> ## Documentation Index
> Fetch the complete documentation index at: https://faqs.xoxoday.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Does Xoxoday support multifactor authentication (MFA)?
> Xoxoday supports MFA via email OTP, SMS OTP, authenticator apps, and IdP push notifications, securing every admin and end-user login.
Xoxoday supports multifactor authentication (MFA) for all administrator and end-user logins, with methods including email OTP, SMS OTP, TOTP via Google Authenticator or Microsoft Authenticator, and push-based MFA through identity providers such as Okta and Duo.
Xoxoday enforces multifactor authentication as a configurable security layer that operates independently of whether your organisation uses single sign-on (SSO). This means every login — whether from an HR admin managing reward budgets or an employee redeeming a gift card — can be protected by a verified second factor.
**Email-based OTP**
The default second factor for local logins is a 6-digit one-time password delivered to the user's registered email address. The code is time-limited with strict retry controls: it expires quickly and is invalidated after a set number of failed attempts. This method requires no additional app installation and works across all device types and operating systems.
**SMS-based OTP**
SMS OTP is available upon request for organisations that need it to meet specific compliance mandates. A time-sensitive code is delivered to the user's registered mobile number during the login flow. This method suits environments where guaranteed email access at login cannot be assumed.
**Authenticator App (TOTP)**
Xoxoday supports time-based one-time passwords generated by third-party authenticator apps, including Google Authenticator and Microsoft Authenticator. During setup, users scan a QR code to link their account to the app. A new rotating 6-digit code is then generated every 30 seconds and used as the second factor at login. This method works entirely offline and is well-suited to teams that already use authenticator apps across other enterprise tools.
**Push-based MFA via Identity Provider**
For organisations using SSO, Xoxoday honours MFA enforcement configured at the identity provider level. When a user authenticates through Okta, Duo, or Microsoft Entra ID, step-up authentication and push notification challenges are handled natively by the IdP before Xoxoday grants access. This allows security teams to maintain a single, centralised MFA policy across all SaaS applications — including Xoxoday — without duplicating configuration.
**Backup and Recovery Codes**
Admins can optionally enable backup verification codes for users who lose access to their primary MFA method. These codes provide a controlled recovery path without requiring helpdesk intervention for every locked-out account.
**Admin Enforcement and Security Controls**
MFA enforcement in Xoxoday is role-aware and configurable. Administrators can require MFA based on user role, device type, or risk score — for example, making it mandatory for admins while keeping it optional for standard users. All MFA-related data exchange occurs over TLS-encrypted channels, and OTPs are invalidated immediately after use or after a maximum number of failed attempts, limiting exposure to brute-force and replay attacks.
For organisations operating under ISO 27001 or SOC 2 Type II compliance frameworks, Xoxoday's MFA controls support access control requirements and contribute to the audit trail generated for all login events.
**Learn more:** [Xoxoday Help Centre — Technical requirement](https://www.xoxoday.com/security)
Learn how Xoxoday integrates with SAML 2.0 and OIDC-based identity providers for single sign-on across your organisation.
Understand how Xoxoday uses TLS encryption to secure all data exchanged between users and the platform.