Multi-factor authentication
Manage your authenticator enrollment and recovery codes.
Authenticator app
Enrolled- Enrolled
- Jun 14, 2026
- Method
- Time-based one-time code (TOTP)
Recovery codes
7 of 10 single-use codes remaining. Code values are stored only as hashes — they are shown exactly once, immediately after generation, and can never be re-displayed.
Authenticator app
Not enrolledScan the QR with your authenticator, then enter the 6-digit code to confirm.
Recovery codes
Ten single-use codes are generated when you activate MFA and displayed exactly once. Store them somewhere safe before leaving that screen.
Turn on two-factor sign-in with an authenticator app. Setup hands you a set of one-time recovery codes — shown exactly once, so store them somewhere safe; each one gets you in a single time if you lose your device.
Behind this page/security/mfa · authenticated
Retrieve
Enrollment state read from the current session; the TOTP secret never leaves the server.Save
Begin →sp_Auth_BeginMfaEnrollment; activate → sp_Auth_ActivateMfaEnrollment; disable → sp_Auth_DisableMfa; recovery → sp_Auth_ConsumeMfaRecoveryCode; regenerate → sp_Auth_RegenerateMfaRecoveryCodes (replaces unused codes only; consumed codes stay as history; plaintext shown once).Success
- Codes shown once, stored as hashes.
- Activation requires a valid TOTP.
- Disable requires re-authentication.
CLI handoff
Implement this scaffold from the structured contract, then remove hard-coded preview rows. The source of truth is CLI Handoff and admin-cli-manifest.json.
Server-inject identity and scope values; never trust browser-supplied account, app, tenant, user, entitlement, price, or permission identifiers. Preserve the loading, empty, forbidden, failed, retrying, and completed states shown by the preview.