auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

Advanced contextual-based feature only triggered by risky logins, mitigating hacking attacks, and reducing threat of data breaches while preserving user experience.

**BELLEVUE, Wash. – Dec. 15, 2020 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today launched [Adaptive Multi-factor Authentication (MFA)](https://auth0.com/blog/auth0-introduces-adaptive-mfa), a sophisticated security feature that helps reduce the threat of hacks and data breaches. Adaptive MFA is an important addition to Auth0's expanding security portfolio&mdash;which also includes Bot Detection, Breached Password Detection, Brute Force Protection, and Suspicious IP Throttling&mdash;and is one of the platform's most advanced context-based security features.

Adaptive MFA is designed to help companies address the inherent challenges of enabling security while preserving user experience. Unlike traditional MFA, which is triggered upon every login attempt and creates an additional step for the end user, Adaptive MFA only appears when a login is deemed risky. This is calculated by an overall risk score that measures abnormal behavior from known devices, impossible travel, and/or IP reputation. Customers can have the confidence that with Adaptive MFA, their end users are asked for secondary authentication only when behavioral signals don't conform to usual patterns for a particular user. 

For example, for a user who normally signs into their account at the same time every morning in San Francisco from a personal laptop, Adaptive MFA would only present a second-factor authenticator if login was attempted outside of the region, usual timeframe, or from a different computer or IP address. Developers can determine how much weight each signal is given to define the risk score that sets off the trigger. 

Many companies are reluctant to implement MFA&mdash;proven to be an effective defense against account hacking attacks&mdash;out of fear of negatively impacting user experience and thus their conversion and retention performance. However, additional friction during the signup, login, or checkout experiences can affect user conversion/retention, resulting in lost sales, and can potentially increase support incidents. Forrester predicts that the MFA market will grow to $2 billion by 2023[1], and this anticipated growth signals the need for a more intelligent and contextually-based MFA solution. 

"Auth0's mission is to provide secure access for everyone. Securing identities is core to that mission, and this new capability adds to the already powerful features in our security profile, designed to counter a variety of sophisticated threats, such as automated attacks, account takeovers, and phishing attacks," said Shiven Ramji, Chief Product Officer at Auth0. "Adaptive MFA should be a key consideration for any enterprise that has previously had to make a tradeoff between security and user experience. The ability to reduce friction while increasing security is a competitive differentiator for our customers."

More detailed information on Adaptive MFA can be found here: [When is MFA the Right Choice?](https://auth0.com/resources/whitepapers/is-mfa-the-right-choice) (whitepaper) and on Auth0's [Multi-factor Authentication](https://auth0.com/multifactor-authentication) page.

<include src="asides/AboutAuth0" />

### Media Contacts
Global Communications 
Auth0 
[press@auth0.com](mailto:press@auth0.com) 

Matter for Auth0 
[auth0@matternow.com](mailto:auth0@matternow.com) 

(1): Forrester Analytics: IAM Software Forecast, 2018 to 2023 (Global)

Auth0 Launches Adaptive MFA to Increase Security and Reduce Friction for End Users

randy_nasson

Director of Product Management for Customer Identity Cloud (formerly Auth0) in our Identity and Access Management (IAM) domain. I joined Auth0 in 2018 and assembled a world-class IAM product team dedicated to delivering customer value and enabling developers to quickly implement secure, robust, and seamless identity solutions. In addition to my current work with CIC, I regularly work with our Auth0 Lab team on greenfield initiatives and with our Strategic and Technical Partner teams on opportunities to drive revenue.

Director, Product Management (IAM)

Randy Nasson

antoniofuentes

Antonio is a Product Manager in charge of features and functions used by thousands of customers implementing identity systems to keep their users safe and prevent malicious activity.

Product Manager, Continuous Auth

Antonio Fuentes

Adaptive MFA Improves Security and Customer Experience



## Key takeaways

* [Multi-factor authentication (MFA)](https://auth0.com/docs/mfa) provides added security for protected content, but usability concerns can adversely affect the user experience.
* Using [custom MFA options](https://auth0.com/docs/mfa/customize-mfa-user-pages) can help reduce friction, but custom MFA requires [writing rules](https://auth0.com/docs/rules) (coding) or explicit user opt-in to minimize prompts for secondary factors.
* Auth0 now offers Adaptive MFA, which only prompts users for secondary authentication factors if the login or authorization attempt is considered risky.

## The Password Problem

The rapid growth of internet and software services means that user accounts are growing at a dizzying rate. According to [Dashlane](https://blog.dashlane.com/world-password-day/), the average US internet user has over 150 online accounts, with that number projected to double by 2022. That’s a ridiculous number of passwords to remember and an equally ridiculous amount of personal data to protect. 

Given the [rampant password reuse problem](https://securityboulevard.com/2020/04/8-scary-statistics-about-the-password-reuse-problem/) (65% of people reuse passwords across multiple sites), when data breaches occur, a vast number of accounts are vulnerable. While protective measures like [Breached Password Detection](https://auth0.com/docs/attack-protection/breached-password-detection) can help minimize risks associated with known stolen credentials, there nevertheless remains a substantial risk for potential credential theft in the future.

### Securing accounts with MFA

Fortunately, [MFA](https://auth0.com/docs/mfa) offers an excellent defense against password-related account compromise. [According to Open Web Application Security Project (OWASP)](https://cheatsheetseries.owasp.org/cheatsheets/Credential_Stuffing_Prevention_Cheat_Sheet.html), MFA is “by far the best defense against the majority of password-related attacks.” 

MFA is used to protect accounts and resources across a variety of industries and comes in myriad forms to accommodate various use cases. However, it remains woefully under-adopted in many areas, especially in consumer products and services. With some solutions, MFA can be overly complex or prohibitively costly to implement. And even when it is offered, many end-users reject it because they don’t want to worry about having access to the secondary factor when they are just trying to shop online, access an article behind a paywall, play a game, or stream music. Even for developer tools like NPM, [fewer than 10% of developers use secondary factors](https://www.zdnet.com/article/only-9-27-of-all-npm-developers-use-2fa/).

Balancing security and usability has historically been very difficult, with industry trends often overcompensating in one direction, then the other, causing even more user frustration. Fortunately, Auth0 makes it easy for you to provide the security of MFA without the poor user experience of having to provide a second factor with each login attempt.

![Introducing Adaptive MFA](https://images.ctfassets.net/23aumh6u8s0i/40V8USPBHCJ0K9SxZHISMw/b7488bb599ce8d9f83a3aeea0e4334fa/adaptive-mfa-sep1)

## Introducing Adaptive MFA

Adaptive MFA bridges the gap between user experience and account security by providing a secondary factor for end-users but only prompting them for secondary verification when the primary factor login looks suspicious or unusual. For example, if the user logs in from a new device or logs in from previously unseen geolocation, these signals can indicate low confidence that a login attempt is legitimate and that the user should be prompted to authenticate via the second factor.

![AMFA How it works](https://images.ctfassets.net/23aumh6u8s0i/1NOHOVPjLZsNsuklb3Cw2e/c5ac893b034e2bf9df235deacb04966f/adaptive-mfa-graphic-1)

By only prompting for second-factor authentication when confidence is low, users who access applications on a regular basis from the same device and location never have to be interrupted with a second-factor prompt.

Auth0 is pleased to announce that Adaptive MFA is available for all hosted customers as of December 15, with Private Cloud availability in the first quarter of 2021. 

### How it works

Traditional MFA prompts users to authenticate using first a primary factor, often a username/password, and then a secondary factor, such as a code sent via SMS or push notification. This ensures that the individual logging in using the primary credentials has possession of or access to the secondary factor as well.

Adaptive MFA assesses the confidence level of each login and, based on that level, decides whether to prompt the user for a secondary factor or not. The confidence level is assessed using:

* The reputation of the requesting IP address
* The frequency of requests from differing geolocations (impossible travel)
* Whether the device is known or not

Assessing these data points for every login attempt, Auth0 determines the confidence of a legitimate login attempt and then:

* Allows the primary authentication to succeed, or
* Challenges the user with an additional factor, or
* Prompts the user to enroll a secondary factor if they currently don’t have one, or 
* Denies the login and blocks the user account

![AMFA How to enable it](https://images.ctfassets.net/23aumh6u8s0i/34gC9R0va1Kd15JtBNdHUd/ec80c9b34f6232ee44410027d8e7aaf4/adaptive-mfa-graphic-3)

### What’s included

With Adaptive MFA, you will have access to a number of tools to help you define flexible policies and make the right tradeoff between security and user experience:

* An Adaptive MFA flow that triggers MFA only when a login attempt appears to be risky
* Risk assessments that can be used to build your own rules to trigger MFA
* Support for managing the feature programmatically via the Management API
* Rule templates to get you started in case you want to write your own custom business logic
* Tenant log metadata to help you understand the risk levels and impact on user experience

### How to enable it

Using Auth0’s updated Admin Dashboard, you can easily configure Adaptive MFA for applications by selecting the **Use Adaptive MFA** option in the **Security > Multi-factor Auth > Define policies** section.

![Use Adaptive MFA](https://images.ctfassets.net/23aumh6u8s0i/7CKjaRixRDYnypIFL2cTiA/85fd1e38bda162575c1fdd7016738526/use-adaptive-mfa)

### Supported configurations

Adaptive MFA can be enabled for all MFA-supported flows and applications where an email address is available. This is because an email address is required to keep the login flow safe in scenarios where the risk is high, and an end-user has no registered additional authenticators. Most connection types fit this category.  

Connection types where an email address is not available are not supported:

* Social connections, if the email claim is not requested
* Azure AD, if the identifier is a username and no email is available
* Passwordless connections, which do not use email

Adaptive MFA is supported in the most commonly used login configurations:

* New Universal Login
* Classic Universal Login (except for passwordless flow)
* Web or Native apps using the latest SDKs
* Flows hosted by a customer using cross-origin authentication

### Fine-tuned control with policies and rules

Auth0’s Adaptive MFA lets you define how to handle low-risk and high-risk login scenarios, including whether to prompt for an additional factor or prompt the user to enroll an additional factor if they don’t have one. In addition, Auth0 enables customization of those policies through the use of rules.

![Adaptive MFA rule](https://images.ctfassets.net/23aumh6u8s0i/3X31s04spm3rcZHMbsjkli/3d974e2b7075f5c5ffc3cf4c37fe4f89/adaptive-mfa-sep2)

#### Adaptive MFA rule templates

Auth0 provides two rule templates out of the box to enable your business to tailor Adaptive MFA behavior to support your needs. 

If you want to prompt users who haven’t enrolled a secondary factor to enroll one during their next login, you can use the **Require MFA Enrollment** rule template. 

```
function requireMfaEnrollment(user, context, callback) {

  const enrolledFactors = user.multifactor || [];
  if (enrolledFactors.length === 0) {
    // The user has not enrolled in any MFA factor yet, trigger an MFA enrollment
    context.multifactor = {
    provider: 'any'
    };
  }

  callback(null, user, context);
}
```

Let’s take a look at the **Adaptive MFA** rule template. The way this rule is written, Adaptive MFA will only be triggered when the confidence level for Impossible Travel is either `medium` or `low`. It provides an example of how you can selectively apply Adaptive MFA to particular assessors and confidence levels.

```
function adaptiveMfa(user, context, callback) {
  const riskAssessment = context.riskAssessment;

  // Example condition: prompt MFA only based on the ImpossibleTravel confidence level.
  let shouldPromptMfa;
  switch (riskAssessment.assessments.ImpossibleTravel.confidence) {
    case 'low':
    case 'medium':
      shouldPromptMfa = true;
      break;
    case 'high':
      shouldPromptMfa = false;
      break;
    case 'neutral':
      // When this assessor has no useful information about the confidence, do not prompt MFA.
      shouldPromptMfa = false;
      break;
  }
```

Then, the code checks if the user is enrolled in MFA using user multi-factor. If the user is enrolled in MFA, then throw the MFA challenge.

```
  // It only makes sense to prompt for MFA when the user has at least one enrolled MFA factor.
  const userEnrolledFactors = user.multifactor || [];
  const canPromptMfa = userEnrolledFactors.length > 0;

  if (shouldPromptMfa && canPromptMfa) {
    context.multifactor = {
      provider: 'any',
      // ensure that we will prompt MFA, even if the end-user has selected to remember the browser.
      allowRememberBrowser: false
    };
  }

  callback(null, user, context);
}
```

### Let’s get started

Ready to learn more about Adaptive MFA and how to enable it to secure your applications and protected resources? Adaptive MFA is available as part of Auth0’s new [Adaptive MFA Security Bundle](https://auth0.com/pricing/). We invite you to learn more by reading the [documentation](https://auth0.com/docs/mfa/adaptive-mfa) and [contact us](https://auth0.com/contact-us) if you have any questions.

Stay safe. And keep your protected resources safe too!


"mfa-adaptive"