{"slug":"enable-two-factor-and-multifactor-authentication","title":"Enable two-factor and multifactor authentication","tags":["tailscale","auth"],"agent_summary":"Last validated: Jun 18, 2024","trigger_phrases":[],"runnable":false,"markdown":"\r\n# Enable two-factor and multifactor authentication\r\n\r\nLast validated: Jun 18, 2024\r\n\r\nTailscale relies on your existing [identity provider](https://tailscale.com/docs/integrations/identity) to authenticate users. Any authentication settings from your identity provider are _automatically used_ by Tailscale, including MFA.\r\n\r\nTo enable MFA for your domain, set it up from your identity provider.\r\n\r\n## [Apple](https://tailscale.com/docs/multifactor-auth\\#apple)\r\n\r\nApple provides documentation on how to enable multifactor authentication for Apple\r\nID. Refer to the Apple Support topic [Two-factor authentication for Apple ID](https://support.apple.com/HT204915)\r\nfor more information.\r\n\r\n## [Google](https://tailscale.com/docs/multifactor-auth\\#google)\r\n\r\nGoogle provides documentation on how to enable multifactor authentication for Gmail and Google Workspace (G Suite). Refer to the Google Help Center topic [Deploy 2-Step Verification](https://support.google.com/a/answer/9176657) for more information.\r\n\r\n## [Microsoft](https://tailscale.com/docs/multifactor-auth\\#microsoft)\r\n\r\nMicrosoft provides documentation that describes how to enable MFA for your whole domain or for individual users for Office365, Active Directory, and Azure Active Directory. Refer to the Microsoft documentation topic [Multifactor authentication for Microsoft 365](https://docs.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/multi-factor-authentication-microsoft-365) for more information.\r\n\r\n## [Okta](https://tailscale.com/docs/multifactor-auth\\#okta)\r\n\r\nOkta provides documentation that describes how administrators can configure MFA for their entire organization or only for\r\nTailscale by setting a multifactor policy. Refer to the Okta documentation topic [Multifactor Authentication](https://help.okta.com/en-us/Content/Topics/Security/mfa/mfa-home.htm) for more information.\r\n\r\n## [OneLogin](https://tailscale.com/docs/multifactor-auth\\#onelogin)\r\n\r\nOneLogin provides documentation that describes how users can enable MFA for the domain by creating a new authentication\r\nfactor, assigning it to a security policy, and assigning that policy to their users. Refer to the OneLogin documentation topic [Use MFA for extra security](https://www.onelogin.com/getting-started/free-trial-plan/add-mfa) for more information.\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"<h1>Enable two-factor and multifactor authentication</h1>\n<p>Last validated: Jun 18, 2024</p>\n<p>Tailscale relies on your existing <a href=\"https://tailscale.com/docs/integrations/identity\">identity provider</a> to authenticate users. Any authentication settings from your identity provider are <em>automatically used</em> by Tailscale, including MFA.</p>\n<p>To enable MFA for your domain, set it up from your identity provider.</p>\n<h2><a href=\"https://tailscale.com/docs/multifactor-auth#apple\">Apple</a></h2>\n<p>Apple provides documentation on how to enable multifactor authentication for Apple\r\nID. Refer to the Apple Support topic <a href=\"https://support.apple.com/HT204915\">Two-factor authentication for Apple ID</a>\r\nfor more information.</p>\n<h2><a href=\"https://tailscale.com/docs/multifactor-auth#google\">Google</a></h2>\n<p>Google provides documentation on how to enable multifactor authentication for Gmail and Google Workspace (G Suite). Refer to the Google Help Center topic <a href=\"https://support.google.com/a/answer/9176657\">Deploy 2-Step Verification</a> for more information.</p>\n<h2><a href=\"https://tailscale.com/docs/multifactor-auth#microsoft\">Microsoft</a></h2>\n<p>Microsoft provides documentation that describes how to enable MFA for your whole domain or for individual users for Office365, Active Directory, and Azure Active Directory. Refer to the Microsoft documentation topic <a href=\"https://docs.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/multi-factor-authentication-microsoft-365\">Multifactor authentication for Microsoft 365</a> for more information.</p>\n<h2><a href=\"https://tailscale.com/docs/multifactor-auth#okta\">Okta</a></h2>\n<p>Okta provides documentation that describes how administrators can configure MFA for their entire organization or only for\r\nTailscale by setting a multifactor policy. Refer to the Okta documentation topic <a href=\"https://help.okta.com/en-us/Content/Topics/Security/mfa/mfa-home.htm\">Multifactor Authentication</a> for more information.</p>\n<h2><a href=\"https://tailscale.com/docs/multifactor-auth#onelogin\">OneLogin</a></h2>\n<p>OneLogin provides documentation that describes how users can enable MFA for the domain by creating a new authentication\r\nfactor, assigning it to a security policy, and assigning that policy to their users. Refer to the OneLogin documentation topic <a href=\"https://www.onelogin.com/getting-started/free-trial-plan/add-mfa\">Use MFA for extra security</a> for more information.</p>\n<p><img src=\"https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed\" alt=\"Project Logo\"></p>\n<p>Ask AI</p>\n<p>reCAPTCHA</p>\n<p>Recaptcha requires verification.</p>\n<p>protected by <strong>reCAPTCHA</strong></p>\n"}