Authenticating with Push MFA
When a policy requires MFA, AuthNull sends a push to the user's phone before the sign-in completes. The user approves or denies it in the app of the organization's MFA provider:
| MFA provider | Where the user approves |
|---|---|
 Duo Security | Duo Mobile, from your Duo organization |
 Okta Verify | Okta Verify, from your Okta organization |
The AuthNull Authenticator app is coming soon.
Where Push MFA Applies
A push is sent when the matching policy's action requires MFA:
| Product | When the push is sent |
|---|---|
| Identity | Windows and Active Directory sign-ins seen by the DC Sensor |
| RADIUS | VPN and network device logins, before the login completes |
| Database | Database sessions - the session opens only after the push is approved |
| PAM | SSH sessions through a gateway |
| AuthNull console | Sign-in to the console, if the user chooses push as their second factor |
Signing In
- Sign in to the resource as usual - for example log on to a domain-joined machine, connect to the VPN, or open a database session.
- A push arrives in Duo Mobile or Okta Verify on your phone.
- Check that the request matches what you are doing, then approve it. Deny any request you did not start.
- The sign-in completes once the request is approved.
warning
Requests are time limited. If you do not respond in time, the request expires and you need to sign in again.
Not Receiving Pushes?
- Check that the user is enrolled in Duo Mobile or Okta Verify in your Duo or Okta organization.
- Check that the user's email address in AuthNull matches their Duo or Okta account.
- Check the sign-in matched a policy that requires MFA - see the product's Logs (Access Logs in PAM).
- See Troubleshooting.