---
title: Multi-Factor Authentication
slug: kronpam-agent-reference-guide-3-8-0/multi-factor-authentication
description: Learn how to enhance security on your agent-installed endpoint with Multi-Factor Authentication (MFA). Enable MFA for specific user groups in Single Connect and easily configure it in the System Configuration Manager. With MFA in place, users will be prom
docTags: 
createdAt: 2023-06-20T15:08:59.000Z
---

In the agent-installed endpoint, we can add a second layer of security during the authentication. Upon providing the correct credentials users will be asked to provide an OTP from the Kron PAM mobile app to complete login. 

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/xC9TrgxNpAytJIVbBOaW8_image.png "MFA User Group Management")

First, users need to enable MFA for the user group from Kron PAM.

- Navigate to** Administration. **
- **Multi-Factor Authentication > User Group Management.** 

From this menu, enable OTP for the desired user groups. 

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/sfi5D1-hMsbr5JfFicaEX_image.png "System Config Management MFA Parameter")

As a second step

- Navigate to **Administration > System Configuration Manager.** 
- Add **sc.windows.agent.connection.otp.enabled** parameter as true. 

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/xrvFUNoC0Tbrw5pcMuiXP_image.png "Agent MFA Login")

Upon successfully configuring MFA, users will be asked to provide an OTP upon connecting to the endpoint. When a user enters the wrong OTP 3 times the agent terminates the connection.