{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-ciam/sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["LightboxImage","Notification"]},"type":"markdown"},"seo":{"title":"MFA per application","siteUrl":"https://developers.frontegg.com/","llmstxt":{"title":"Frontegg Developer Documentation","description":"Authentication, authorization, and user management for Customer Identity, plus Agen for SaaS and Agen for Work. Guides, SDKs, and API references.","sections":[{"title":"Customer Identity (CIAM)","description":"Auth, SSO, SCIM, entitlements, and user management — guides, SDKs, and APIs.","includeFiles":["ciam/**/*.md"],"excludeFiles":[]},{"title":"Agen for SaaS","description":"Agentic access and authorization for SaaS products.","includeFiles":["agen-for-saas/**/*.md"],"excludeFiles":[]},{"title":"Agen for Work","description":"Agentic access and authorization for internal and workforce use.","includeFiles":["agen-for-work/**/*.md"],"excludeFiles":[]},{"title":"Platform","description":"Shared platform overview.","includeFiles":["platform/**/*.md"],"excludeFiles":[]}],"excludeFiles":["internal-docs/**","ciam/guides/env-settings/inject-client-ip.md","CLAUDE.md",".claude/**","**/images/**"],"hide":false}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"mfa-per-application","__idx":0},"children":["MFA per application"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["When you manage multiple applications in the same environment, you can configure MFA separately for each application. MFA enforcement, remember-device settings, and available MFA methods can differ between apps while sharing the same environment and accounts."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["By default, your current MFA configuration applies to all applications. Configure MFA per application only when a specific application requires different settings."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"what-you-can-configure","__idx":1},"children":["What you can configure"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Setting"},"children":["Setting"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Vendor"},"children":["Vendor"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Account"},"children":["Account"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["MFA enforcement (Don't force, Force, Force except enterprise SSO)"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Yes"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Yes"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Remember MFA on trusted devices and device expiration"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Yes"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Yes"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["MFA methods (Authenticator apps, SMS, Email, WebAuthn)"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Yes"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["No"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Custom authenticator app name"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Yes"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["No"]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["MFA enforcement and remember-device"]}," can be set at both vendor and account level for each application."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["MFA methods, custom authenticator app name"]}," are vendor-only."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Account admins can enforce stricter MFA policies or adjust remember-device settings in the ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"/ciam/guides/security-center/mfa/management#setting-mfa-policy-for-specific-accounts"},"children":["Frontegg portal"]}," or ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"/ciam/guides/security-center/mfa/self-service"},"children":["self-service portal"]}," when the Security tab is enabled."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"how-defaults-work","__idx":2},"children":["How defaults work"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Your current MFA configuration applies to all applications. Configure MFA per application only when a specific application needs different settings — enforcement, remember-device, MFA methods, or authenticator app name."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["When you save per-application MFA settings, those settings apply only to that application."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"configure-mfa-per-application","__idx":3},"children":["Configure MFA per application"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["MFA per application is configured on the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Multi-factor authentication"]}," page under [ENVIRONMENT] → Configurations → Security → MFA — not from the Applications menu."]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Open the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Frontegg portal"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Navigate to [ENVIRONMENT] → Configurations → Security → MFA."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["When you manage multiple applications, the page includes two tabs:"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":4,"id":"app-overview-tab","__idx":4},"children":["App overview tab"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["App overview"]}," tab lists all applications and their effective MFA configuration, including Force MFA status, active factors, and authenticator name."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["To edit an application, click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Manage"]}," on the relevant row."]},{"$$mdtype":"Tag","name":"LightboxImage","attributes":{"isLightbox":true},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"img","attributes":{"src":"/assets/mfa-per-application-app-overview.50e5600880655622b034e19aac120b07f3b0cf56a5c732209b45808fd2abb8bc.ee8d0119.png","alt":"MFA configuration per application — App overview tab"},"children":[]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":4,"id":"configuration-tab","__idx":5},"children":["Configuration tab"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Configuration"]}," tab lets you configure MFA for a specific application:"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Select the application from the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Application"]}," dropdown."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Set Force MFA options, remember-device settings, and MFA methods as needed."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Save"]},"."]}]},{"$$mdtype":"Tag","name":"LightboxImage","attributes":{"isLightbox":true},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"img","attributes":{"src":"/assets/mfa-per-application-configuration.20b21deedd9452b3e9234cf290b10fd5a0e7a4639b86af89fc94076d585d04d1.ee8d0119.png","alt":"MFA configuration per application — Configuration tab"},"children":[]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["See ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"/ciam/guides/security-center/mfa/management#selecting-mfa-methods"},"children":["Selecting MFA methods"]}," for details on each MFA method."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["See ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"/ciam/guides/security-center/mfa/management"},"children":["MFA management"]}," for additional configuration options."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":4,"id":"mfa-enforcement-and-remember-device-account","__idx":6},"children":["MFA enforcement and remember-device (account)"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Account-level MFA settings apply to the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["selected application"]},". The same account can have different MFA requirements on different applications."]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Open the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Frontegg portal"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Navigate to [ENVIRONMENT] → Management → Accounts."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Select the account and open the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Security Policy"]}," tab."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Select the application from the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Application"]}," dropdown if the account has multiple applications assigned. With a single application, this step is not required."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Set the MFA policy and remember-device settings, then click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Save"]},"."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Repeat steps 4–5 for each application that needs different account-level MFA settings."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For portal steps and screenshots, see ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"/ciam/guides/security-center/mfa/management#setting-mfa-policy-for-specific-accounts"},"children":["Setting MFA policy for specific accounts"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Account admins can also configure MFA from the ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"/ciam/guides/security-center/mfa/self-service"},"children":["self-service portal"]}," when the Security tab is enabled."]},{"$$mdtype":"Tag","name":"Notification","attributes":{"title":"User MFA enrollment","type":"info"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Per-application MFA covers ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["policy"]}," (enforcement, methods, remember-device). A user's own MFA enrollment is tied to the user and applies across all applications they are assigned to. Users manage this from the personal space under ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"/ciam/guides/admin-portal/personal-modules#implement-mfa-verification"},"children":["Implement MFA verification"]},"."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"remember-trusted-devices","__idx":7},"children":["Remember trusted devices"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["When users choose to remember a device after MFA, that trust applies ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["only to the application they signed into"]},". Remembering a device in one application does not skip MFA when the same user signs into a different application."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Device expiration follows the remember-device policy for the relevant application and account."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"multi-account-behavior","__idx":8},"children":["Multi-account behavior"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If a user belongs to multiple accounts, Frontegg applies the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["strictest MFA rule per user within the same application"]},". For example, if one account forces MFA and another does not, the user must complete MFA when signing into that application."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Different applications can enforce different MFA requirements for the same user."]},{"$$mdtype":"Tag","name":"Notification","attributes":{"title":"Multi-account approach to MFA","type":"info"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If a user belongs to multiple accounts and only one enforces MFA, the user will be required to use MFA when signing into the application where that account's policy applies. See ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"/ciam/guides/security-center/mfa/management#multi-factor-authentication-mfa-management"},"children":["MFA management"]}," for more details."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"application-deletion","__idx":9},"children":["Application deletion"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["When you delete an application, its per-application MFA configuration is removed. Other applications continue to use your current configuration or their own per-application settings."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"sdk-integration","__idx":10},"children":["SDK integration"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For embedded login with multiple applications, pass the correct ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["appId"]}," in your SDK ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["contextOptions"]},". MFA settings resolve based on the application the user is authenticating into. See ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"/ciam/guides/management/multi-apps/overview#app-integration-tab"},"children":["Getting started with multi-apps"]}," for integration details."]}]},"headings":[{"value":"MFA per application","id":"mfa-per-application","depth":2},{"value":"What you can configure","id":"what-you-can-configure","depth":3},{"value":"How defaults work","id":"how-defaults-work","depth":3},{"value":"Configure MFA per application","id":"configure-mfa-per-application","depth":3},{"value":"App overview tab","id":"app-overview-tab","depth":4},{"value":"Configuration tab","id":"configuration-tab","depth":4},{"value":"MFA enforcement and remember-device (account)","id":"mfa-enforcement-and-remember-device-account","depth":4},{"value":"Remember trusted devices","id":"remember-trusted-devices","depth":3},{"value":"Multi-account behavior","id":"multi-account-behavior","depth":3},{"value":"Application deletion","id":"application-deletion","depth":3},{"value":"SDK integration","id":"sdk-integration","depth":3}],"frontmatter":{"seo":{"title":"MFA per application"}},"lastModified":"2026-07-26T10:30:11.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/ciam/guides/security-center/mfa/per-application","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}