Policy Configuration

Policy Configuration controls multi-factor authentication (MFA) failure lockout rules, as well as how OTP binding keys are generated and associated with user accounts. The configuration applies only to the current application.

Path: Sign in to the RootAuth Console → select the target application → click Configuration in the top navigation → Security Settings → Multi-factor Authentication → Policy Configuration.

 

1. Policy Configuration Page

On the Multi-factor Authentication page, click the Policy Configuration tab to configure policies. This tab is displayed alongside Factor Management. The Email Verification, OTP, and SMS Verification switches in Factor Management remain independent and are not affected by the settings on this page.

After making changes, click Save at the bottom of the page to apply them. Click Reset to restore the values from before the current edit.

 

2. MFA Failure Lockout Policy

Controls the number of consecutive failed verifications allowed for enabled MFA methods and the duration of the resulting lockout.

Setting	Default value	Rule
Consecutive failed attempts	6 attempts	Can be set from 2 to 20 attempts.
Lockout duration	60 minutes	Can be set from 30 to 1,440 minutes.

 

When a user reaches the configured consecutive-failure limit, the system temporarily locks subsequent MFA verification attempts. The user can try again after the lockout duration ends. The factors included in the count are the MFA methods enabled for the current application in Factor Management.

 

3. OTP Binding Key Policy

Controls how OTP QR-code keys are generated and associated with user accounts.

Option	Description	Effective rule
Use RootAuth default rules	Keeps the current RootAuth default behavior.	The system generates a new binding QR code after OTP is re-enabled for the application or an administrator resets a user's OTP.
Bind to the user account	Associates the OTP key with the user account on an ongoing basis.	The same user uses the same key and sees the same QR code each time they enter the binding flow.

4. Notes

• Policy Configuration and factor switches are independent settings. Turning off a factor does not remove policies saved on this page.
• Changes to the lockout policy apply only to subsequent MFA failure counts and lockout behavior. Users already locked out must wait until the current lockout duration ends.
• When Bind to the user account is selected, a new OTP key is generated only when MFA is reset or rebound. Ensure that users keep their currently bound authenticator secure.