Complete MFA and remove a method in the Console

Complete MFA at Console sign-in with a passcode or a recovery code, and remove an enrolled method.

Lerian Console completes the second verification step for users who have multi-factor authentication enabled. When the organization requires a method that a user has not enrolled, the Console sets it up at sign-in.

Account enrollment and method management are available under Settings › Security and through the Identity API.

Before you start

---

You need:

• an active user account with authenticator-app or email MFA enabled.
• access to the selected method or an unused recovery code.

Complete the second verification step

---

After the password or SSO step succeeds, the Console opens the MFA verification page.

1. Select a method

   Use the preferred method or select another enabled method.

2. Get the passcode

   For an authenticator app, open the app and read the current code. At sign-in, the Console sends the email code automatically.

3. Enter the passcode

   Enter the six-digit passcode and continue.

Set up a required method

---

A user who owes a required method sees the setup page during sign-in.

1. Select a method

   Select one of the methods that the Console offers.

2. Set up the method

   For an authenticator app, scan the QR code. For email, the Console sends a code to the saved email address.

3. Save the recovery code

   When the Console shows a recovery code, store it.

4. Confirm the method

   Enter the six-digit passcode. The Console then opens the verification page.

Use a recovery code

---

Select the recovery-code option when an enrolled method is unavailable. Enter one unused recovery code.

A recovery code works once. Store the remaining codes securely after sign-in.

Recover from a failed verification

---

Situation	Action
The passcode is invalid	Get the current passcode and try again before the submission limit is reached. The verification limit applies per user, not per sign-in session.
The email does not arrive	Wait for the resend cooldown, then request one new code.
The MFA session expires	Restart the complete sign-in flow, including the first factor.
No enrolled method is available	Use an unused recovery code. If none is available, contact an administrator and follow your organization’s account-recovery procedure.

Remove a method

---

In Settings › Security, open the MFA tab and select Remove next to the method.

To remove the authenticator app, enter its current code. To remove the email method, enter the code that the Console sends by email when the dialog opens.

Related pages

---

Multi-factor authentication

How MFA enrollment, verification, and recovery work.

Manage MFA via API

Enroll methods, select a preference, and manage recovery codes.

MFA deployment requirements

Configure Auth for MFA sign-in.