---
title: PingOne MFA
description: Overview of PingOne MFA services for enabling MFA actions in authentication flows, configuring MFA settings and policies, and managing MFA devices
component: pingone-api
page_id: pingone-api:mfa:index
canonical_url: https://developer.pingidentity.com/pingone-api/mfa/index.html
llms_txt: https://developer.pingidentity.com/pingone-api/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: 2026-08-07
page_aliases: ["introduction.adoc"]
section_ids:
  authentication-methods: Authentication methods
---

# PingOne MFA

The PingOne MFA services provide capabilities for enabling MFA actions in authentication flows, configuring MFA settings and policies, and specifying MFA devices.

For MFA authentication:

* The /deviceAuthentications endpoint initiates and completes an MFA action without requiring a call to the PingOne authorize service. It supports actions to select a supported MFA device device type and to validate a one-time passcode (OTP). Refer to [MFA Device Authentications](mfa-authentication/mfa-device-authentications/index.html).

For MFA policies and settings:

* The MFA settings endpoint supports operations to read, update, and reset the PingOne MFA settings associated with a specified environment. Refer to [MFA Settings](mfa-settings/index.html).

* The Device authentication policies (identified in the PingOne UI as "MFA Policies") enable you to configure different settings per MFA authentication method, according to your security policies. Refer to [Device Authentication Policies](device-authentication-policy/index.html).

For MFA device management:

* The enable user settings (MFA) control whether a user can authenticate using MFA actions. This endpoint enables or disables MFA capability. refer to [Enable Users MFA](users/enable-users-mfa/index.html).

* The MFA devices service defines the MFA method or methods associated with a user, such as email, SMS, voice, or other MFA device types for use in an MFA flow. Refer to [MFA Devices](users/mfa-devices/index.html).

* To enable multi-factor authentication (MFA) via push notification on a native device, the user resource must have a native device and an application associated with its user ID. The association is implemented with a pairing key. Refer to [MFA Pairing Keys](users/mfa-pairing-keys/index.html).

|   |                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
| - | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
|   | These requests require `PING_ONE_MFA` in the Bill of Materials (BOM) for your environment. To check the BOM for the list of PingOne products associated with your environment, refer to [Read One Bill of Materials](../platform/bill-of-materials-bom/read-one-bill-of-materials.html). If `PING_ONE_MFA` is not in the BOM, contact your PingOne administrator to check whether your license supports adding this product to your environment. |

## Authentication methods

PingOne MFA supports the following authentication methods:

| Authentication Method Reference (amr) | Description                                                                                                                                      |
| ------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ |
| `EMAIL`                               | OTP through email                                                                                                                                |
| `MCA`                                 | Multiple-channel authentication, indicating that an out-of-band operation through mobile push, either interactive or "silent"                    |
| `MFA`                                 | Multi-factor authentication, indicating some MFA method, as opposed to a Bypass scenario                                                         |
| `OTP`                                 | Time-based one-time passcode using an authenticator application or mobile OTP                                                                    |
| `SMS`                                 | OTP through SMS text message                                                                                                                     |
| `SWK`                                 | Software-secured key, indicating device authorization using a trusted mobile device                                                              |
| `TEL`                                 | OTP through a phone call                                                                                                                         |
| `USER`                                | User presence test, indicating an interactive push notification approved by the user, as opposed to a non-interactive "silent" push notification |

|   |                                                                                                                                                                                                                                                                                                                                          |
| - | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|   | **Note** The mobile application can pass any string (such as as `face`, `ftp`, `pin`, etc.) as AMR using the `approve()` method to indicate how the user approved the authorization on a push notification flow. Refer to [PingOne MFA SDK for Android](../native-sdks/pingone-mfa-mobile-sdks/pingone-mfa-mobile-sdk-for-android.html). |