Authenticator enrollment and organization MFA policy

Product Zbix CRM · Version 1.2.0 · Source reviewed · Reviewed 28 October 2026
Audience Administrators and implementation teams · Deployment All supported models

Overview

Security Settings supports time-based authenticator verification and one-use recovery codes. Enrollment is tied to the current session and protected by password reauthentication. The organization can keep MFA optional, require it for administrators or require it for all users. Administrative recovery resets another user’s factor, revokes their sessions and requires enrollment again.

Purpose

Use MFA to add a second verification step and maintain a controlled recovery process for lost authenticators.

Prerequisites

• An active account and the current password.

• An authenticator application and a protected place to store recovery codes.

• Administrator identity and an enrolled factor for organization policy changes.

Procedure

1. Open Administration > Security Settings and choose Set up authenticator app. Reauthenticate with the current password.

2. Add the displayed enrollment to the authenticator and enter the requested current code to confirm. Keep the enrollment secret private.

3. Store the displayed recovery codes securely. They are shown once and each can be used once. Verify the panel reports the authenticator enabled.

4. For an organization policy change, select Optional for everyone, Required for administrators or Required for all users, then choose Review MFA policy change. Confirm using the current password and a fresh factor.

5. For a verified lost-factor case, select the other user under Administrator recovery, supply the recovery reason and complete the administrator’s reauthentication. Have the affected user sign in and enroll again.

Expected result

The account or organization policy is updated with audit history, and recovery revokes affected sessions.

Important notes

• TOTP secrets require a durable external encryption key. Key custody is an installation responsibility; user recovery codes do not replace that key.

• A code already accepted cannot be replayed. The interface describes a 30-second code cycle and an adjacent time-step allowance.

• Required MFA cannot be disabled by the user while the policy applies.

• Do not publish QR enrollment images, secret text or recovery codes in a support case.

Troubleshooting

• Authenticator codes fail repeatedly: verify the phone clock and use a fresh code; use an unused recovery code if available.

• Organization policy cannot be changed: enroll the administrator first and resolve any user-enrollment prerequisites reported by the application.

Related articles

• Authentication and sign in architecture

• Manage sessions and sign out other devices

• Password change and account recovery