---
title: Multi-Factor Authentication
slug: kronpam-agent-reference-guide-3-8-1/multi-factor-authentication
description: Learn how to enhance security on your agent-installed endpoint with Multi-Factor Authentication (MFA). Enable MFA for specific user groups in Single Connect and easily configure it in the System Configuration Manager. With MFA in place, users will be prom
docTags: 
createdAt: 2023-06-20T15:08:59.000Z
---

In the agent-installed endpoint, we can add a second layer of security during the authentication. Upon providing the correct credentials users will be asked to provide an OTP from the Kron PAM mobile app to complete login. 

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/xC9TrgxNpAytJIVbBOaW8_image.png "MFA User Group Management")

First, users need to enable MFA for the user group from Kron PAM.

- Navigate to** Administration. **
- **Multi-Factor Authentication > User Group Management.** 

From this menu, enable OTP for the desired user groups. 

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/sfi5D1-hMsbr5JfFicaEX_image.png "System Config Management MFA Parameter")

As a second step

- Navigate to **Administration > System Configuration Manager.** 
- Add **sc.windows.agent.connection.otp.enabled** parameter as true. 

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/xrvFUNoC0Tbrw5pcMuiXP_image.png "Agent MFA Login")

Upon successfully configuring MFA, users will be asked to provide an OTP upon connecting to the endpoint. When a user enters the wrong OTP 3 times the agent terminates the connection.

### Offline authentication

OTP prompts during login can continue even if the agent's connection to PAM is lost. When the **Offline Authentication** toggle is enabled under the Agent Group (as shown in the screenshot below), it defines the duration (in days) that offline authentication will remain active for agents in that group.

For this policy to take effect, the user must have logged into the endpoint at least once while the agent was online. During the specified period, the OTP generation key for that user will be stored locally on the agent in an **encrypted** format, allowing the OTP to be validated locally by the agent.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/bwzfqi2M4ZwuFnkEmvQ8e_image.png "Offline Authentication Configuration")