisation Settings.
Getting started
Prerequisites
Before configuring Organisation-Level MFA, ensure you have Organisation Administrator access in Access Evo.
Accessing the security options page
The Organisation-Level MFA setting is found in Organisation Settings in Evo.
Sign in to Access Evo as an Organisation Administrator.
Go to Organisation Settings, then open the Security Options page.
The Minimum Authentication Requirement control appears here.
📌Note: The Security Options page is only visible to Organisation Administrators. Standard users and managers do not have access to this setting.
Authentication levels
The Minimum Authentication Requirement determines which sign-in methods users must satisfy. There are four levels, ranging from password-only to phishing-resistant hardware authentication.
Level | Evo UI Label | Description | Badge |
0 — Basic | Password only | Users authenticate with their password only. MFA is optional — users may set it up, but are not required to. | BASIC |
1 — Advanced (SMS) | Text message, Authenticator app or FIDO2 | Users must authenticate with at least SMS in addition to their password. Authenticator app or FIDO2 also satisfy this level. | ADVANCED |
2 — Advanced (App) | Authenticator app or FIDO2 authenticators | Users must authenticate with at least an Authenticator app in addition to their password. FIDO2 also satisfies this level. | ADVANCED |
3 — High | FIDO2 authenticators only | Users must authenticate with a FIDO2 hardware key in addition to their password. This is the highest level of security available. | HIGH |
MFA level hierarchy
Authentication levels follow a strict security hierarchy. A more secure method always satisfies a lower-level requirement, so you will never need to configure multiple methods for a single user to meet a lower threshold.
FIDO2 (Level 3) > Authenticator app (Level 2) > Text message (Level 1) > Password (Level 0)
The table below shows which methods satisfy each configured level:
User's configured method | Level 0 (Password) | Level 1 (SMS) | Level 2 (App) | Level 3 (FIDO2) |
Password only | ✓ | ✗ | ✗ | ✗ |
Text message (SMS) | ✓ | ✓ | ✗ | ✗ |
Authenticator app | ✓ | ✓ | ✓ | ✗ |
FIDO2 hardware key | ✓ | ✓ | ✓ | ✓ |
Security considerations
Each authentication method carries different security risks. Access Evo displays these risks in the Security Options UI to help you choose the right level for your organisation.
Method | Security Consideration |
Text message (SMS) | Can be intercepted via SIM-swapping attacks and is vulnerable to phishing. |
Authenticator app (TOTP) | Vulnerable to phishing attacks if users share codes with attackers. |
FIDO2 hardware key | Phishing-resistant and cryptographically secure — the recommended option for high-security environments. |
Configure Organisation-Level MFA
Set the Minimum Authentication Requirement
To set the Minimum Authentication Requirement, follow the steps below.
Go to Organisation Settings then in Access Evo, click Security Options.
Locate the Minimum Authentication Requirement setting.
Select the level appropriate for your organisation.
Save your changes.
📌Note: Changing this setting takes effect immediately. Users who do not have a qualifying MFA method already configured will be redirected to set one up on their next sign-in.
Check compatibility with your domain security policy
The Organisation-Level MFA setting must be compatible with the domain security policy configured in Access Identity. For example, if your organisation requires SMS (Level 1) but the domain policy has SMS disabled, users will not be able to satisfy the requirement.
To check the compatibility, follow the steps below.
In the Security Options page, click Check Security Policy.
A compatibility dialogue appears, showing each MFA method and whether it is:
Column | Values | What to look for |
Organisation Security Options | Allowed / Not Allowed | Which methods your organisation level permits |
Security Policy Options | Allowed / Not Allowed | Which methods the domain policy permits |
Compatible | ✓ (green) / ✗ (red) | A red cross indicates a conflict that may prevent users from signing in |
📌Note: If a conflict is shown, contact your domain administrator or Access Identity support to align the domain security policy before enforcing the organisation-level requirement.
User sign-in experience
When a user signs in to Evo and your organisation has an MFA level configured, Evo follows this process:
The user signs in with their email address and password.
Evo checks whether the user's organisation has an MFA level configured.
If the user already has a qualifying MFA method set up and enabled, Evo prompts them to verify using that method and they can proceed.
If the user does not have a qualifying MFA method, Evo redirects them to Access Identity to set up the required MFA method.
📌Note: Evo only redirects users to set up MFA if their existing method does not satisfy the configured level. Users who already have a higher-level method are not affected.
MFA recovery and lockout
If a user cannot complete MFA, for example because they have lost their authenticator device or no longer have access to their registered phone number, the recovery path depends on their domain configuration.
Recovery path summary
User Type | Backup Codes Available? | Recovery Path | Who Acts |
Domain user (email on a verified domain in Access Identity) | N/A | Domain owner disables 2FA via the Administrator UI | Domain owner |
Non-domain user (e.g. gmail.com) | Yes | User signs in using a backup code | User (self-service) |
Non-domain user (e.g. gmail.com) | No | Support ticket to Access Identity support | Access Identity team |
Recovery path 1: Domain owner disables 2FA
This path applies when the locked-out user's email address belongs to a domain that is verified and owned within Access Identity.
A section titled Disable two-factor authentication for someone else is visible.
Enter the email address of the locked-out user then select Disable two-factor authentication.
Access Evo confirms the action and creates an audit log entry.
📌Note: Domain owners can only act on users whose email address belongs to a domain they own. They cannot disable 2FA for users on domains they do not control, including external domains such as gmail.com.
Recovery path 2: Non-domain users
A domain owner cannot recover users who authenticate with an external or unverified domain (for example, gmail.com). You have two options:
Option A: User has backup codes
On the sign-in screen, when prompted for MFA verification, select Use a backup code.
Enter one of your previously generated backup codes.
You can now access your MFA settings to reconfigure or disable MFA.
📌Note: Backup codes are generated at the time of MFA setup. Advise your users to store backup codes in a secure location when they first configure MFA.
Option B: User does not have backup codes
If the user does not have backup codes available, raise a support ticket with Access Identity support. The Access Identity team can disable MFA at the user level directly, following an internal process. Access Evo creates an audit log entry for this action.
After Access Identity resolves the support ticket, the experience is the same as Recovery Path 1. The user can sign in without MFA and Access Evo does not automatically prompt them to set it up again.