Notes

This screen answersUS-10

Acceptance criteria

As a portal user, I want to log in using Microsoft Authenticator or email OTP, so my account is protected beyond a password.

Given a user has Multi-Factor Authenticator enrolled via Microsoft Entra, when they log in with correct credentials, then they are prompted for Authenticator approval or email OTP before access is granted.
Given a user fails MFA 5 times, when the 5th attempt fails, then the account is temporarily locked per security policy. Auto-unlock after 15 min.
After auto-unlock and another 3 failed attempts within 24 hours, account is temporarily locked for admin to unlock. (full admin-unlock go to US-54).
Given MFA is enabled, when an existing user without enrollment logs in, then they are forced through enrollment before proceeding.

Wireframe state

DefaultWrong codeLast code

Use a recovery code

Enter one of the 10 codes you saved when you set up two-step sign in.

Code not accepted. Check the code and try again. Each recovery code works once, and you have 3 tries left.

This is your last code. You have 1 recovery code left. After you use it, set up two-step sign in again to get new codes.

Recovery code

Letters and numbers, with a dash in the middle.