## MFA per application

When you manage multiple applications in the same environment, you can configure MFA separately for each application. MFA enforcement, remember-device settings, and available MFA methods can differ between apps while sharing the same environment and accounts.

By default, your current MFA configuration applies to all applications. Configure MFA per application only when a specific application requires different settings.

### What you can configure

| Setting | Vendor | Account |
|  --- | --- | --- |
| MFA enforcement (Don't force, Force, Force except enterprise SSO) | Yes | Yes |
| Remember MFA on trusted devices and device expiration | Yes | Yes |
| MFA methods (Authenticator apps, SMS, Email, WebAuthn) | Yes | No |
| Custom authenticator app name | Yes | No |


**MFA enforcement and remember-device** can be set at both vendor and account level for each application.

**MFA methods, custom authenticator app name** are vendor-only.

Account admins can enforce stricter MFA policies or adjust remember-device settings in the [Frontegg portal](/ciam/guides/security-center/mfa/management#setting-mfa-policy-for-specific-accounts) or [self-service portal](/ciam/guides/security-center/mfa/self-service) when the Security tab is enabled.

### How defaults work

Your current MFA configuration applies to all applications. Configure MFA per application only when a specific application needs different settings — enforcement, remember-device, MFA methods, or authenticator app name.

When you save per-application MFA settings, those settings apply only to that application.

### Configure MFA per application

MFA per application is configured on the **Multi-factor authentication** page under [ENVIRONMENT] → Configurations → Security → MFA — not from the Applications menu.

1. Open the **Frontegg portal**.
2. Navigate to [ENVIRONMENT] → Configurations → Security → MFA.


When you manage multiple applications, the page includes two tabs:

#### App overview tab

The **App overview** tab lists all applications and their effective MFA configuration, including Force MFA status, active factors, and authenticator name.

To edit an application, click **Manage** on the relevant row.

![MFA configuration per application — App overview tab](/assets/mfa-per-application-app-overview.50e5600880655622b034e19aac120b07f3b0cf56a5c732209b45808fd2abb8bc.ee8d0119.png)

#### Configuration tab

The **Configuration** tab lets you configure MFA for a specific application:

1. Select the application from the **Application** dropdown.
2. Set Force MFA options, remember-device settings, and MFA methods as needed.
3. Click **Save**.


![MFA configuration per application — Configuration tab](/assets/mfa-per-application-configuration.20b21deedd9452b3e9234cf290b10fd5a0e7a4639b86af89fc94076d585d04d1.ee8d0119.png)

See [Selecting MFA methods](/ciam/guides/security-center/mfa/management#selecting-mfa-methods) for details on each MFA method.

See [MFA management](/ciam/guides/security-center/mfa/management) for additional configuration options.

#### MFA enforcement and remember-device (account)

Account-level MFA settings apply to the **selected application**. The same account can have different MFA requirements on different applications.

1. Open the **Frontegg portal**.
2. Navigate to [ENVIRONMENT] → Management → Accounts.
3. Select the account and open the **Security Policy** tab.
4. Select the application from the **Application** dropdown if the account has multiple applications assigned. With a single application, this step is not required.
5. Set the MFA policy and remember-device settings, then click **Save**.


Repeat steps 4–5 for each application that needs different account-level MFA settings.

For portal steps and screenshots, see [Setting MFA policy for specific accounts](/ciam/guides/security-center/mfa/management#setting-mfa-policy-for-specific-accounts).

Account admins can also configure MFA from the [self-service portal](/ciam/guides/security-center/mfa/self-service) when the Security tab is enabled.

User MFA enrollment
Per-application MFA covers **policy** (enforcement, methods, remember-device). A user's own MFA enrollment is tied to the user and applies across all applications they are assigned to. Users manage this from the personal space under [Implement MFA verification](/ciam/guides/admin-portal/personal-modules#implement-mfa-verification).

### Remember trusted devices

When users choose to remember a device after MFA, that trust applies **only to the application they signed into**. Remembering a device in one application does not skip MFA when the same user signs into a different application.

Device expiration follows the remember-device policy for the relevant application and account.

### Multi-account behavior

If a user belongs to multiple accounts, Frontegg applies the **strictest MFA rule per user within the same application**. For example, if one account forces MFA and another does not, the user must complete MFA when signing into that application.

Different applications can enforce different MFA requirements for the same user.

Multi-account approach to MFA
If a user belongs to multiple accounts and only one enforces MFA, the user will be required to use MFA when signing into the application where that account's policy applies. See [MFA management](/ciam/guides/security-center/mfa/management#multi-factor-authentication-mfa-management) for more details.

### Application deletion

When you delete an application, its per-application MFA configuration is removed. Other applications continue to use your current configuration or their own per-application settings.

### SDK integration

For embedded login with multiple applications, pass the correct `appId` in your SDK `contextOptions`. MFA settings resolve based on the application the user is authenticating into. See [Getting started with multi-apps](/ciam/guides/management/multi-apps/overview#app-integration-tab) for integration details.