Question
Merative
US
Last activity: 17 Aug 2025 23:30 EDT
Pega MFA using Authenticator
We need to setup MFA in Pega default login using Authenticator option apart from OTP through SMS/Email. Is there any option available out of box to do that? If we need to go with customization, please let us know if anyone has done this in your application.
Updated: 19 Jul 2025 19:05 EDT
Tech Mahindra
IN
@SathishKumarJ17003558 please check the below post.
Merative
US
@BirupakhyaThis post talks about MFA through OTP using SMS/Email. We already have that enabled. I am trying to understand about using Authenticator app tokens for MFA in Pega.
HCA Healthcare
US
Pega only ships MFA with OTP over email/SMS; there’s no out-of-the-box “Authenticator app/TOTP” for the default login. You can enable Pega’s built-in MFA on supported Authentication Service types (Basic, SAML, OIDC), but it’s still OTP, not TOTP. If you want an authenticator app, the clean path is to front Pega with your IdP (Microsoft Entra, Okta, Duo) via OIDC/SAML and enforce MFA there; Pega then trusts the IdP session. If you stick with Pega login, you’d need a custom auth service that handles TOTP: store a per-user shared secret, show a QR for enrollment, and verify RFC-6238 codes during login, plus backup codes and lockout on failures. Also, don’t use the raw /prweb servlet; point users at your Authentication Service URL so MFA applies consistently. For references: Pega’s docs cover OTP MFA and show OIDC/SAML setup, community posts confirm no native TOTP and list which auth types expose the Security Policies tab. In practice, most teams choose IdP-enforced MFA for less custom code and better device management. Relevant links: Pega OTP MFA guidance, OIDC/SAML setup, and community notes that TOTP requires custom work.