Access & identity
Multi-Factor Authentication (MFA)
Multi-Factor Authentication is an additional verification layer within the Telblu authentication architecture. Beyond the username and password (or identity-provider assertion), MFA requires the user to prove possession of a second, independent factor before a platform session is issued. This strengthens the reliability of identity verification and reduces the impact of credential compromise.
Availability of specific MFA methods depends on the Telblu deployment and the organisation's configuration. Where a corporate identity provider is used, MFA may be enforced by that provider and honoured by Telblu. Where Telblu handles credentials directly, MFA is governed by the organisation's authentication policy.
Identity verification
MFA adds a second, independent verification factor to a user's sign-in. Even if a password is compromised, an attacker cannot complete authentication without the additional factor.
Authentication security
By combining something the user knows with something the user has, MFA raises the cost of credential-based attacks such as phishing, credential stuffing and password spraying.
Session protection
MFA is evaluated at sign-in and can be re-challenged for sensitive actions or new devices, so long-lived sessions do not weaken the strength of the original authentication.
Enterprise authentication
MFA policy is defined per organisation. Administrators can require MFA for privileged roles or every user, and enforce it consistently across password and identity-provider sign-in.
What is Multi-Factor Authentication?
Multi-Factor Authentication requires a user to present a second verification factor after their password. In Telblu today that second factor is a time-based one-time password (TOTP) generated by a standard authenticator app on the user's device, with single-use recovery codes as a backup. Compromising the password alone is not sufficient to complete sign-in.
Why passwords alone may not be sufficient
Passwords are vulnerable to phishing, reuse across services, credential stuffing from public breaches and targeted password spraying. Even a strong password can be captured by a convincing lookalike login page. A single secret is a single point of failure for an entire account.
Multiple verification factors
MFA combines factors from independent categories so that a successful attack must compromise more than one channel simultaneously. A stolen password does not grant access without the registered device, and a stolen device does not grant access without the password.
How MFA complements authentication
MFA is layered on top of the primary authentication step. After the password or identity provider assertion is validated, Telblu (or the identity provider) issues an additional challenge. Only once the challenge is satisfied is a platform session created.
MFA alongside Roles & Permissions
MFA strengthens the identity that a session represents but does not decide what that identity is allowed to do. Once the user is authenticated, Telblu applies scoped role assignments to determine which organisations, departments and workspaces the session can access.
Authentication, MFA and access are distinct layers
InfoAuthentication Flow with MFA
The diagram below shows the complete Telblu sign-in flow when Multi-Factor Authentication is enabled. MFA appears as an additional gate after primary identity validation and before any authorisation decisions are made.
1. User
The user begins sign-in from a supported Telblu client. The starting point is an unauthenticated session that must be bound to a verified identity before platform access is granted.
2. Username & Password
The user presents their primary credentials. This may be a Telblu-managed password or an assertion returned by a configured enterprise identity provider during SSO.
3. Identity Validation
Telblu validates the credential or assertion. The identity is matched to an organisation user record, and the system checks whether the account is active and permitted to sign in.
4. Additional Verification (if enabled)
When MFA is required for the user or organisation, Telblu issues a second-factor challenge. The user enters a time-based one-time password (TOTP) from a registered authenticator app, or a single-use recovery code.
5. Authentication Successful
Both the primary credential and the additional factor are satisfied. Telblu establishes that the user is who they claim to be and creates an authenticated session context.
6. Role Resolution
The authenticated identity is mapped to role assignments within the organisation. Roles are resolved independently of authentication and determine the administrative or operational scope available.
7. Permissions Loaded
Permissions attached to the resolved roles are loaded into the session. These permissions define which actions, resources and workspaces the user may interact with.
8. Workspace Access
With identity proven, roles resolved and permissions loaded, the user is granted access to the workspaces and data scoped to their organisation and department assignments.
MFA is an authentication control, not an authorisation control
InfoWhere MFA Fits
MFA sits inside the authentication layer. It strengthens identity verification but hands off to authorisation only after the user has been successfully authenticated.
Authentication
Initiates the sign-in process and collects the primary credential.
Identity Verification
Confirms that the supplied credential matches a valid user record.
Multi-Factor Authentication
Strengthens identity verification with an independent second factor.
User Session
A secure session is issued only after authentication and any required MFA succeed.
Role Resolution
Determines which roles apply to the authenticated user.
Organisation Scope
Scopes the session to the correct organisation and department.
Platform Access
Grants access to workspaces and resources based on role-derived permissions.
MFA does not influence authorisation decisions
WarningSecurity Benefits
MFA delivers specific security outcomes when used as part of a broader authentication and access management strategy.
Additional Identity Verification
A second verification step reduces the likelihood that a stolen password or phished credential alone can lead to unauthorised account access. The attacker must also compromise a separate factor in a different channel.
Reduced Credential Risk
Compromised passwords should not be sufficient to access sensitive enterprise information. MFA ensures that knowledge of a secret must be paired with possession of a device or biometric proof.
Executive Account Protection
Privileged accounts with organisation-wide visibility are high-value targets. Requiring additional verification for administrators and executives limits the blast radius of credential compromise.
Defence in Depth
MFA forms one layer within Telblu's overall security model. It operates alongside strong authentication, granular permissions and audit logging so that no single control carries the entire security burden.
Authentication Lifecycle
The timeline below shows the complete lifecycle of a Telblu authentication session, from the initial login request through to session termination. MFA appears as an optional but critical gate before a session is created.
1. Login Request
The user initiates sign-in by presenting a primary credential, such as a username and password or an assertion from an enterprise identity provider. At this stage the session is unauthenticated and no platform resources are accessible.
2. Identity Verification
Telblu validates the credential or assertion against the organisation's user directory. The system confirms the account exists, is active and is permitted to authenticate. Failed verification returns an authentication error without revealing which factor failed.
3. Additional Verification (if required)
When MFA policy applies, Telblu issues an independent second-factor challenge. The user must satisfy this challenge before the flow can continue. If the challenge fails or times out, the session remains unauthenticated.
4. Session Created
After all required authentication factors succeed, Telblu creates a bounded session. The session carries identity claims, an expiration time and a refresh policy. It does not yet contain role or permission assignments.
5. Permissions Loaded
Role assignments are resolved and the corresponding permissions are loaded into the session context. This step translates the authenticated identity into an authorisation context that governs what the user may do.
6. Platform Access
With identity proven, MFA satisfied, roles resolved and permissions loaded, the user is granted access to the platform features, workspaces and data scoped to their organisation and department assignments.
7. Session Ends
The session ends when the user signs out, the session expires, or an administrator revokes the session. Upon termination, all in-memory authorisation context is discarded and the user must re-authenticate to continue.
Lifecycle stages are sequential
InfoRelationship to Platform Security
MFA is one component of a layered security model. The diagram below shows how authentication, MFA, authorisation, organisation scope and executive controls work together to enforce secure, least-privilege access.
Authentication
Establishes that the user is a valid member of the organisation and creates the initial session context.
Multi-Factor Authentication
Strengthens the authentication decision by requiring an independent verification factor.
Roles & Permissions
Translates the authenticated identity into an authorisation context with specific actions and resource grants.
Organisation Scope
Scopes the session to the correct organisation and department boundaries.
Executive Control Centre
Surfaces role-appropriate executive intelligence and controls based on the resolved permissions.
Authentication establishes identity
Authentication answers the question "Who is this user?" It binds the session to a verified organisation user record and provides the foundation for every subsequent security decision.
MFA strengthens the identity claim
By requiring an independent factor, MFA makes it harder for an attacker to impersonate a valid user even when the primary credential has been compromised.
Roles & Permissions enforce least privilege
Once identity is proven, Telblu applies role-based access control to ensure the user can only access the resources and actions required for their responsibilities.
Organisation scope isolates boundaries
organisation and department assignments prevent cross-tenant data exposure and ensure that executive views and operational data stay within the correct boundary.
Executive Control Centre surfaces role-scoped intelligence
The Executive Control Centre uses the resolved roles and permissions to present relevant executive intelligence. It does not bypass access controls; it relies on the same role-resolution layer used throughout the platform.
Secure access requires every layer
Best practiceDeployment Considerations
The authentication capabilities available to an organisation depend on the Telblu deployment model and the configuration applied by administrators. Not every deployment supports the same methods, policies or integrations.
Identity provider dependencies
When Telblu is configured to delegate authentication to an enterprise identity provider, MFA may be enforced by that provider. In this model Telblu honours the provider's authentication assertion and does not manage second-factor challenges directly.
Telblu-managed authentication
When Telblu manages credentials directly, MFA policy is configured within the organisation's access settings. Available factors, enforcement scope and re-challenge behaviour are determined by the deployment's capabilities.
Administrator enforcement
Administrators can typically require MFA for all users, for specific roles, or for privileged actions. The exact policy options available depend on the organisation's subscription and deployment configuration.
Audit and compliance alignment
Authentication and MFA events are recorded in the audit log where available. Retention periods, event granularity and export options vary by deployment and should be confirmed against the organisation's compliance requirements.
Supported MFA methods in this release
WarningSecurity Recommendations
The following practices help organisations get the most security value from MFA and keep access controls aligned with business risk.
Protect privileged accounts
Require additional verification for administrators, executives and other high-privilege roles. Privileged accounts have broad visibility into organisation data, so they should receive the strongest authentication protections available in the deployment.
Review authentication activity
Monitor sign-in patterns, failed attempts and new device usage through the audit log where available. Unusual activity may indicate credential compromise or attempts to bypass MFA policy.
Remove inactive users
Disable or remove accounts that no longer require access. Inactive accounts retain permissions until they are offboarded, increasing the attack surface and the risk of stale credentials being reused.
Regularly review permissions
Conduct periodic access reviews to confirm that role assignments still reflect current responsibilities. Over-provisioned roles undermine least privilege and can allow lateral movement after any successful authentication.
Combine MFA with strong role governance
MFA proves identity, but role governance decides what that identity can do. Align MFA enforcement with role sensitivity and ensure that privileged roles cannot be obtained without appropriate approval.
MFA is most effective when paired with governance
Best practice