---
title: Using MFA for Kron PAM Mobile Client Application
slug: kronpam-reference-guide-3-9-0/using-mfa-for-kron-pam-mobile-client-application
description: Learn how to enable multi-factor authentication (MFA) in Kron PAM's Mobile Application to secure online access. This guide explains the process of installing the Kron PAM Mobile App, registering a token, and enabling MFA for user groups. Discover how the 
docTags: 
createdAt: 2022-07-31T18:06:05.000Z
---

Kron PAM’s built-in MFA can be used as a secondary layer of authentication for logging into the Kron PAM Mobile Client for its online features (Approval Management, Geo-Fencing, and Password Manager).


To enable MFA for Kron PAM Mobile Client Application:

:::hint{type="warning"}
- Admin and user must install the Kron PAM Mobile Client Application and register a token to receive Offline Tokens with the Kron PAM Mobile Client Application. (You get the tokens from the **Offline Token > + > Add New Token > Register Token** menu).  
- MFA must be enabled for the user group using MFA for Mobile Client connections. (See sections [Sending the MFA QR Code to Users](docId\:r-Q1GHQ5jOx1b8rV1q9KD), [Creating a Connection Between Kron PAM and the Kron PAM Mobile Client Application](docId\:A3GIZ4czOLC5WC9pTfOSA), [Enabling Multi-Factor Authentication (MFA)](docId\:EWfFlZCOkk4zsgvVXeAJU))
:::

1. Navigate to **Administration **> **System Configuration Manager**.
2. Set the **mobile.application.otp.enabled **parameter as true.

After these settings are done and a login operation is started on the Kron PAM Mobile Client Application, the application will automatically look for a Registered Token in its Offline Tokens with the name that matches the tfa.otp.issuer parameter. If there is a registered token with another name, then it will prompt the user to change the registered token. The user selects yes and enters a new token on the next page, window forwards to the token page for entering a new token. If the token is matched, the user can log in. Once the current six-digit value of the Offline Token is validated with the server, login will be successful.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/vzYUNhK6TJFCZcIgGx9AV_image.png "Figure – Token mismatch ")

If there’s no Registered Token in the Kron PAM Mobile Client Application and MFA is enabled with the parameter above, registering a token also requires a Multi-Factor Authentication. Kron PAM will send a one-time-password (OTP) to the user’s phone number ([Using SMS for MFA](docId\:mTVaBgG2fqvAaAYjRb3CF)). The user will be asked to enter the OTP on the Kron PAM Mobile Client Application.

:::hint{type="info"}
The Kron PAM Mobile Client MFA functionality works only with *registered *tokens to ensure that the offline tokens are only working in one Kron PAM Mobile Client Application at a time.
:::