df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing.<br/><br/> Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

IAM starts at the login box but impacts security, analytics, and user experience

Identity and Access Management (IAM) is the branch of IT concerned with verifying users' identity and controlling their access to digital resources. Or, as [Gartner defines it](https://www.gartner.com/en/information-technology/glossary/identity-and-access-management-iam): "IAM is the discipline that enables the right individuals to access the right resources at the right times for the right reasons."

<iframe width="560" height="315" src="https://www.youtube.com/embed/IKxigcbhsGk" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

## IAM Key Concepts: Authentication vs. Authorization

As the name indicates, IAM concerns both verifying users' identity (authentication) and granting them access to data based on that identity (authorization). These concepts are interrelated but not interchangeable, and understanding each is critical to grasp the larger meaning of IAM.

**Authentication refers to the methods you use to determine that someone is who they claim to be.** The classic authentication method is the username-password combination. However, using passwords alone for authentication is increasingly regarded as insecure since passwords are easy for hackers to guess or steal via [credential stuffing attacks](https://auth0.com/blog/what-is-credential-stuffing/).

Today's gold standard for verifying identity is [multi-factor authentication (MFA)](https://auth0.com/multifactor-authentication), which supplements passwords with authentication methods that are harder to fake, such as a biometric scan or a code sent to a user's personal device.

![MFA](https://images.ctfassets.net/23aumh6u8s0i/7ujWt3YR4Lc2D6MlbcibdZ/a5a02d1d95abd9014ab6d30d86dc5bb9/mfa-iam)

For a real-world metaphor, imagine going to a nightclub where you're on the list. The bouncer checks your ID to make sure you're really you (authentication). Then the bouncer lets you in and tells you that there's an asterisk next to your name, which means you're allowed into the VIP section (authorization).

**Authorization is the allocation or delegation of permissions to a particular individual or type of user.** For example, in the nightclub, a regular patron has access to the dance floor, a VIP is allowed behind the velvet ropes, but only the owner can get into the back office with the safe.

A modern IAM platform lets admins control authorization from a central user dashboard and via APIs, saving time and preventing security incidents. For instance, you could log into your IAM dashboard and grant a specific freelancer the ability to edit their own pieces. Likewise, if an administrator leaves the company, you can revoke access, so they don't walk away with valuable intellectual property.

![Dashboard](https://images.ctfassets.net/23aumh6u8s0i/7BQhEA3AimOi3dxgnAJv2h/2b4b1d707578bbb9f4fbf6e3160f610d/dashboard-iam)

## Types of IAM

Most organizations have multiple classes of users with different identity needs: their workforce, their business partners, and their customers. Even if you're using the same IAM platform for all three, you'll need to take a different approach for each.

### Workforce identity

The average business makes use of a wide variety of applications. Say you buy and provision to your employees (like Slack or WordPress) and some you build in-house. In either case, you need a [workforce IAM approach](https://auth0.com/b2e-identity-management-for-employees/) that integrates with all these disparate apps. As in our earlier example of the library, you use this to allocate permissions based on roles or individual identities.

### Customer Identity (CIAM)

[Customer identity and access management (CIAM)](https://auth0.com/b2c-customer-identity-management/) is its own branch of IAM and is used to control access to your external applications. You're most likely to use social logins here and generally focus on reducing friction (while still implementing appropriate security). [CIAM](https://auth0.com/blog/what-is-ciam/) is rapidly expanding as people log in on more devices, like smart TVs and wearables. 

A CIAM platform is concerned not just with the end user's login experience, but with gathering information about them into a data-rich identity profile. The greater your understanding of your users, the greater your ability to provide value for them. 

With this valuable data comes a huge responsibility: of obeying data privacy laws regarding data collection and storage, and sensitive data against breaches. Given that, a major (though often invisible) element of CIAM is controlling access to customer data by your own employees and third parties.

### B2B identity

IAM for enterprise customers might be the most specialized branch of identity management. It's also one of the most complex since large enterprises operate on different back-end technology stacks. 

Custom-made identity solutions often falter here and struggle to scale when onboarding multiple large customers. That's why startups often switch to third-party IAM platforms when they begin to move upmarket, so they can quickly federate identity using any provider and on any technology stack.

## IAM Tools

An old-fashioned approach to IAM might be as simple as a login box and some basic, role-based permissions. For instance, a public library with a digital card catalog just needs to let patrons log in and ensure they can't access functions reserved for the librarians.

But that limited understanding of IAM is ill-suited to a post-digitization world. These days, most organizations utilize a vast number of applications, and personal data can be both a valuable asset and a dangerous legal liability. If that same public library wants to let patrons log into all nearby branches with the same credentials, interface with local school software to connect students with books, and simultaneously protect those students' data, they'll need a much broader set of tools than a simple login box.

Today, most IAM platforms provide some combination of the following tools and features, albeit with varying levels of customizability and extensibility.

### Single Sign-On (SSO)

[SSO](https://auth0.com/docs/sso/current) is an IAM tool that enables a user to log into one of an organization's properties and automatically be logged into a designated set of other properties. For example, when you log into Google, you're automatically logged into your Gmail and YouTube accounts. For users, SSO reduces friction since they don't have to keep track of different credentials for every application. For organizations, SSO helps in collecting valuable insights about user behavior and preferences since it tracks them as they move from one application to another, connected by a single login.

### Federated Identity

While SSO lets users log into different properties or brands owned by a single organization, federated identity does the same thing across multiple organizations.

Most people are familiar with federated identity through [social login](https://auth0.com/learn/social-login/), in which you can use your Google, Facebook, or Apple ID to log into a wide range of apps. Federation is built on trust, so when you order from a food delivery app with your Apple ID, you're not ordering from Apple but indicating that the app trusts Apple enough to take their word that you are who you claim to be.

For [B2B federation](https://auth0.com/blog/why-auth0-b2b-federation-is-your-secret-weapon-for-enterprise/), there are a different set of enterprise connections, such as Active Directory, Azure, SAML, LDAP, and ADFS.

![B2B Federation](https://images.ctfassets.net/23aumh6u8s0i/6HTuHDmDrVhGoM64N5W5VT/fbf838da10673560329d5dfcd92070f3/why-federation-is-your-secret-weapon-for-enterprise_auth0-enterprise-connections)

B2B federation is often a challenge because different organizations use different technology stacks and enterprise connections. But a robust IAM solution such as Auth0 integrates across numerous providers, saving companies from having to code complex workarounds to make different back ends communicate with one another.

### Multi-factor authentication (MFA)

As we mentioned earlier, implementing MFA is crucial to protect your organization's data from malicious intrusions, and virtually every IAM platform offers some form of MFA. However, it's equally crucial to customize MFA with the appropriate level of security. IN B2C contexts, you need to consider UX and try not to create unnecessary friction for users who don't want to be subjected to heightened scrutiny every time they log in. For workforce IAM, you may want more stringent MFA, since the consequences of an unauthorized party gaining access to your private network can be so devastating.

A modern IAM solution will allow you to implement MFA only when it's needed. This can be accomplished through [step-up authentication or adaptive authentication](https://auth0.com/blog/what-is-step-up-authentication-when-to-use-it/) in which users only trigger MFA if they're trying to access sensitive data or their behavior is flagged as risky.

### Anomaly detection

In the past few years, identity has become the preferred gateway for hackers to break into systems. Brute force attacks, credential stuffing attacks, and even highly targeted phishing campaigns are all attempts by hackers to break in through a company's front door: the login box. 

These attacks [can be devastating](https://auth0.com/blog/11-of-the-worst-data-breaches-in-media/), leading to stolen data, legal fallout, and huge spikes in traffic that crash applications. A cutting-edge IAM solution is designed to get in front of those issues through anomaly detection.

There are multiple ways IAM systems can help detect and mitigate malicious attacks. IAM solutions detect attacks by monitoring signals such as the velocity of traffic, detection of login patterns that differ from a user's routine (such as location and browser), use of a breached password, or use of devices and IP addresses with a poor reputation.

In Auth0's case, we use two primary tools for anomaly detection: [brute-force protection and breached password detection](https://auth0.com/docs/anomaly-detection).

Brute-force protection stops users from logging in from the same IP address after a certain number of failed attempts, preventing botnet attacks from causing outages.

Breached password protection is designed to monitor data breaches in which credentials have been compromised and warn both companies and individuals. Auth0's breached password protection lets users customize how they respond to such an event. Customers can notify users when their passwords have been stolen, and if they choose, prevent users from logging in until they change passwords.

## The Benefits of Third-Party IAM

For users, the most visible element of IAM is the login box, but IAM's relationship to security and data management goes far beyond just usernames and passwords. Because of this, developers and IT teams are faced with a choice: build IAM functions in-house or outsource to third-party IAM platforms. 

While there are advantages to each approach, a sophisticated IAM platform links identity across applications, guards against data breaches, and is a valuable source of analytics. Think of it like the circulatory system for all of an organization's digital resources &mdash; just beneath the surface, interwoven through every application.

Many companies chose to build their IAM solution in-house in years past, but these days, more and more are outsourcing their identity and access management needs to third parties. A [2020 Auth0 survey](https://auth0.com/resources/whitepapers/state-app-assembly-2020) of IT professionals found that 58% currently outsource authentication when building applications. This trend has given rise to a new subset of Software as a Service (SaaS), known as [Identity as a Service (IDaaS)](https://auth0.com/blog/what-is-idaas/).

The reasons organizations increasingly choose to buy an IAM platform, rather than attempt to build it, are complex and vary depending on a company's size and needs.

### Cost and time savings

Building and maintaining an in-house identity solution is a challenge for companies of any size and particularly for startups with limited resources. Auth0 customers frequently report that custom IAM solutions can quickly become full-time jobs for multiple developers, representing a fundamental distraction from their core business proposition.

### Adaptability and extensibility

Large enterprises often transition to an external IAM provider because their in-house solution is riddled with legacy code and doesn't integrate with a wide range of applications. In-house solutions are static and closed to outsiders, and repairing one may be more of a headache than it's worth. Instead, enterprises may find more value outsourcing to a platform designed to interface with other systems and add new capabilities.

This confers major business advantages. For instance, an extensible IAM solution is crucial in [post-merger integration](https://auth0.com/resources/whitepapers/Managing-Identitity-10-steps-PMI), helping migrate user identities from multiple sources into a single directory.

### Security and legal compliance

In the past few years, personal data has become a hot-button issue, with numerous high-profile data breaches and the passage of data privacy regulations around the world. Laws like [GDPR and CCPA](https://auth0.com/resources/whitepapers/GDPR-vs-CCPA) demand that businesses exercise greater control over who can access their user data and also require businesses to share that data with users upon request.

There are high costs for failing to comply with data privacy laws, and as more laws are passed, adjusting an IAM solution for each one can easily be costly. Proprietary systems often have hidden vulnerabilities and may not conform to an industry's security best practices. Outsourcing to a trusted third-party IAM platform can offload some of the burdens of compliance and ensure that security measures evolve in keeping with current best practices.

## IAM: Central to Your Business, Crucial to Your Future

As you've seen, IAM is an umbrella term that encompasses multiple tools, functions, and even philosophies about how organizations manage access and identity within their systems. Many executives who aren't used to devoting much thought to IAM are surprised to learn how closely it's tied to security, user experience, and business outcomes. However, even as IAM evolves to be more important and complex, the technology for managing it is evolving to be more comprehensive and intuitive. 

If you're interested in learning more about how Auth0's IAM platform can serve your identity needs, please [reach out to our dedicated team](https://auth0.com/en/contact-us).

<include src="asides/AboutAuth0" />


What is IAM?

5e074956ee8ba1fea26e30d28c190495?s=300 avatar

5e074956ee8ba1fea26e30d28c190495?s=300

Full stack developer creating content at Auth0. I love taking a deep dive into hard-to-understand concepts and creating content that makes them easier to grasp. In my free time you can usually find me reading, hanging out with my dogs, or curling in the squat rack.

Former Developer Content Manager

Holly Guevara

Learn what multi-factor authentication is and different methods for implementing MFA.


Before you can learn about multi-factor authentication, you must understand authentication itself. Authentication, simply put, is the process of **verifying that someone is who they say they are**.

When you want to sign in to your account on a website, the website must first make sure you're the owner of that account. How do they do that? They ask you for something that only you should know. Typically, this is the **username and password** that you set up when you created the account. Great! You were the one who set it up, so there's no way anyone else could have your password, right?

It turns out that someone providing the correct username and password to access a resource doesn't necessarily prove that they are who they say they are. User credential breaches have become much more prevalent in recent years, so there's a good chance that some of your username and password combinations have been involved in a breach. This means that relying only on a username and password to identify someone isn't a great practice.

This is where multi-factor authentication comes into play.

## What is Multi-factor Authentication

Multi-factor authentication (MFA) provides a method to verify a user's identity by requiring them to provide **more than one piece of identifying information**.

You have most likely encountered multi-factor authentication on some of your favorite websites already. For example, when you sign in to your banking account, you may get a screen requesting that you enter the code that was emailed to you. Once you enter this code, you're then able to access your bank account. This is an example of MFA in action!

Providing a username and password coupled with a code sent to your email is one form of MFA, but there are several other options you have for implementing MFA. Let's look at some of those now.

## Types of Multi-factor Authentication

The category that you use to identify a user is called an **authentication factor**. In general, these identification methods fall into three authentication factor categories:

**Something you know** &mdash; Something you know, such as a password, PIN, personal information like mother's maiden name, etc.

**Something you have** &mdash; A physical item you have, such as a cell phone or a card.

**Something you are** &mdash; Biometric data, such as fingerprint, retina scan, etc.

To implement multi-factor authentication, you need to cover at least two of these categories.

A common scenario would be requiring a user to sign in with their username and password. This covers the "**something you know**" category. After providing their username and password, they'd receive a text to their cell phone with a short code called a one-time password (OTP). This covers the "**something you have**" category. They'll be required to type this code into the website, and if correct, then they'll be authenticated.

<AmpContent>
![One-time password screen](https://images.ctfassets.net/23aumh6u8s0i/5RoVY86v6SZ5OAVtZzRm6B/1ee99b6f7547ece9c5fc3e7ab2563360/one-time-password)

</AmpContent>

<NonAmpContent>
<p>
<img class="img-responsive" src="https://images.ctfassets.net/23aumh6u8s0i/5RoVY86v6SZ5OAVtZzRm6B/1ee99b6f7547ece9c5fc3e7ab2563360/one-time-password" alt="one-time password screen" style="width:50%"/>
</p>
</NonAmpContent>

In this scenario, even if an attacker knows the user's password, *it isn't enough*. They'll have to also gain access to the user's phone to provide the one-time password.

### One-time passwords

In the scenario above, the application sent the user a code known as a **one-time password (OTP)**. This is one of the most commonly used forms of multi-factor authentication. Let's take a closer look at what one-time passwords are.

A one-time password, like its name indicates, is a pseudo-randomly generated password that expires after a short time period and is only valid for one login. They are typically paired with a traditional username and password to make the authentication process more secure. Even if a user has a weak or reused password, the one-time password that is sent to them is a way to indirectly strengthen their credentials.

There are a few different ways to send one-time passwords to users.

#### SMS

SMS is one of the most user-friendly ways to send one-time passwords. The user signs in to your application with their username and password, and then they receive a text message to their cell phone with their OTP. They're able to easily copy the code from the text message and send it back to the application.

While this may be simple for the user, and it's better than not having MFA at all, it's still [not the best way](https://auth0.com/blog/dont-pass-on-the-new-nist-password-guidelines/#The-SMS-Controversy) to send or receive one-time passwords.

Believe it or not, delivering an OTP through SMS carries the risk of compromise. Here are some of the ways that an attacker can gain access to your OTP through SMS:

- **Social Engineering** &mdash; An attacker that has breached a user's username and password may also have access to their phone number. Attackers have been known to obtain SMS-delivered one-time passwords by sending a text to the user telling them that they used to have the same phone number as them, and they are locked out of one of their accounts because they forgot to update the phone number listed on the account. They politely ask for the code that was just sent to the user's cell phone, so they can get back into their account. Many people want to help the person on the other end, so they text them the code without thinking much of it.

- **SIM Swap** &mdash; [SIM swapping](https://www.consumer.ftc.gov/blog/2019/10/sim-swap-scams-how-protect-yourself) (also known as simjacking) is when an attacker gains access to your cell phone number. One interesting (and terrifying) way this can happen is by an attacker calling your cell phone provider and convincing them that they lost their phone and need a new SIM card activated. The SIM card that gets activated is one that the attacker owns. If the cell phone provider obliges, then the attacker now has access to any text messages, phone calls, etc. that come through. So, if they already have your username and password, all they have to do is type in the OTP that is texted to your phone number (which they now have access to), and they're in! This [Hacking Challenge at Defcon video](https://www.youtube.com/watch?v=fHhNWAKw0bY) has an excellent demonstration of this in action.

#### Email

Another option for receiving OTPs is through email. While this does provide another step to access your account, which is great, it still has some downfalls:

- Because [password reuse is so prevalent](https://www.zdnet.com/article/44-million-microsoft-users-reused-passwords-in-the-first-three-months-of-2019/), there's a chance that a user's email password is the same as the account that's requesting the OTP. Assuming the attacker already has this password, then the extra step of the OTP is useless.

- One of the requirements for MFA is that the implemented factors come from at least two of the MFA categories: something you know, something you have, and something you are. The username and password fulfill **something you know**, and OTP is meant to fulfill **something you have**. Ideally, something you have would be a physical item, such as your cell phone. Having access to an email account doesn't necessarily mean that the cell phone is in your possession, as you could access your email from any device. 

#### Authenticator apps

Another common way to manage OTPs is with authenticator apps. Once you install the app up on your cell phone, you can set up any accounts that work with the authenticator app to send your one-time passwords to that app. The OTPs will typically regenerate every 30 seconds, so instead of waiting for an email or a text message, you simply open up the app, and you'll always find a valid OTP there.

There are a lot of authenticator app options. Some of the most popular ones are [Duo](https://duo.com/), [Authy](https://authy.com/), and [Google Authenticator](https://support.google.com/accounts/answer/1066447).

An authenticator app is an excellent choice for receiving one-time passwords. Unlike SMS, an attacker can't access your authenticator app simply by having access to your text messages or phone number. Your one-time passwords also can't be stolen if someone gains access to your email account.

There are, however, still downsides to authenticator apps. Some users may find it too much of a hassle to download a new app and set up all of their accounts on it to receive one-time passwords, especially when it's so much easier to just enter their phone number instead.

Another issue is that if you lose your cell phone, accessing those accounts that have MFA enabled can quickly become a nightmare. Most popular authenticator apps now have [safeguards, such as key backups, built-in](https://authy.com/blog/how-the-authy-two-factor-backups-work/). To enable backups, you have to create a strong password that's used to encrypt your OTPs. Then, if you ever lose your phone, you can install the authenticator app on your new phone and type in your password to decrypt your keys.

## Step-up Authentication

You may have noticed a common theme amongst the downsides to some of the OTP options: **user experience**.

One of the biggest obstacles to mass adoption of MFA is the slight hit that user experience takes. Generally, the more steps you require to sign in to your application, the fewer people will want to use it.

To manage the balance between user experience and security, some people find it best not to require MFA on every login, but instead, require it when accessing more sensitive data.

> With [step-up authentication](https://auth0.com/docs/mfa/concepts/step-up-authentication), applications that allow access to different types of resources can require users to authenticate with a stronger authentication mechanism to access sensitive resources.

For example, say you have an application that requires users to sign in with their email and password to access customer data. However, when a user wants to see employee data, an **extra authentication factor** is required.

![Auth0 step-up authentication](https://images.ctfassets.net/23aumh6u8s0i/7AkLMOctLnHeZk8BFrw3fz/7aa520a8fa86e9f485d809c0aec4f0d2/step-up-authentication-flow)

Step-up authentication is an excellent option to bridge the gap between user experience and security.

## Implementing Multi-factor Authentication with Auth0

Now that you've seen why multi-factor authentication is important, you're probably wondering *how* you can implement it into your own apps. Let's go through how you can get MFA up and running in just minutes using [Auth0](https://auth0.com).

To start, <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for a free Auth0 account</a>. Once you go through setup, leave the tab open, as you'll be returning to it soon.

Next, you're going to clone this [sample React application](https://github.com/auth0-blog/auth0-react-sample) that has already been set up to use Auth0 for authentication.

> If you'd like to know more about how this application was built, check out [The Complete Guide to React User Authentication](https://auth0.com/blog/complete-guide-to-react-user-authentication/).

In your terminal, run the following:

```bash
git clone git@github.com:auth0-blog/auth0-react-sample.git
cd auth0-react-sample
npm install
```

Next, create the `.env` file in your `auth0-react-sample` root directory:

```bash
touch .env
```

This is where you'll store your Auth0 variables so that you can connect your React application to Auth0. Paste the following into `.env`:

```
REACT_APP_AUTH0_DOMAIN=
REACT_APP_AUTH0_CLIENT_ID=
```

Back in the [Auth0 dashboard](https://manage.auth0.com/dashboard/), click on "**Applications**" and then on the "**Create Application**" button.

Name your application anything you'd like, click on "Single Page Web Applications", and then click "Create".

![Auth0 new application](https://images.ctfassets.net/23aumh6u8s0i/4qVyZ0Mpj5B9GhqeZuSc3Y/4aeab2a7cfaf7ebddf030ba9da13106f/new-auth0-application)

Click on the "**Settings**" tab. Paste the development URL for your React application (`http://localhost:4040`) into the text area under "Allowed Callback URLs", "Allowed Logout URLs", and "Allowed Web Origins".

**Allowed Callback URLs**: `http://localhost:4040`

**Allowed Logout URLs**: `http://localhost:4040`

**Allowed Web Origins**: `http://localhost:4040`

❗ Make sure you scroll down to the bottom and click "Save changes".

Next, you'll need to paste some of these values from the Settings page into your React application's `.env` file so that the Auth0 authentication server recognizes your React application.

Back in your code editor, open your `.env` file. Set `REACT_APP_AUTH0_DOMAIN` to the value for "Domain" from the Auth0 Settings page and `REACT_APP_AUTH0_CLIENT_ID` to the value of "Client ID". 

```
REACT_APP_AUTH0_DOMAIN=your-domain.auth0.com
REACT_APP_AUTH0_CLIENT_ID=yourclientidstring
```

Save this and then start your React application by running the following in your terminal:

```bash
npm start
```

Head to [`http://localhost:4040/`](http://localhost:4040/) in your browser to see your application live.

To test it out, click on the "Log In" button. You'll be redirected to the Auth0 Universal Login page (https://your-domain.auth0.com/login), where you can sign up as a new user. 

![Auth0 signup/login page](https://images.ctfassets.net/23aumh6u8s0i/6ToiqA66XF0UEs1OhYZ2Dw/66e51832bd2c5976b128ecf072927494/auth0-login-screen)

And just like that, you've successfully set up authentication on your demo React application! However, as you know from learning about MFA, this username and password approach leaves a little to be desired. Let's see how you can step up your application's security a notch by turning on multi-factor authentication.

### Enabling MFA with Auth0

Head back to the Auth0 dashboard and click on [**Multifactor Auth**](https://manage.auth0.com/dashboard/#/mfa) in the sidebar.

![Auth0 MFA](https://images.ctfassets.net/23aumh6u8s0i/7wWKd6DIOFnWafex1Iu4rT/c3df03c639a32e4679390c5b1223a7d5/mfa-dashboard.png)

There are a few options here that you can choose. To quickly see MFA in action, select "Phone Message". Scroll down a little and select "Always" from the "Require Multi-factor Auth
" dropdown, and then press "Save".

![Auth0 MFA phone number](https://images.ctfassets.net/23aumh6u8s0i/2jbVMojYAIwwnldyQBMCIY/07413d4028ea0afa75caf81f4f151969/auth0-mfa-phone-number)

Head back to your React application, sign out, and then sign back in. After entering your email and password, you'll be prompted to enter your phone number. Once you do, you'll be asked to enter the 6-digit code that was texted to you.

![Auth0 MFA text OTP](https://images.ctfassets.net/23aumh6u8s0i/4TisUePt1RFWO7GCoxiqnN/208fb3f7ab33d6be9120c862e862952c/auth0-mfa-text-otp)

![Auth0 MFA text OTP code](https://images.ctfassets.net/23aumh6u8s0i/7lCkR3RkB3XqjpIDsEk7F0/283bd91de9a1b338493df8d0361c4137/sms-otp)

Type in the code that you received to your cell phone, and then click "Continue". You'll then be asked to copy a recovery code. This is one of the safeguards that we covered back in the Authenticator Apps section that will allow you to recover your account if you ever lose your phone.

![Auth0 MFA recovery code](https://images.ctfassets.net/23aumh6u8s0i/1fK66CyrkCPmjghImTP4Hb/0e6390f24f78f7758cb8bc40b4130bbe/auth0-mfa-recovery)

Once you've copied it and pressed "Continue", you'll be redirected back to the React application, and you're now signed in!

🎉 **You just enabled MFA on your application in a matter of minutes!**

Auth0 offers several different options for MFA. This demo showed how to set up an SMS one-time password for the sake of simplicity, but if you'd prefer an even better option, you can choose from some of the authenticator apps that are offered. Feel free to experiment in the dashboard and see what works best for you!

## Wrap Up

If you need any more convincing about the need for multi-factor authentication, have a look at the popular website [haveibeenpwned.com](https://haveibeenpwned.com/). The website collects data on password breaches. You can type in your email address to see if it has been involved in any publicly known data breaches. As of writing this, there are **over 10 billion accounts** listed. So, even if you have a strong password, you're trusting the websites you use to keep that password safe, which unfortunately doesn't always happen.

While it's on your mind, take this time to go review your important accounts to make sure you have MFA enabled. Nobody wants to deal with the fallout of canceling their credit cards, dealing with stolen funds, and resetting all of their passwords because their bank account was breached due to weak credentials. Make sure you're always on the offensive by securing your accounts as much as possible! And if you run a website, take care of your users by giving them the means to secure their accounts on your application.

Be sure to reach out in the comments below or [find me on Twitter](https://twitter.com/hollylawly) if you have any questions. Thanks for reading!

"security-access"