Policy Configurations

In the instance that you do not want your MFA clients to cache authentication information locally, you will need to enable "Always Online Mode". This setting deletes the local user profile cache, requiring the system to have access to the server u...

Contactless cards are, by default, set up to lock the MFA workstation when tapped to the reader when logged in. This can be changed or turned off a few different ways depending on how you want your computers and contactless cards to work out for y...

In Internet Explorer on the ONE Admin Portal as the one_sys_admin user, go to the Policies tab. To the right of the look-up box, select the AD Tool. If you receive an error, please make sure you have the necessary ActiveX settings in ...

Under the Methods tab, click on 'New Pin Policy' on the left-hand side. A window will pop up. Give your new pin policy a name and its restrictions / rules. Hit Save when you're done. Back on the original screen, still on th...

If you have more than one MFA server and or a specific order you want your clients to look at the servers, the MFA policy can be used to configure that. In your MFA Portal, go to your Policies tab. On the left-hand side, click on Vi...

The clients are controlled by the registry keys in our location: HKLM\Software\Foray   These values are passed down through the MFA GlobalDefault or OU specific policy. In the event that you need to test a one-off functionality without af...

Enrollment Stations are central computers set up to be used solely for the function of enrolling new MFA users. The benefit of these station(s) is the enrolling user's information is not cached locally like a regular workstation and removes the ne...

FIDO tokens require a special step in their profile setup. The following instructions demonstrate that setup. This can also be done for "in-use" FIDO profiles. In your MFA portal, go to the Methods tab. Click on FIDO on the l...

The following steps are used to implement PIN based RBA with the RFID authentication method. This means when a user scans their card, they will be prompted to enter the PIN type associated with their authentication set and will not be prompted to ...

The Windows Username/Password tile has the highest amount of configurations for its appearance in your MFA client workflows. This document will talk about the most important settings that modify this tile's behavior and where and and when you can ...