
We will walk through four ways developers can use modern approaches to enhance their user login experience. We will explore using Multi-Factor Authentication (MFA), implementing a passwordless solution, using biometrics as a part of the login experience, and more.

### Legal Disclosure

_This document and any recommendations within is not legal, privacy, security, compliance, or business advice. This document is intended for general informational purposes only and may not reflect the most current security, privacy, and legal developments nor all relevant issues. You are responsible for obtaining legal, security, privacy, compliance, or business advice from your own lawyer or other professional advisor and should not rely on the recommendations herein. Okta is not liable to you for any loss or damages that may result from your implementation of any recommendations in this document. Okta makes no representations, warranties, or other assurances regarding the content of this document. Information regarding Okta's contractual assurances to its customers can be found at [okta.com/agreements](https://www.okta.com/agreements/)._

Introduction

Google Social Connection to Login

Authentication Beyond Passwords



For this exercise, you'll configure the **"Phone Message"** factor by following these steps:

- Head to the [Auth0 Dashboard](https://manage.auth0.com/dashboard).
- Locate the **"Security"** section on the left-hand menu. Under this section, click the **"Multi-factor Auth"** sub-section.
- Click the **"Phone Message"** option under the **"Factors"** list to open its configuration page.

Now, let's explore in detail how you can configure this factor.

### Configure your delivery provider

The **"Phone Message"** factor is disabled by default if you are using a new tenant. To enable it, click the toggle button in the upper-right corner. The toggle button should turn green.

```ui/message-banner__5
```

You may see a message that your plan includes 100 SMS codes. That limit is acceptable for trying out this feature. However, you'll [configure an SMS delivery provider like Twilio](https://auth0.com/docs/customize/hooks/extensibility-points/send-phone-message/configure-twilio-as-mfa-sms-provider) to remove that limit in production.

Locate the **"Configure your delivery provider"** and select **"Twilio"** as your delivery provider, which allows you to use your Twilio account to deliver SMS messages for MFA. For simplicity, keep the default delivery method, **"SMS"**.

#### Configure your Twilio delivery provider

Right below the delivery method selection, you'll see two fields to enter your Twilio Account SID and Twilio Auth Token. Copy and paste those values from your Twilio Console into the corresponding field.

Select your **"SMS Source"**. Depending on your selection, you'll need to enter your **"Twilio Messaging Service SID"** or a **"From"** phone number. Your users will see what you enter as the sender of the SMS.

Select the **"Use From"** to use your Twilio phone number for simplicity. Copy and paste your Twilio Phone Number from the Twilio Console into the **"From"** field.

You'll see the **"Enrollment Template"** and **"Verification Template"** fields below this field, which you can use to customize the message your users get when they enroll a new device for MFA and when they log in after MFA enrollment. You can leave the default value for both of these fields.

#### Complete the factor configuration

Finally, click the **"Save"** button at the end of the page to complete configuring the **"Phone Message"** factor.

```ui/message-banner__6
```

You have effectively set up Twilio as an SMS delivery provider.



Define an MFA Factor



Once you have configured your MFA factor, scroll to the top of the page and click the **"Back to Multi-factor Authentication"** link.

Once you are back on the **"Multi-factor Authentication"** page, scroll past the **"Factors"** section and locate the **"Define policies"** section. Recall that an MFA policy determines _when_ Auth0 will prompt your users to provide additional authentication factors to log in successfully. You must define a policy to enforce MFA in your applications.

Looking at the **"Require Multi-factor Auth"**, you'll notice that **"Never"** is the default selection. This selection means that Auth0 will _never_ require users to authenticate using an additional factor for any application registered under your Auth0 tenant.

```ui/message-banner__7
```

For this exercise, select **"Always"** to always require an additional authentication factor to log in. Then, click the **"Save"** button.

```ui/message-banner__8
```

```ui/message-banner__9
```

<details>

<summary>

Did you get a warning about enabling MFA?

</summary>

You may see a modal warning you about the possible consequences of always requiring MFA:

> _All new and existing users who are not enrolled in Multi-factor Authentication will be required to enroll using one of the enabled factors the next time they log in. This will apply across all applications within your tenant._

If it shows up, click the **"Continue"** button.

</details>



Define an MFA Policy



```ui/goal-banner__1
```

In this lab, you will:

- Define an MFA Factor using a phone message.
- Define, apply, and test an MFA policy.
- Use Twilio to deliver MFA codes via SMS.





### Required hardware

You need a mobile phone with SMS service to complete this lab and valid phone number to activate your Twilio account.

### Create an Auth0 Account

If you already have an Auth0 account, you can log in to your tenant and continue to the next step.

Otherwise, <a href="https://auth0.com/signup/?utm_source=devcenter&utm_medium=auth0&utm_campaign=devn_signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for a free Auth0 account</a>.

```ui/signup-ad__2
```

During the sign-up process, you create something called an [Auth0 Tenant](https://auth0.com/docs/get-started/auth0-overview/create-tenants), representing the product or service to which you are adding authentication.

```ui/message-banner__3
```

### Create an Account with Twilio

Visit ["Try Twilio"](https://www.twilio.com/try-twilio) to get started with a free Twilio account. Twilio does not require you to provide any credit card information to try their services.

![Try Twilio sign-up form](https://cdn.auth0.com/website/developer/resources/workshops/adding-mfa-sms-with-twilio/try-twilio.png)

**Be ready to have a valid phone number to verify your Twilio account**. You may need to answer some quick questions as part of the sign-up process with Twilio.

### Access the Twilio Console

Once you create a Twilio account and log in, you'll see the Twilio Console. You'll use the Twilio Console to manage your Twilio account and any applications that you decide to connect with Twilio services.

For this exercise, you'll need to locate your [Twilio Account String Identifier (SID)
](https://www.twilio.com/docs/glossary/what-is-a-sid) and your [Twilio Auth Token](https://support.twilio.com/hc/en-us/articles/223136027-Auth-Tokens-and-How-to-Change-Them), which you'll use later to configure MFA with Auth0.

You can locate the Account SID and the Auth Token within the **"Account Info"** box of your Twilio Console.

**Safeguard your Account SID and Auth Token as they are credentials** that Twilio uses to determine which Twilio account should receive incoming API requests. The Account SID acts as a username and **the Auth Token acts as a password**. As such, never give out your Auth Token to anyone or expose it to the public.

To send an SMS using Twilio, you'll need either a Twilio Messaging Service SID or a Twilio Phone Number. A Twilio Phone Number is a virtual yet standard telephone number that is not locked down to a physical phone. For simplicity, you'll use a Twilio Phone Number to send your MFA SMS codes.

```ui/message-banner__4
```

Check the official documentation from Twilio to ["Get your first Twilio phone number"](https://www.twilio.com/docs/usage/tutorials/how-to-use-your-free-trial-account#get-your-first-twilio-phone-number). Upon success, you'll see a message confirming that Twilio has assigned you a phone number. Your Twilio Phone Number is listed under the **"Account Info"** section of the Twilio Console.



Lab Setup


You have effectively set up MFA SMS with Twilio, reducing the likelihood of many cyber-attacks. It's common for third parties to steal usernames and passwords or programmatically attack user accounts. An additional MFA factor, such as an SMS code, impedes these violations, protecting the data and privacy of your users.

Recap



### Use the Auth0 Dashboard to log in

#### Instructions

- Visit the [Auth0 Dashboard](https://manage.auth0.com/) home page.
- Locate the **"Try your Login box"** under the **"Next Steps"** section.
- Click the **"Try it out"** link.
- Log in using any of the available login options.

#### Expected results

The Auth0 Universal Login page should prompt you to use two authentication factors to complete your login&mdash;or sign-up:

- **If you sign up, you need to provide...**
  - Something you know: You must create a username/password combination or use a social login provider like Google (if you have enabled that feature in your Auth0 tenant).
  - Something you have: You'll have to enroll your phone number for MFA.
- **If you log in, you need to provide...**
  - Something you know: You must use a username/password combination or a social login provider like Google.
  - Something you have: You'll have to enter an SMS code that Auth0 has sent through Twilio to your phone number.



Test Your MFA Strategy with Twilio SMS



When you **configure Multi-Factor Authentication (MFA) to use SMS** as an authentication factor, Auth0 will send your users a code via SMS as part of the authentication process. Your users will have to enter that code in a login form to complete the login transaction. This interaction implies that your users can **prove their digital identity** by providing:

- **Something they know:** your users know their login credentials.
- **Something they own:** your users have the device that they have registered to use with MFA.

### MFA with Twilio

Auth0 has built-in support for sending messages through Twilio, a popular customer engagement platform. Auth0 can use Twilio to deliver MFA verification code via text messages as part of your user login flow.

When you use Twilio with Auth0, you can customize the message content depending on the user or the application that triggered the login transaction. You can also add custom logic before sending a message to a user.



What is MFA?

Passwordless With Email

Enable SMS for MFA Using Auth0 and Twilio



Follow these steps to integrate the Auth0 social connection in your tenant with your Google Cloud project:

- Head to the [Auth0 Dashboard](https://manage.auth0.com/dashboard).
- Click the **"Authentication"** tab on the left-hand menu and then click the **"Social"** option.
- Select the `google-oauth2` connection.
- Copy the Client ID from the Google Cloud project into the **"Client ID"** field of your `google-oauth2` **"Settings"** page.
- Copy the Client Secret from the Google Cloud project into the **"Client Secret"** field of your `google-oauth2` **"Settings"** page.
- Scroll to the bottom of the page and click **"Save Changes"**.



Configure the Google Social Connection



```ui/goal-banner__1
```

In this lab, you will:

- Set up a Google developer project.
- Test a Google social connection for development.
- Configure and test a Google social connection for production.





### Create an Auth0 Account

If you already have an Auth0 account, you can log in to your tenant and continue to the next step.

Otherwise, <a href="https://auth0.com/signup/?utm_source=devcenter&utm_medium=auth0&utm_campaign=devn_signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for a free Auth0 account</a>.

```ui/signup-ad__3
```

During the sign-up process, you create something called an [Auth0 Tenant](https://auth0.com/docs/get-started/auth0-overview/create-tenants), representing the product or service to which you are adding authentication.

```ui/message-banner__4
```




You learned the value of using Auth0 dev keys to prototype and test Google social login quickly. You also learned how to create a Google consent screen and set of credentials that you can use to help your users log in while your app is in production.

As a final piece of advice, for purposes of data sanitation, management, and regional privacy policies, it is a good idea to separate data in environments. A best practice when working with Auth0 is to have different tenants for your project environments.

For example, [**it's recommended for developers to specify a production tenant**](https://auth0.com/docs/get-started/tenant-settings). A production tenant gets higher rate limits than non-production tenants. Check out the ["Set Up Multiple Environments"](https://auth0.com/docs/get-started/auth0-overview/create-tenants/set-up-multiple-environments) Auth0 document to learn more about how to set up **development**, **staging**, and **production** environments in the Auth0 Identity Platform.

This practice would also cover key management. You can create a Google Cloud project that pairs with each Auth0 tenant. Then, you can configure the Google social connection for each tenant using the keys from its corresponding Google Cloud project.

Recap and Insights



Auth0 needs credentials to connect with Google authorization servers when processing social logins. You need a Google Developer account to create a Google Cloud project where you can set up those credentials. If you don't have one already, [sign up for a Google Developer account](https://console.developers.google.com/).

### Create a Google Project

Follow the steps to **"Create a project"** from the ["Create, shut down, and restore projects"](https://support.google.com/googleapi/answer/6251787?ref_topic=7014522#zippy=%2Ccreate-a-project) document from the Google API Console Help site:

- Visit the [Google API Console](https://console.developers.google.com/).
- Click the **"Create Project"** button.
- Provide a project name such as **"Hello Social Login"**.
- Click on the **"Create"** button.

Once you complete this process, a new **"APIs & Services"** page will load. Ensure that your project is selected in the drop-down next to the **"Google Cloud"** logo on the navigation bar.

You need an OAuth client ID and client secret to identify your application in Google's OAuth servers. To do so, you must configure an OAuth consent screen and create credentials for your Google Cloud project.

### Configure consent screen

According to Google, when you use OAuth 2.0 for authorization, your application requests authorizations for one or more scopes of access from a Google Account. Google displays a consent screen to the user, including a summary of your project, its policies, and the requested access scopes. 

As such, before creating an OAuth client ID, you must first configure the OAuth consent screen with information about your application.

Click the **"Configure Consent Screen"** on the page to start the process, filling out the required information for each section.

#### 1. OAuth Consent Screen

Choose how you want to configure and register your app, including your target users. You can only associate one app with your project. 

- Select **"External"** for the **"User Type"**.
  - You can only select "Internal" if your Google account is part of a Google Workspace.
- Click the **"Create"** button.

Next, a screen loads for you to configure the app registration screen.

Locate the **"App Information"** section and fill out its form as follows:

- Use **"Hello World"** as the **"App name"**.
- Select your Google account email for the "User support email".

Locate the **"App domain"** section and then the **"Authorized domains"** subsection to perform the following steps:

- Click on the **"Add Domain"** button.
- Enter `auth0.com` as the value of the **"Authorized domain"**.
- Click out of the field to confirm your input. 

Locate the **"Developer contact information"** section and enter your Google account email address as the value of **"Email addresses"**.

Finally, click the **"Save and Continue"** button.

#### 2. Scopes

Scopes allow your project to access specific types of private user data from their Google Account. By default, Auth0 requests Google for the user's basic and extended profile. Google presents this request to the user at the time they log in: 

**"To continue, Google will share your name, email address, language preference, and profile picture with auth0.com."**

You don't need to specify any additional scopes for this lab. As such, click **"Save and Continue"**.

#### 3. Test Users

You don't need to specify test users as you are using Auth0. Click **"Save and Continue"**.

#### 4. Summary

This section shows you a recap of the OAuth consent screen settings and any scopes or test users you could have set up.

Click **"Back to Dashboard"** to continue.

### Create a Google OAuth Client ID

For this section, you will need the value of your Auth0 domain, which you can obtain by following these instructions:

- Open the [Applications](https://manage.auth0.com/#/applications) section of the Auth0 Dashboard.
- Click on any of the applications that show up.
- Click on the **"Settings"** tab of the application page.
- Locate the **"Domain"** field under the **"Basic Information"** section.
- Store the **"Domain"** value in the following field to set up your Google credentials in the next section:

```ui/field__5
```

```ui/message-banner__6
```

Proceed to create credentials to access the Google authorization servers as follows:

- Click the **"Credentials"** tab on the left-hand menu.
- Click the **"Create Credentials"** button and select "OAuth client ID".
- Select **"Web Application"** as the **"Application type"**.
- Provide **"Hello World"** as the **"Name"**.

Locate the **"Authorized JavaScript origins"** section and follow these steps:

- Click the **"Add URI"** button.
- Enter your Auth0 Domain as the value of the field that comes up:

```config/bash__1
https://$AUTH0_domain
```

Next, locate the **"Authorized redirect URIs"** section and follow these steps:

- Click the **"Add URI"** button.
- Enter the following as the value of the field that comes up:

```config/bash__2
https://$AUTH0_domain/login/callback
```

Finally, click the **"Create"** button.

You'll see an **"OAuth client created"** modal, which displays your OAuth Client ID and a Client Secret. You'll need this information in the next section.



Set Up Google Production Keys



### Use the Auth0 Dashboard to log in

#### Instructions

- Visit the [Auth0 Dashboard](https://manage.auth0.com/) home page.
- Locate the **"Try your Login box"** under the **"Next Steps"** section.
- Click the **"Try it out"** link.

#### Expected results

Notice that there's an alert on the top-right corner of this page. This alert warns you about using Auth0 Dev Keys for one or more of your connections and that you should not use those keys in production.

Auth0 Google dev keys are not intended or safe for production environments or to handle real users' traffic. The goal of dev keys is only to allow developers to see how their applications can work with Auth0 quickly. Let's go over how you can set up Google production keys for your Auth0 social connection.



Test the Default Google Social Connection



You ensure you have configured your Google social connection correctly using the Auth0 Dashboard and the client demo application.

### Use the Auth0 Dashboard to log in

#### Instructions

- Visit the [Auth0 Dashboard](https://manage.auth0.com/) home page.
- Locate the **"Try your Login box"** under the **"Next Steps"** section.
- Click the **"Try it out"** link.

#### Expected results

Notice that the login page no longer has the dev keys alert.

Proceed to log in with Google to fully test the social connection, if you'd like.



Test Your Production Google Social Connection



Google is a popular social connection that allows users to log in to your application using their Google profile. Google social login is easy to set up. Google lets you set up a developer account for free with a limited yet generous number of Google Cloud projects. Google does not require you to have a paid developer account to fully enable Google as a social identity provider.

<details>

<summary>

What is Social Login?

</summary>

Social login is [Single Sign-On (SSO)](https://auth0.com/single-sign-on) for end-users. Users can log in to applications or websites using their existing login information from a social network provider like Facebook, Twitter, or Google. Social login simplifies registration and login transactions for end-users as they don't need to create a new account specifically for your application or website.

Additionally, social login improves the onboarding experience as you can gather up-to-date user information from the social network provider in the background without creating any friction or compromise on user experience.

The social login process is simple:

- Users enter your application and select the desired social network provider.
- Your application uses Auth0 to send a login request to the social network provider.
- Once the social network provider confirms the user's identity, your existing users get access to your application. Auth0 will register any new users and then log them into the application.

```ui/message-banner__2
```

</details>

Auth0 makes it even easier to get started with Google. Every new tenant has the Google social connection enabled by default. You don't even have to set up a Google Cloud project to see Google social login in action. Auth0 maintains a set of developer keys you can use to start testing Google social login in your applications in development. **You'll learn how to use those Google dev keys and set up ones for production throughout this exercise**.

What if your users modify their Google profile information? By default, Auth0 automatically syncs Google user profile data with each user login, which ensures that changes made in the user's Google profile are automatically updated in Auth0. Optionally, you can disable user profile data synchronization to keep the scope of updating user profile information within your application.

Let's get started with using Google to log in!



Why Use Google For Social Login?



You have set up your passwordless connection using email. Now, you need to configure the Auth0 Universal Login page to use that passwordless connection so your users can log in using only their email addresses:

- Click the **"Branding"** tab on the left-hand menu of the Auth0 Dashboard.
- Click the **"Universal Login"** option.
- Click the **"Advanced Options"** box to override the Universal Login page with custom HTML.
- Click the **"Login"** tab and then click the toggle button present in the **"Customize Login Page**" box. 
  - You can now interact with the code widget below.
- Locate the **"Default Templates"** drop-down menu in the top-right corner of the widget. 
- Select the **Lock (passwordless)** option. 
  - The HTML code within the widget will change.
- Finally, scroll to the bottom and click the **"Save Changes"** button.

```ui/message-banner__8
```



Implement Passwordless Authentication



```ui/goal-banner__1
```

In this lab, you will:

- Configure an Auth0 passwordless connection.
- Test passwordless login using email.





### Create an Auth0 Account

If you already have an Auth0 account, you can log in to your tenant and continue to the next step.

Otherwise, <a href="https://auth0.com/signup/?utm_source=devcenter&utm_medium=auth0&utm_campaign=devn_signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for a free Auth0 account</a>.

```ui/signup-ad__2
```

During the sign-up process, you create something called an [Auth0 Tenant](https://auth0.com/docs/get-started/auth0-overview/create-tenants), representing the product or service to which you are adding authentication.

```ui/message-banner__3
```





```ui/message-banner__4
```

Ensure that you are still logged in to the Auth0 Dashboard and follow these steps:

- Head to the [Auth0 Dashboard](https://manage.auth0.com/dashboard).
- Click the **"Authentication"** tab on the left-hand menu. 
- Click the **"Passwordless"** option to open the **"Passwordless Connections"** page.
- Click the toggle button of the **"Email"** option. 

A modal will come up for you to customize the settings and options, allowing your users to use one-time password (OTP) authentication via email messages:

- Click the **"Settings"** tab.
  - You can customize the content and appearance of the email message your users will receive using the **From**, **Subject**, and **Body** fields. 
  - **For simplicity, use the provided default values**.
  - Click the **"Save"** button.

```ui/message-banner__5
```

- Click the **"Applications"** tab.
  - You can enable this passwordless connection on any of your applications by clicking on the toggle button next to its name.
  - You need to enable the connection on at least one application to try it out in the next steps.
  - Click the **"Save"** button.

```ui/message-banner__6
```

### Caveats

By default, Auth0 sends the email from its own SMTP provider. However, **Auth0's built-in email infrastructure should be used for testing-level emails only** as it doesn't allow you to modify the content of the email your users will receive using the abovementioned fields. For simplicity, you'll use the default Auth0 SMTP provider for this exercise.

For production, you can configure your own SMTP email provider, such as Mandrill, Amazon SES, or Sendgrid, to better monitor and troubleshoot the email service and to fully customize the email messages. Additionally, for Auth0 to send your custom email, you must change the **"From"** value to an email address that is not from the `@auth0.com` domain. Otherwise, Auth0 will send the default email template.

```ui/message-banner__7
```



Set Up a Passwordless Connection


### Use the Auth0 Dashboard to log in

#### Instructions

- Visit the [Auth0 Dashboard](https://manage.auth0.com/) home page.
- Locate the **"Try your Login box"** under the **"Next Steps"** section.
- Click the **"Try it out"** link.
- Enter your email address using the input box under the message **"Otherwise, enter your email to sign in
or create an account"**.
- Click the **"Submit"** button.

#### Expected results

Auth0 will send you an email with a verification code you'll need to enter on the login page to access the account. Once you do so, a success page loads showing you the **"It Works!"** title and a box with the user information present in your decoded ID token.

Test Your Passwordless Authentication with Email



[Passwordless authentication](https://auth0.com/blog/what-is-passwordless-authentication/) is the process of verifying the identity of a user with something other than a password. The most common passwordless authentication methods include asking users to **prove their digital identity** by providing:

- Something they own: your users have access to a device or account they own.
- Something they are: your users provide a biometric trait that is unique to them, like their fingerprints.

The [benefits of using passwordless authentication](https://auth0.com/docs/authenticate/passwordless#benefits) include improved user experience, enhanced security, and reduced total cost of ownership.

### Auth0 Makes Passwordless Authentication Easy

Auth0 offers passwordless connections that allow users to log in to your applications without needing to remember yet another password. For this exercise, you'll enable passwordless authentication using something your users own: their email accounts.

Your users will experience the following login flow when using passwordless authentication with email:

- Your application will redirect users to the Auth0 Universal Login Page whenever they need to log in.
- Your users will enter an email address in the provided login form instead of a username and password combination.
- Your users will receive a one-time-use code via email.
- They will enter the one-time-use code on the login screen to access the application.



What is Passwordless Authentication?

WebAuthn with FIDO Security Keys



Before you start, it's important to note that biometrics are currently tied to a physical device. For example, if you use your smartphone to log in using its fingerprint reader, you can only use that smartphone to log in that way. In the context of MFA, if a biometric is the only second factor that your users have available to complete the authentication process, they won't be able to log in if they don't have the physical device that registered their biometric.

You can **achieve a balance between security and usability** by offering your users an alternative MFA factor whenever their device biometrics are unavailable. For that reason, Auth0 requires you to enable at least one other factor before enabling **"WebAuthn with FIDO Device Biometrics"** as an authentication factor. You are all set up if you have already completed any of our other MFA labs. Otherwise, please complete either the ["Enable MFA with SMS"](/resources/labs/authentication/enable-mfa-with-sms) or the ["WebAuthn with FIDO Security Keys"](/resources/labs/authentication/webauthn-with-fido-security-keys) lab.

### Enable WebAuthn with FIDO Device Biometrics

Follow these steps to configure the **"WebAuthn with FIDO Device Biometrics"** factor:

- Head to the [Auth0 Dashboard](https://manage.auth0.com/dashboard).
- Locate the **"Security"** section on the left-hand menu.
- Under this section, click the **"Multi-factor Auth"** sub-section.
- Click the **"WebAuthn with FIDO Device Biometrics"** option under the **"Factors"** list to open its configuration page.
- There's not much more to do other than clicking the toggle button to enable this factor, which turns the button green.

```ui/message-banner__5
```





Once you have configured your MFA factor, click the **"Back to Multi-factor Authentication"** link at the top of the page.

Once you are back on the **"Multi-factor Authentication"** page, scroll past the **"Factors"** section and locate the **"Define policies"** section. Recall that an MFA policy determines _when_ Auth0 will prompt your users to provide additional authentication factors to log in successfully. You must define a policy to enforce MFA in your applications.

Looking at the **"Require Multi-factor Auth"**, you'll notice that **"Never"** is the default selection. This selection means that Auth0 will _never_ require users to authenticate using an additional factor for any application registered under your Auth0 tenant.

```ui/message-banner__6
```

For this exercise, select **"Always"** to always require an additional authentication factor to log in. Then, click the **"Save"** button.

```ui/message-banner__7
```

```ui/message-banner__8
```

<details>

<summary>

Did you get a warning about enabling MFA?

</summary>

You may see a modal warning you about the possible consequences of always requiring MFA:

> _All new and existing users who are not enrolled in Multi-factor Authentication will be required to enroll using one of the enabled factors the next time they log in. This will apply across all applications within your tenant._

If it shows up, click the **"Continue"** button.

</details>





```ui/goal-banner__1
```

In this lab, you will:

- Define an MFA Factor using device biometrics.
- Define, apply, and test an MFA policy.





### Required hardware

You need a device that can use your biometric information for access, such as a mobile device with face recognition or a fingerprint reader.

### Create an Auth0 Account

If you already have an Auth0 account, you can log in to your tenant and continue to the next step.

Otherwise, <a href="https://auth0.com/signup/?utm_source=devcenter&utm_medium=auth0&utm_campaign=devn_signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for a free Auth0 account</a>.

```ui/signup-ad__3
```

During the sign-up process, you create something called an [Auth0 Tenant](https://auth0.com/docs/get-started/auth0-overview/create-tenants), representing the product or service to which you are adding authentication.

```ui/message-banner__4
```





### What is MFA?

When you **configure Multi-Factor Authentication (MFA) to use biometrics** as an authentication factor, your users will have to use their face or fingerprint to complete the login transaction. This interaction implies that your users can **prove their digital identity** by providing:

- **Something they know:** your users know their login credentials.
- **Something they are:** your users can show their faces or scan their fingerprints.


### What are device biometrics?

[Biometrics](https://auth0.com/blog/what-are-biometrics-the-proscons-of-biometric-security/) are **measurable** and **unique** human traits that applications can use to verify a person's identity, such as a person's face or fingerprints.

Biometrics can serve as a secure and convenient authentication factor, **making Multi-Factor Authentication (MFA) as easy and fast as possible**. The availability of mobile devices capable of reliably measuring human traits has grown exponentially, increasing the popularity of biometric authentication in enterprise and customer applications.

Developers enable end-users to use biometrics on web applications by implementing the [Web Authentication API (WebAuthn)](https://webauthn.me/), which is part of the [FIDO2 standard](https://fidoalliance.org/fido2/). End-users can register their biometric devices with any application that supports the standard.

When users authenticate with WebAuthn, they can use something they are as an authentication factor, such as their face or fingerprint. Auth0 supports using biometrics to perform MFA. Let's see that in action!

```ui/rabbit__2
```



MFA with Biometrics


You have effectively set up MFA, reducing the likelihood of many cyber-attacks. It's common for third parties to steal usernames and passwords or programmatically attack user accounts. An additional MFA factor, such as WebAuthn with FIDO Device Biometrics, impedes these violations, protecting the data and privacy of your users.

You can also configure the Auth0 Universal Login to let users [authenticate using WebAuthn with Device Biometrics instead of a password](https://auth0.com/docs/authenticate/login/auth0-universal-login/passwordless-login/webauthn-device-biometrics). Try it out!

![A user gets the option to use device biometrics or a password to log in.](https://images.ctfassets.net/cdy7uua7fh8z/4DkewyodXBQ3gncybz7KPI/873d6a3eafb644ee605daa209006d1b3/Docs_Login.png)



### Use the Auth0 Dashboard to log in

#### Instructions

- Visit the [Auth0 Dashboard](https://manage.auth0.com/) home page.
- Locate the **"Try your Login box"** under the **"Next Steps"** section.
- Click the **"Try it out"** link.
- Log in using any of the available login options.

#### Expected results

The Auth0 Universal Login page should prompt you to use two authentication factors to complete your login&mdash;or sign-up:

- **If you sign up, you need to provide...**
  - Something you know: You must create a username/password combination or use a social login provider like Google (if you have enabled that feature in your Auth0 tenant).
  - Something you have: You could enroll a security key or an authenticator application, for example.
  - Something you are: You'll have to enroll your face or a fingerprint.
    - **Notice that this is optional**. Auth0 will ask you if you'd like to enroll your device biometrics to log in faster the next time.
- **If you log in, you need to provide...**
  - Something you know: You must use a username/password combination or a social login provider like Google.
  - Something you are if you enrolled your device biometrics: You'll have to show your face or scan your fingerprint.
  - Something you have, as an alternative to device biometrics: You'll have to connect and tap your security key or enter a One-Time Password (OTP) from an authenticator application.



Test Your MFA Strategy with Device Biometrics

WebAuthn with Biometrics



For this exercise, you'll configure the **"WebAuthn with FIDO Security Keys"** factor by following these steps:

- Head to the [Auth0 Dashboard](https://manage.auth0.com/dashboard).
- Locate the **"Security"** section on the left-hand menu. Under this section, click the **"Multi-factor Auth"** sub-section.
- Click the **"WebAuthn with FIDO Security Keys"** option under the **"Factors"** list to open its configuration page.
- Click the toggle button to enable this factor, which turns the button green.

<details>

<summary>

What is user verification for security keys?

</summary>

The **"WebAuthn with FIDO Security Keys"** configuration page presents you with a **"User Verification"** section. In the context of a security key, user verification is the process of verifying that the person authenticating is authorized to use the security key. When you enable this feature, the browser will ask the user logging in to enter a PIN or use a touch sensor to complete the WebAuthn challenge.

Some browsers don't implement key user verification properly. Additionally, user verification does not work for FIDO1 keys. As such, it's best to set this option to **"Never"** or **"If supported"**.

**"Never"** is the default value as it's usually good enough **_when you are using security keys for MFA_**. In the context of MFA, users must enter a username/password combination or use social login before using their security keys as part of the authentication process. As such, your users have already provided some form of user verification before the browser prompts them to use their security keys.

</details>





Once you have configured your MFA factor, click the **"Back to Multi-factor Authentication"** link at the top of the page.

Once you are back on the **"Multi-factor Authentication"** page, scroll past the **"Factors"** section and locate the **"Define policies"** section. Recall that an MFA policy determines _when_ Auth0 will prompt your users to provide additional authentication factors to log in successfully. You must define a policy to enforce MFA in your applications.

Looking at the **"Require Multi-factor Auth"**, you'll notice that **"Never"** is the default selection. This selection means that Auth0 will _never_ require users to authenticate using an additional factor for any application registered under your Auth0 tenant.

```ui/message-banner__4
```

For this exercise, select **"Always"** to always require an additional authentication factor to log in. Then, click the **"Save"** button.

```ui/message-banner__5
```

```ui/message-banner__6
```

<details>

<summary>

Did you get a warning about enabling MFA?

</summary>

You may see a modal warning you about the possible consequences of always requiring MFA:

> _All new and existing users who are not enrolled in Multi-factor Authentication will be required to enroll using one of the enabled factors the next time they log in. This will apply across all applications within your tenant._

If it shows up, click the **"Continue"** button.

</details>





```ui/goal-banner__1
```

In this lab, you will:

- Define an MFA Factor using security keys.
- Define, apply, and test an MFA policy.





### Required hardware

You need a security key to complete this lab. If you are attending an Auth0 workshop in person, please reach out to any workshop mentors to receive one if you haven't already.

### Create an Auth0 Account

If you already have an Auth0 account, you can log in to your tenant and continue to the next step.

Otherwise, <a href="https://auth0.com/signup/?utm_source=devcenter&utm_medium=auth0&utm_campaign=devn_signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for a free Auth0 account</a>.

```ui/signup-ad__2
```

During the sign-up process, you create something called an [Auth0 Tenant](https://auth0.com/docs/get-started/auth0-overview/create-tenants), representing the product or service to which you are adding authentication.

```ui/message-banner__3
```





### What is MFA?

When you **configure Multi-Factor Authentication (MFA) to use a security key** as an authentication factor, your users will have to connect their security key to a device to complete the login transaction. This interaction implies that your users can **prove their digital identity** by providing:

- **Something they know:** your users know their login credentials.
- **Something they own:** your users have a security key that they have registered to use with MFA.

### What are security keys?

A security key is a device that works as an authentication factor. Its primary objective is to **make Multi-Factor Authentication (MFA) as easy and fast as possible**. After you enter the first authentication factor (username and password or social login), you connect your security key to your device and press or tap a button to activate it. The security key sends a code to the application, completing the login process.

You can read our ["The Working Principles of 2FA (2-Factor Authentication) Hardware"](https://auth0.com/blog/the-working-principles-of-2fa-2-factor-authentication-hardware/) blog post to learn more about the details on how security keys work and why they are the strongest possible authentication factor.

These are some key takeaways on the [advantages of security keys](https://auth0.com/blog/fido-security-key-support-comes-to-auth0/#The-Case-for-Security-Keys) when compared to using a smartphone-only authenticator for MFA:

- They **protect against phishing and man-in-the-middle attacks**.
- They **promote user privacy** as they don't require a personal device.
- They **provide one-touch login** without having to take out a mobile phone to complete an authentication challenge.
- Users can **register multiple keys** with applications, minimizing business disruption and the chances of account lockout.

Some of the most popular security keys are [Yubikey](https://www.yubico.com/) and [Google Titan](https://cloud.google.com/titan-security-key). These keys come in different sizes and offer different connection options, such as USB-A, USB-C, and Lightning. Some keys are NFC-enabled so that you can use them without physically connecting the key to a device: you simply tap and go!

Security companies build these devices based on open standards. The FIDO Alliance has standardized the design of security key software, which makes them easy to use and reliable. Developers allow their users to use security keys on web applications by implementing the [Web Authentication API (WebAuthn)](https://webauthn.me/), which is part of the [FIDO2 standard](https://fidoalliance.org/fido2/). End-users can register their security keys with any application that supports the standard.

When users authenticate with WebAuthn, they can use something they have as an authentication factor, such as a security key. Auth0 supports using FIDO-compliant security keys to perform MFA. Let's see that in action!



MFA with a FIDO Security Key


You have effectively set up MFA, reducing the likelihood of many cyber-attacks. It's common for third parties to steal usernames and passwords or programmatically attack user accounts. An additional MFA factor, such as WebAuthn with FIDO Security Keys, impedes these violations, protecting the data and privacy of your users.

You can allow your users to enroll in MFA using different factors. Follow the ["WebAuthn with Biometrics" lab](/resources/labs/authentication/webauthn-with-biometrics) to learn how to set up Multi-Factor Authentication (MFA) using biometrics as an authentication factor.

```ui/message-banner__7
```



### Use the Auth0 Dashboard to log in

#### Instructions

- Visit the [Auth0 Dashboard](https://manage.auth0.com/) home page.
- Locate the **"Try your Login box"** under the **"Next Steps"** section.
- Click the **"Try it out"** link.
- Log in using any of the available login options.

#### Expected results
 
The Auth0 Universal Login page should prompt you to use two authentication factors to complete your login&mdash;or sign-up:

- **If you sign up, you need to provide...**
  - Something you know: You must create a username/password combination or use a social login provider like Google (if you have enabled that feature in your Auth0 tenant).
  - Something you have: You'll have to enroll your security key.
- **If you log in, you need to provide...**
  - Something you know: You must use a username/password combination or a social login provider like Google.
  - Something you have: You'll have to connect and tap your security key.



Test Your MFA Strategy with Security Keys

We will walk through four ways developers can use modern approaches to enhance their user login experience. We will explore using Multi-Factor Authentication (MFA), implementing a passwordless solution, using biometrics as a part of the login experience, and more.


## Introduction

We will walk through four ways developers can use modern approaches to enhance their user login experience. We will explore using Multi-Factor Authentication (MFA), implementing a passwordless solution, using biometrics as a part of the login experience, and more.

### Legal Disclosure

_This document and any recommendations within is not legal, privacy, security, compliance, or business advice. This document is intended for general informational purposes only and may not reflect the most current security, privacy, and legal developments nor all relevant issues. You are responsible for obtaining legal, security, privacy, compliance, or business advice from your own lawyer or other professional advisor and should not rely on the recommendations herein. Okta is not liable to you for any loss or damages that may result from your implementation of any recommendations in this document. Okta makes no representations, warranties, or other assurances regarding the content of this document. Information regarding Okta's contractual assurances to its customers can be found at [okta.com/agreements](https://www.okta.com/agreements/)._
