MFA

modules/ROOT/content-nav.adoc

@@ -121,11 +121,13 @@ Generic Start
 ** xref:logging/log-downloads.adoc[Download logs]
 
 * Security
+** xref:security/mfa.adoc[Multi-Factor Authentication]
 ** xref:security/single-sign-on.adoc[Single sign-on]
 ** xref:security/secure-connections.adoc[Secure connections]
 ** xref:security/encryption.adoc[Encryption]
 ** xref:security/tool-auth.adoc[Tool authentication with Aura user]
 
+
 * xref:user-management.adoc[User management]
 
 * xref:billing.adoc[Billing]

modules/ROOT/pages/security/mfa.adoc

@@ -0,0 +1,47 @@
+= Multi-Factor Authentication 
+
+Multi-Factor Authentication (MFA) adds an extra layer of security to your Neo4j Aura account by requiring a verification code in addition to your password. 
+To generate the verification code use an authenticator app, such as Google Authenticator.
+
+There's two scenarios for MFA:
+
+* Scenario 1: Individual users can enable MFA for their own accounts.
+* Scenario 2: Organization administrators can enable MFA for an entire organization, then it's mandatory for all members to go through the MFA setup.
+
+== Scenario 1. Enable MFA as a user via account settings 
+
+[IMPORTANT]
+====
+To enable MFA, you must log in using email and password, not Google login or SSO.
+====
+
+. Log in to the Aura Console using your email/password.
+. Go to *Account > Settings > Preferences > Security*.
+. In the *Multi-Factor Authentication (MFA)* section select *Enable*.
+. You will be logged out automatically.
+. Log back in with your email and password.
+. A setup modal appears with a QR code.
+. Scan the QR code.
+. Enter the verification code from the authenticator app.
+. Save your recovery code somewhere secure.
+
+==  Scenario 2. Enable MFA for an organization 
+
+* `Organization Owners` or `Organization Admins` can enable MFA that applies to all members of the organization.
+* Members must log in using email and password. MFA setup is not supported for accounts authenticated through SSO or Google OAuth.
+
+=== To require MFA for all organization members:
+
+. Go to *Account > Settings > Preferences > Security*.
+. In the *Multi-Factor Authentication (MFA)* section select *Enable*.
+
+==== Member steps to complete MFA setup:
+
+. Organization members will see the message, "_Your organization has required Multi Factor Authentication (MFA). Clicking enable MFA below will log you out and you will then need to login using your email and password to configure MFA._"
+. They click *Enable*.
+. Are logged out automatically.
+. Log back in using their email and password.
+. A setup modal appears with a QR code.
+. Using their authenticator app, they scan the QR code.
+. Enter the verification code from the authenticator app.
+. Save the recovery code somewhere secure.