Creating an MFA policy
Note
This feature is at the Preview stage.
MFA policies enable configuring multi-factor authentication (MFA) for federated and local user accounts.
To create an MFA policy:
-
Log in to Yandex Identity Hub.
-
In the left-hand panel, select Security settings.
-
Navigate to the MFA policies tab.
-
In the top-right corner, click Create policy and in the window that opens:
-
In the Name field, enter a name for the new policy. Follow these naming requirements:
- It must be from 1 to 63 characters long.
- It may contain lowercase Latin letters, numbers, and hyphens.
- It must start with a letter and cannot end with a hyphen.
-
Optionally, enter a policy description in the Description field.
-
If you do not want to activate the policy upon creation, disable Policy active.
-
In the Factor types field, select additional authentication factors required for users from the policy's target groups to verify their identity:
-
Any. This option allows users to select one of the following additional authentication factor standards:-
WebAuthn (FIDO2). The acceptable additional authentication factors may include hardware keys such as Rutoken or YubiKey, Passkeys authenticators, platform authenticators such as Windows Hello, etc.
Warning
Browser extensions with password input control may cause errors when entering additional factors. We recommend disabling such extensions in case of errors.
-
TOTP. This standard enables using one-time codes generated by dedicated authenticator apps as an additional authentication factor.
-
-
Phishing-resistant. This option enforces the WebAuthn authentication factors as the most secure ones.
-
-
In the Creation deadline field, specify the period in days during which the user must add a second authentication factor after registration.
-
In the Lifetime field, set the credential validity period, in days.
Upon expiry of the specified timeout, the user will need to authenticate with the additional factor again.
-
Click Create policy.
-
If you do not have the Yandex Cloud CLI installed yet, install and initialize it.
By default, the CLI uses the folder specified when creating the profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also set a different folder for any specific command using the --folder-name or --folder-id parameter.
-
See the description of the CLI command for creating an MFA policy:
yc organization-manager mfa-enforcement create --help -
Create an MFA policy by running the command:
yc organization-manager mfa-enforcement create \ --organization-id <organization_ID> \ --acr-id <authentication_factor_type> \ --ttl <lifetime> \ --status <policy_status> \ --apply-at <activation_time> \ --enroll-window <creation_deadline> \ --name <policy_name> \ --description <policy_description>Where:
-
--name: Policy name. Follow these naming requirements:- It must be from 1 to 63 characters long.
- It may contain lowercase Latin letters, numbers, and hyphens.
- It must start with a letter and cannot end with a hyphen.
-
--organization-id: Organization ID. -
--acr-id: Authentication factor type. -
--ttl: Credential validity period in days. -
--status: Policy status, active (status-active) or inactive (status-inactive). -
--apply-at: Time after which the policy will become active. This is an optional parameter. -
--enroll-window: Period in days after registration during which the user must add a second authentication factor. -
--description: Policy description. This is an optional parameter.
-
-
Optionally, run the following command to activate an inactive MFA policy:
yc organization-manager mfa-enforcement activate \ --id <policy_ID>
Note