MFA

modules/ROOT/content-nav.adoc

@@ -121,11 +121,13 @@ Generic Start
 ** xref:logging/log-downloads.adoc[Download logs]
 
 * Security
+** xref:security/mfa.adoc[Multi-factor authentication]
 ** xref:security/single-sign-on.adoc[Single sign-on]
 ** xref:security/secure-connections.adoc[Secure connections]
 ** xref:security/encryption.adoc[Encryption]
 ** xref:security/tool-auth.adoc[Tool authentication with Aura user]
 
+
 * xref:user-management.adoc[User management]
 
 * xref:billing.adoc[Billing]

modules/ROOT/pages/security/mfa.adoc

@@ -0,0 +1,50 @@
+= Multi-Factor Authentication 
+
+Multi-Factor Authentication (MFA) adds an extra layer of security to your Neo4j Aura account by requiring a verification code in addition to your password. 
+The verification code is generated using any authenticator app, such as Google Authenticator.
+
+There are two scenarios for MFA:
+
+* Individual users can enable MFA for their own accounts.
+* Organization administrators can enable MFA for an entire organization, then it's mandatory for all members to go through the MFA setup.
+
+[IMPORTANT]
+====
+To enable MFA, you must log in using email and password, not using any SSO or Google Sign-In.
+====
+
+
+== Enable MFA as a user via account settings 
+
+. Log in to the Aura Console using your email/password.
+. Select your avatar to access *Account > Settings > Preferences > Security*.
+. Enable *Multi-Factor Authentication (MFA)*.
+This automatically logs you out.
+. Log back in with your email and password.
+. Enter the one-time password sent to your email account.
+. Scan the QR code in the setup modal.
+. Enter the verification code from the authenticator app.
+. Save your recovery code somewhere secure.
+
+==  Enable MFA for an organization 
+
+`Organization Owners` or `Organization Admins` can require all members of an organization to set up MFA from organization level security settings.
+Then each organization member will be prompted to complete the setup, with an authenticator app of their choice.
+
+To require MFA setup for an organization:
+
+. Go to *Organization Settings > Security & Networking > App MFA (Multi-Factor Authentication)*.
+. Enable *Multi-Factor Authentication (MFA)*.
+
+After MFA is enabled at the organization level, all members will see the following message in the console:
+
+[quote]
+"_Your organization has required Multi Factor Authentication (MFA). 
+Clicking enable MFA below will log you out and you will then need to login using your email and password to configure MFA._"
+
+. Once you click *Enable*, you are logged out automatically.
+. Log back in using your email and password,
+. Enter the one-time password sent to your email account.
+. Use your authenticator app to scan the QR code in the setup modal.
+. Enter the verification code from the authenticator app.
+. Save your recovery code somewhere secure.