# Using Multi-Factor Authentication (MFA)

* Up to version 1.4, only internal MFA was supported, user could only use MFA methods configured in his profile.
* Since version 1.5 (currently in alpha), MFA can be configured per location, and administrators can choose whether a location will use internal MFA or external OIDC/SSO provider.

Depending on location settings, you may use:

* Internal MFA - You must have at least one MFA method configured in your profile. For a detailed tutorial, [check out this article](https://docs.defguard.net/1.5/using-defguard-for-end-users/setting-up-2fa-mfa).
* External MFA - You will be redirected to an external site, where authentication is handled by your OIDC provider, for example Google/Microsoft.

## External MFA

1. Open Defguard client, select your Instance and click **Connect** next to location with required MFA

<figure><img src="https://content.gitbook.com/content/kHPDOBrb5X1TB8O3GsjW/blobs/BOw4dYgcKbvQ39zfV1ET/defguard-client-instances.png" alt=""><figcaption></figcaption></figure>

2. After clicking **Authenticate with Google,** you will be redirected to a secure site where you will need to log in in order to confirm your identity. In this example, we use Google as our OpenID provider, but yours can be different (Microsoft, Okta, etc.)

<figure><img src="https://content.gitbook.com/content/kHPDOBrb5X1TB8O3GsjW/blobs/1rvX5YCE58K3Pzuh1R7G/defguard-client-openid.png" alt="" width="563"><figcaption></figcaption></figure>

3. After logging in, you will see this

<figure><img src="https://content.gitbook.com/content/kHPDOBrb5X1TB8O3GsjW/blobs/wGVDflJBW6ga6XTB1KA5/defguard-openid-success.png" alt="" width="375"><figcaption></figcaption></figure>

Your connection will be established immediately after successful authentication.

## Internal MFA

1. Open Defguard client, select your Instance and click **Connect** next to location with required MFA

<figure><img src="https://content.gitbook.com/content/kHPDOBrb5X1TB8O3GsjW/blobs/BOw4dYgcKbvQ39zfV1ET/defguard-client-instances.png" alt=""><figcaption></figcaption></figure>

2. Choose method configured for your account, and click **Connect**.
   * If you're using "Email" method, please enter the code sent to your email.
   * If you're using "Authenticator App", please enter code generated within your authenticator app.

{% hint style="info" %}
If you don't know how to set up or use your **Authenticator App,** please check [this article](https://docs.defguard.net/1.5/setting-up-2fa-mfa#setting-up-2famfa) for detailed information.
{% endhint %}

<figure><img src="https://4041812211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkHPDOBrb5X1TB8O3GsjW%2Fuploads%2Fr9sNCcP7RjJk5utnkWNe%2Fmfa-modal.png?alt=media&#x26;token=8665862e-b5b3-4a16-bf52-2467e18baf78" alt="" width="563"><figcaption></figcaption></figure>

{% hint style="info" %}
If you need a guide explaining how to use Mobile Client as your MFA method, please [scroll down.](#authenticating-via-biometry)
{% endhint %}

3. After entering code, click **Verify**

<figure><img src="https://content.gitbook.com/content/kHPDOBrb5X1TB8O3GsjW/blobs/sXnhgX25kcqCEL0P9Qty/defguard-client-2fa.png" alt="" width="563"><figcaption></figcaption></figure>

Your connection will be established immediately after this step.

## Multi-Factor Authentication via Mobile Biometry

After configuring VPN on your mobile device and [enabling Biometry](https://docs.defguard.net/1.5/mobile-client/using-biometry-as-mfa-method#setting-up-biometry), we not only enable Biometry based connecting on a mobile device, but add an extra security layer to have the most secure/sophisticated MFA method available.&#x20;

After enabling Biometry we create an additional private/public key par, with the private key stored on the hardware/secure storage, and inform in the UI, that this device now can be used for MFA using Biometry on a desktop client:

<figure><img src="https://4041812211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkHPDOBrb5X1TB8O3GsjW%2Fuploads%2FYQq6XK7TmdOr7cqthhOr%2Fdevice-list-biometry.png?alt=media&#x26;token=d67aa94c-afdf-4067-8dae-e6a2c3e6f4da" alt="" width="563"><figcaption></figcaption></figure>

Now, when you connect on the desktop client to a location that has Internal MFA configured, you can choose **“Mobile App”** for MFA, then a QR code will be shown.

<figure><img src="https://4041812211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkHPDOBrb5X1TB8O3GsjW%2Fuploads%2FLWHGatapaYKAwpHTsYHZ%2Fmobile-client-desktop-modal.png?alt=media&#x26;token=e8c9cf69-69c4-487d-8052-df4c8cc32804" alt="" width="375"><figcaption></figcaption></figure>

This QR code to be scanned on the mobile device for additional MFA steps:&#x20;

1. &#x20;Biometry authentication, that enables access to device secure storage&#x20;
2. Additional validation with private/public key pair between mobile/desktop/core server. After that, our “normal” MFA flow (with session keys, WireGuard private/public keys) takes place.

Here is a video showcasing this process:

{% embed url="<https://www.youtube.com/watch?v=b-XC76k4KVU>" %}

And here you can see the whole flow done with multiple steps including the user, desktop (and mobile) the Proxy and Defguard Core and gateway in the final step:

<figure><img src="https://4041812211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkHPDOBrb5X1TB8O3GsjW%2Fuploads%2F3YFJZ40kKMsvrXtraakL%2Fimage.png?alt=media&#x26;token=f5a106d3-71f9-461f-ba3d-22b8f11d8694" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.defguard.net/1.5/using-defguard-for-end-users/desktop-client/using-multi-factor-authentication-mfa.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.