---
title: MFA Configurations for VPN Services
slug: singleconnect-reference-guide-3-2-0/mfa-configurations-for-vpn-services
description: Learn how to leverage Single Connect MFA as a third-party server for enhanced security in applications, devices, and VPNs using RADIUS authentication. Discover two MFA server support options - one with Single Connect providing both primary and secondary a
docTags: 
createdAt: 2022-07-31T18:23:34.000Z
---

Single Connect MFA can be used as a 3rd party MFA server for all applications, devices, VPNs, etc. that support RADIUS authentication. Two options are available for MFA server support:

1. Both the first authentication (with username and password) and the secondary authentication (with OTP) are provided via Single Connect. To activate this feature:
   •	Define the VPN device according to the TACACS Access Manager configuration
   •	Enable MFA on the User Group (Navigate to** Administration** >** 2FA Provisioning **> **User Group Management**)
2. Only second authentication with OTP is provided via Single Connect. To activate this feature:
   •	Define the VPN device and the Device Group Realm with the related users in Single Connect (See [User Group Creation](docId\:JSLu4BUYSklRSlBB7IzJ8) and [Device Management](docId:0PMWEU2A-JcLspD18wGA5)  sections.)
   •	Define the element type property in the VPN Device element type section:
3. Navigate to **Device Management** >** Element Type**.
4. Click the **Options** button of the desired element type and select **Show Properties**.
5. Set the **radius.auth.only.token.enabled** property value as **true**.

::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/DKHL8hhJR7-T39z-ad4Co_image.png" size="70" width="525" height="219" caption="Only Second Authentication with OTP" position="center" showCaption="true"}