Configure MFA for the User Portal

You can specify what authentication mechanisms your users must provide to access CyberArk Identity, as well as if and when multi-factor authentication is required. For example, you can specify that users logging in from a certain country provide additional authentication.

To define MFA for User Portal access

Step 1: Create an authentication profile.

This is where you specify the authentication mechanisms.

  1. In the Authentication Rules area, select Add New Profile from the Default Profile drop-down list.

  2. Click Settings > Authentication.
  3. Click Add Profile on the Authentication Profiles page.
  4. Enter a unique name for each profile.
  5. Select the authentication mechanism(s) from either Multiple Authentication Mechanisms or Single Authentication Mechanism.

    You can't select the same mechanism in both challenge menus. For example, if you select QR Code in either of the challenge columns under Multiple Authentication Mechanisms, you can't select it under Single Authentication Mechanism.

    RADIUS does not support FIDO2 authentication mechanisms.

    Some authentication mechanisms require additional configurations before users can authenticate using those mechanisms. Make sure your users complete the configuration requirements for any mechanism you plan to use. Refer to Secure access with adaptive MFA for more detail.

    Authentication set Description
    Multiple Authentication Mechanisms

    You can require that the first challenge be the user’s account password, then for the second challenge users can choose between an email confirmation code, security question, or text message confirmation code. See Authentication mechanisms for information about each authentication mechanism.

    If you have multiple challenges, the CyberArk Identity waits until users enter all challenges before giving the authentication response (pass or fail). For example, if users enter the wrong password for the first challenge, the CyberArk Identity will not send the authentication failure message until after users respond to the second challenge.

    If users fail their first challenge and the second challenge is SMS, email, or phone call, the default configuration is that the CyberArk Identity will not send the SMS/email or trigger the phone call. Contact support to change this configuration.
    Single Authentication Mechanism

    Single authentication challenges are sufficient for users to log in without any additional challenges, even if you selected challenges from Multiple Authentication Mechanisms.

    For example: if you select Password for Challenge 1, Security Question(s) for Challenge 2, and QR Code from Single Authentication Mechanism, a user with an enrolled device can scan the QR Code with the CyberArk Identity mobile app to log in, bypassing the mechanisms selected from Multiple Authentication Mechanisms. If a user does not have an enrolled device, the user can log in by responding to the challenges selected from Multiple Authentication Mechanisms (Password and Security Question(s) in this example).

  6. (Optional) Select the pass-through duration.

    If users have already authenticated using one of the specified mechanism within this duration, then they will not be authenticated again. The default is 30 minutes.

    This pass-through option does not apply to Windows or Mac MFA logins, or RADIUS VPN connections; only the User Portal and the Admin Portal.
  7. Click OK.

    If you have not created an authentication rule, see Create authentication rules to create one and associate this profile to it.

Step 2: Create an authentication rule.

This is where you specify the conditions in which the authentication profile is applied.

  1. Click Core Services > Policies and select the policy you want to edit or click Add Policy Set to create a new one.

  2. Click Authentication Policies > CyberArk Identity.

  3. Select Yes in the Enable authentication policy controls drop-down.

  4. Click Add Rule.

  5. The Authentication Rule window displays.

  6. Click Add Filter.

  7. Define the filter and condition using the drop-down boxes.

    For example, you can create a rule that requires users logging in from China to provide the authentication challenges specified in step 2. The sample rule would look like the following:

    Supported filters are:

    Filter Description Conditions available
    Identity Cookie

    The cookie that is embedded in the current browser by CyberArk Identity after the user has successfully logged in

    • Is present
    • Is not present


    The browser used for opening the CyberArk Identity portal.

    • equal to
    • not equal to


    CyberArk Identity roles that a user belongs to. If a user belongs to multiple roles, the authentication rule that comes first (highest priority on top) is honored.

    If a role is renamed following the creation of an authentication rule using Role as a filter, the authentication rule will automatically update with the new role name. If a role is deleted, the portion of the any authentication rule using that role as a filter will also be deleted.

    This filter is only applicable to managing web application access.

    • equal to
    • not equal to


    The country based on the IP address of the user computer.

    • equal to
    • not equal to

    Risk Level

    Risk Level: The authentication factor is the risk level of the user logging on to user portal. For example, a user attempting to log in to CyberArk Identity from an unfamiliar location can be prompted to enter a password and text message (SMS) confirmation code because the external firewall condition correlates with a medium risk level. This Risk Level filter, requires additional licenses. If you do not see this filter, contact CyberArk support. The supported risk level are:

    • Non Detected -- No unexpected activities are detected.
    • Low -- Some aspects of the requested identity activity are unexpected. Remediation action or simple warning notification can be raised depending on the policy setup.
    • Medium -- Many aspects of the requested identity activity are unexpected. Remediation action or simple warning notification can be raised depending on the policy setup.
    • High -- Strong indicators that the requested identity activity is anomaly and the user's identity has been compromised. Immediate remediation action, such as MFA, should be enforced.
    • Undetermined -- Not enough user behavior activities (frequency of system use by the user and length of time user has been in the system) have been collected.

    The following video illustrates how to create an authentication rule based on risk level.

    • equal to
    • not equal to

    Managed Devices

    A device is considered “managed” if it is enrolled in CyberArk Identity and you use CyberArk Identity for device management. A device that is enrolled for only single sign-on or endpoint authentication is not considered a managed device. For more information about the difference, refer to Mobile Device Management or single sign-on only.

    The Windows Cloud Agent does not include device management features. Enrolled Windows machines are not considered managed devices.

    This filter is only applicable to managing web application access.

    • True
    • False

    Certificate Authentication

    Whether or not you use a digital certificate issued by your organization’s trusted certificate authority. You can upload a certificate using the Admin Portal > Settings > Authentication > Certificate Authorities. Users can also individually use CyberArk as their trusted certificate authority and automatically install the digital certificate by enrolling their devices.

    For example, if you configure an authentication rule to use the Certificate Authentication condition, then CyberArk Identity checks for a digital certificate issued by a trusted certificate authority and enforces the specified authentication profile before allowing access to this application.

    CyberArk support must enable the Certificate Authentication filter for your company.
    • is used
    • is not used
  8. Click the Add button associated with the filter and condition you have specified.

  9. Select the profile you want applied (in the Authentication Profile dr op-down) if all conditions are met.

    For example, you can select the "Trial Profile" profile you created in step 2.

  10. Click OK.

Step 3: Select a default profile, then save.

  1. Select a default profile to be applied if a user does not match any of the configured conditions in the Default Profile (used if no conditions matched) drop-down.

    If you have no authentication rules configured and you select Not Allowed in the Default Profile dropdown, users will not be able to log in to the service.
  2. Click Save.