Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What is the difference between MFA and 2FA?
Short answer
Both add, besides the password, one more proof of a different type to the login; the factor types are divided into something known (password, PIN), something possessed (phone, authenticator application, hardware key) and the person themselves (biometrics) (NIST SP 800-63B). 2FA (two-factor authentication) means exactly two factors, and MFA (multi-factor authentication) two or more factors; every 2FA is an MFA. In TR7, the two terms appear in two separate places: in AGS, Multi-Factor Authentication (MFA) profiles (E-mail OTP, TOTP, HTTP OTP) for application users are added to the access flow as an MFA step after authentication; Two-factor Authentication (2FA) on the Management Access screen, on the other hand, asks for a code sent by e-mail or SMS in addition to the password at login to the TR7 management interface. Management 2FA is off by default; when it is turned on, the code is sent, in the order of the methods selected in 2FA methods, to the user's e-mail address or phone number in Device Users; for users whose Authorization Source value is LDAP, the addresses read from the directory are also used.
Where It Is Used in TR7
| Where | Field / label | What for |
|---|---|---|
| AGS → Authentication → Multi-Factor Authentication (MFA) | MFA Method: E-mail OTP, TOTP, HTTP OTP; Trust Device | The second factor profile for application users; the built-in profiles TOTP Standard, TOTP Strict and E-mail OTP are selected in the flow |
| AGS-enabled vService → Flowchart | MFA step, MFA Profile | Adding the second factor to the access flow |
| AGS-enabled vService → Dashboard | The AGS TOTP, AGS OTP Sending (All Channels) and AGS OTP Verification (All Channels) charts on the AGS - MFA tab | Monitoring the second factor attempts |
| AGS → Integrations → Notification Profiles | Failed MFA Threshold (per min) | An alert when the failed MFA attempts exceed the threshold |
| Settings → Device Management → Management Access | Two-factor Authentication (2FA) (off by default), 2FA methods (e-mail, SMS) | The second factor for management interface login |
| Same screen | 2FA requiring user types, 2FA excluded users (default admin), 2FA no contact policy (Block login / Allow login) | From whom 2FA is requested; what is done to a user without contact information |
| Settings → User Management → Device Users | User e-mail, User Phone Number | The addresses to which the management 2FA code is sent |
Comparison
| 2FA | MFA | |
|---|---|---|
| Number of factors | Exactly two | Two or more |
| For whom in TR7 | Management interface users (Management Access) | The application users behind the AGS-enabled vService |
| Methods in TR7 | A code sent by e-mail or SMS | E-mail OTP; TOTP with an authenticator application; HTTP OTP with an external SMS or HTTP service that delivers the OTP code |
Common Misconceptions
- "Asking for two passwords is 2FA." The two factors must be of different types; two passwords are of the same type (something known).
- "Management Access 2FA also protects AGS users." Management 2FA protects only the login to the TR7 interface; for application users, a Multi-Factor Authentication (MFA) profile is added to the flow.
- "When 2FA is turned on, a code is requested from everyone." No code is requested from the users in the 2FA excluded users list (default admin); what happens to a user without contact information is determined by 2FA no contact policy.
How it is done in the documentation
