Your users can now set up and manage their MFA/2FA methods directly in the Desktop Client. That makes life simpler for them and saves time for admins.
For users, everything happens in the app they already use to connect. They pick a method, follow a few guided steps and connect, without a detour to the Defguard web app or a call to the help desk.
Paired with MFA/2FA flows, which let you allow several methods for the same authentication step, it gives users flexibility without compromising the security level you set.
For admins, it removes the follow-up work around every MFA/2FA change. When you turn on MFA/2FA for a WireGuard® location, or move it to a stronger factor, users who lack the required method can set it up from that location in their client, where the connect button normally is. Their instance stays enrolled throughout, so there is nothing to remove and set up again.
Configure MFA/2FA at the moment of connecting
When a location needs an MFA/2FA method the user has not set up, the location shows an option to configure it in place of the connect button. The same setup can be started from the client at any time, before a location asks for it, either from the client’s Add page or from the location’s MFA/2FA settings.
MFA/2FA methods users can add in the client
Two methods can be added this way. An authenticator app is set up by scanning a QR code and confirming a code from it. A FIDO2 security key is set up by inserting the key, naming it, entering its PIN and touching it, as described in Using a security key (FIDO2).
Admins decide which MFA/2FA methods count
Users can set up whichever methods they like, but only the factors you put into a location’s MFA/2FA flow let them connect to it. Defguard checks the submitted factor again when the connection starts and rejects any factor that is not part of the step. Leave email codes out of the production flow, and an email code never opens a tunnel there. With group-level overrides (Enterprise), you can narrow the choice further for specific groups, for example to FIDO2 keys only for contractors.
Confirming identity before a new method is added
Before a new method is added, the user proves who they are with a method they already have, and can choose which one. A user with no MFA/2FA method yet receives a verification code by email instead.
Recovery codes
On a first MFA/2FA setup, the client shows recovery codes for the user to download or copy. They are the way back in if the user loses access to their authenticator app, so they belong somewhere safe, such as a password manager.
Rolling out a stronger MFA/2FA requirement
In-client setup comes with the 2.2 Desktop Client. Update the clients first, then enforce MFA/2FA on the location or add a step to its MFA/2FA flow.
Documentation: Configuring MFA/2FA methods