Skip to main content
Regentra supports two ways to add a second factor to sign-in: passkeys (Face ID, Touch ID, Windows Hello, or a security key) and TOTP authenticator apps (Microsoft Authenticator, Google Authenticator, Authy, 1Password, etc.). Either one satisfies your MFA requirement — you don’t need both.

​
Who needs MFA

MFA is mandatory for Admin, Super Admin, and MSP Admin roles, regardless of whether your organization has turned on the org-wide MFA toggle. Every other role follows your organization’s MFA setting, which an admin controls from Settings → Authentication & SSO.
If you hold an admin-tier role, you can’t opt out of MFA even if your organization’s MFA toggle is off. Set up a passkey or TOTP before you’re prompted at login.

​
Setting up MFA

1

Navigate to security settings

Go to Settings → Authentication & SSO.
2

Choose a method

Set up a passkey under the Passkeys card, or a TOTP app under the Multi-Factor Authentication card. You can set up both if you like.
3

Confirm the factor

A passkey confirms itself the moment your device creates it (Face ID, Touch ID, Windows Hello, or your security key’s own prompt). A TOTP app confirms by scanning a QR code and entering the 6-digit code it generates.

​
Passkeys

Passkeys use WebAuthn/FIDO2 — the same technology behind “Sign in with Face ID” on other sites. They’re phishing-resistant: a passkey is bound to Regentra’s actual domain, so it can’t be tricked into authenticating on a lookalike site the way a typed code can. Enroll one from Settings → Authentication & SSO → Passkeys. You can register more than one — for example, your laptop’s Touch ID and a physical security key as a backup — and each shows up as its own entry you can name and revoke independently.
A passkey satisfies your MFA requirement on its own, without an authenticator app — signing in with a passkey is already two factors (something you have, something you are or know) in one step.

​
Trusted devices

When you complete an MFA challenge, you can check Remember this device for 14 days to skip the second-factor prompt on that device until it expires. Manage which devices are currently trusted — and revoke any you don’t recognize — from Settings → Authentication & SSO → Trusted Devices.

​
Enrolling or removing a factor

Both enrolling a new factor and removing an existing one require you to have verified a factor earlier in your current session — a fresh MFA check, not just being logged in. If you’re prompted to re-verify while trying to change your MFA settings, that’s this step-up check; complete it and you’ll return to where you were.
This applies even to removing your last remaining factor — you can’t disable MFA on your account without proving you still control a factor first.

​
Recovery

When you enroll a TOTP authenticator, Regentra generates one-time backup codes — store them somewhere safe (a password manager, not the same device as your authenticator app). Each code works once. If you lose access to your authenticator device and have a passkey enrolled, sign in with the passkey instead — no recovery needed. Otherwise:
  1. Use a backup code at the MFA prompt to sign in.
  2. Ask an admin to reset your MFA from Settings → Team Members, if you’re out of backup codes too. This clears your enrolled factors so you can set up a new one on your next login.

​
Password requirements

Regentra requires a minimum password length of 12 characters with no other composition rule — no forced mix of uppercase, numbers, or symbols. Every password is checked against a breach database at signup, reset, and change; a password that’s appeared in a known breach is rejected even if it meets the length requirement.
If the breach-check service is temporarily unreachable, Regentra doesn’t block you from setting your password — it lets the change through and records the fact that the check couldn’t run, rather than locking you out over a third-party outage.

​
Account lockout

After 5 failed sign-in attempts, an account is locked for 15 minutes before another attempt is allowed. This applies per account, not per IP address, so a locked-out user can’t be unlocked simply by trying from a different network.

​
Azure AD users and MFA

If your organization uses Entra ID SSO for authentication, Regentra checks whether the sign-in response from Azure AD actually proves MFA happened, rather than assuming it did just because SSO was used. If Azure AD’s conditional access enforced MFA on that sign-in, Regentra accepts it as satisfying its own requirement and skips its passkey/TOTP prompt. If it can’t confirm that — Azure AD didn’t enforce MFA, or the proof is missing — and this user still requires MFA, Regentra falls back to its own passkey or TOTP challenge right after the SSO sign-in.
Regentra doesn’t duplicate MFA unnecessarily, but it also never blanket-trusts SSO as a substitute for MFA. Admin-tier roles always require MFA regardless of SSO — signing in via SSO satisfies that requirement only when Azure AD’s own proof is strong enough; otherwise Regentra still prompts them.