---
title: MFA Configurations for VPN Services
slug: singleconnect-reference-guide-3-1-0/mfa-configurations-for-vpn-services
description: Learn how to enhance the security of your applications and devices with Single Connect MFA. This document explores two options for implementing Single Connect as a third-party MFA server, including utilizing it for both initial and secondary authenticatio
docTags: 
createdAt: 2022-07-31T18:23:34.000Z
---

Single Connect MFA can be used as a 3rd party MFA server for all applications, devices, VPNs, etc. that support RADIUS authentication. Two options are available for MFA server support:

1. Both the first authentication (with username and password) and the secondary authentication (with OTP) are provided via Single Connect. To activate this feature:
   •	Define the VPN device according to the TACACS Access Manager configuration
   •	Enable OTP on the User Group (Navigate to** Administration** >** 2FA Provisioning **> **User Group Management**)
2. Only second authentication with OTP is provided via Single Connect. To activate this feature:
   •	Define the VPN device and the Device Group Realm with the related users in Single Connect (See [](https://app.archbee.com/docs/jsymInd0w_SXayMlKGOmR/324coxOV7eIniuZghqbQk)[User Group Creation](docId\:CqJW9kmGk4tJ4f2zIIMiA) and [Device Management](docId\:adWPW6z8hh1jE67rihAtN) sections.)
   •	Define the element type property in the VPN Device element type section:
3. Navigate to **Device Management** >** Element Type**.
4. Click the **Options** button of the desired element type and select **Show Properties**.
5. Set the **radius.auth.only.token.enabled** property value as **true**.

::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/DKHL8hhJR7-T39z-ad4Co_image.png" size="70" width="525" height="219" caption="Only Second Authentication with OTP" position="center" showCaption="true"}