I would like to request that the MFA enrolment process be repaired because its current behaviour is misleading and undermines confidence in this important security feature.
I have now reproduced the following behaviour:
-
“Enforce multi-factor authentication” is enabled for a user.
-
The user signs in and is presented with the QR code.
-
The QR code is scanned successfully using 2FAS Authenticator.
-
The current six-digit code is entered into Manager.
-
Manager reports that the token is invalid.
-
The user logs out and signs in again.
-
Manager displays the normal authentication-code prompt.
-
The code generated by the same 2FAS entry is accepted and the user is logged in.
I also tested the recovery procedure by disabling and re-enabling MFA. Manager generated a new QR code and secret, but the enrolment screen again reported that the new token was invalid. After logging out, the newly generated token worked correctly and the old token no longer worked.
This confirms that the QR code and authenticator are working correctly. The problem is with the enrolment screen or its validation process.
This issue matters because a user who receives an “Invalid token” message will naturally conclude that MFA setup has failed. Many users may abandon MFA entirely, while administrators must explain that the error should be ignored and that the user should log out and try again. A security feature should provide especially clear and trustworthy feedback.
Ideally, Manager should validate the authentication code during enrolment and display a clear success message. If validation at that stage is not intended, the authentication-code field should be removed and replaced with instructions such as:
MFA registration is complete. Sign out and sign in again to verify your authenticator.
For an even cleaner process, Manager could confirm the code, complete enrolment, and then automatically return the user to the login screen.
This behaviour has already been discussed in the forum:
MFA itself appears to work correctly once enrolment is complete. However, the incorrect error during setup is confusing, discourages adoption, and creates unnecessary support work. I believe this issue deserves to be corrected.