Environment-wide protection
Require every user to enroll in a second factor for a security-sensitive application.
Kinde · Const
MFA enforcement
Kinde lets administrators make MFA mandatory or optional for users. Environment settings apply globally, while organization-level settings can narrow enforcement to one organization.
How it works
MFA enforcement makes users configure and use a second authentication factor during sign-up or their next sign-in. It can be required for the whole environment, or configured separately for individual organizations when that feature is available.
Key points
- The environment setting supports two policies: require MFA for users or offer it as an opt-in.
- Available secondary factors include email OTP, SMS OTP, and an authenticator app.
- Mandatory enforcement triggers enrollment at first registration or at the next login.
- Organization-scoped enforcement is available when MFA should not apply across the whole environment.
- Administrators choose which secondary methods are offered rather than automatically enabling every method.
- After saving the configuration, sign-in flows direct users through MFA.
Common mistakes
- Environment-level configuration affects every user; use organization-level settings when enforcement must be narrower.
- Recovery codes are enabled initially; disabling them removes the recovery-code generation and display step during MFA setup.
Example: Enable environment-wide MFA
# Configure in Kinde Dashboard:
# Settings > Environment > Multi-factor auth
# Require multi-factor authentication: Yes
# Select authentication methods, then SaveEnable mandatory MFA for every user in the environment through the Kinde dashboard.
When to use it
Gradual adoption
Offer MFA without forcing enrollment immediately, allowing users to opt in at their next sign-in.
Organization-specific enforcement
Apply stronger authentication requirements to one customer organization without changing other organizations.
Interview questions
QHow do you enforce MFA for all users?
Set **Require multi-factor authentication** to **Yes** under Settings > Environment > Multi-factor auth, choose the available additional methods, and save. Users then have to set up MFA when they first sign up or next sign in.
Follow-up: How would you limit enforcement to one organization? Use the organization’s Multi-factor auth settings and enable enforcement there, rather than applying it at the environment level.
QHow does optional MFA differ from mandatory MFA?
Choose **Optional** instead of **Yes** in the environment’s MFA settings. Users can then choose whether to set up MFA when they first sign up or next sign in.
Follow-up: What happens after a user opts in? They use the selected secondary method during subsequent sign-ins and can use recovery codes if those are enabled.
QWhich secondary factors can be enabled?
Kinde supports email OTP, SMS OTP, and authenticator apps as secondary factors. The dashboard lets you select which additional authentication options users may use.
Follow-up: What configuration detail affects recovery? The Enable recovery codes toggle controls whether recovery codes are shown during MFA setup and is enabled by default.
Related
Multi-factor authenticationSet multi-factor authentication for an organizationEnable recovery codesAuthenticator appEmail OTPSMS OTP