> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Manage machine authenticator settings

Machine Authentication captures identifying information about the Web browser used to access an application. Resource rules can use this information during risk evaluation. When configured, IDaaS compares the browser's current Machine Authentication attributes with the attributes previously stored in the user's IDaaS account.

The user receives risk points for each difference found between the machine authentication attribute values in the web browser and the values stored in the IDaaS account. The risk points from this test are combined with points from other risk-based authentication tests to produce a total risk score. This score determines the level of authentication required to access the application, based on the **Authentication Decision** settings in each resource rule.

IDaaS validates the Web browser by using a machine secret generated when the user creates a Machine Authentication on that browser. IDaaS stores the machine secret from each Machine Authentication in its repository.

## Modify machine authenticator settings

1. Click Menu icon **>** **Policies** **>Authenticators**.

2. **Select** **Machine Authenticator**. The **Machine Authenticator** settings appear.

3. To allow users to use Machine Authentication, click **Enabling this feature allows users to register a Machine Authenticator**. If selected, when a user logs in using the minimum authentication level or higher, a **Remember Me** option appears on the log in screen for the user to assign machine authentication.

4. **If you select the allow users to use Machine Authentication, modify the following settings as required:**

   1. From the **Authenticator Required for Machine Registration** drop-down list, select the authenticator that is the minimum level used to register a Machine authenticator to a Web browser when logging in.

   note
   **Password + OTP**, **Password + Token**, **Password + Token Push**, and **Password + Mobile Smart Credential Push** authentications can only be performed when logging in to specific applications. If any of these options are selected, a Machine authenticator cannot be registered when logging in to an IDaaS account.

5. Set **Maximum Number of Machine Secrets** to the number of computers a user can have registered. Setting the value to `1` disables machine secret storage and machine authentication. The maximum value is `20`.

6. Under **Machine Authenticator Security Level**, select one of the following:

   - **Machine Nonce Required** to require a machine **nonce** be part of the machine secret used for authentication. This is the default setting.

     Including a machine nonce as part of the machine authentication allows those willing to have cookies stored on their Web browser to leverage machine authentication. The machine nonce (and/or sequence nonce) is stored in the local storage folder of the Web browser. IDaaS references that number during machine authentication to validate that the number included matches the number recorded by IDaaS. Machine authentication is successful when both numbers match. The unique number sent to the Web browser used when creating each machine authentication also allows IDaaS to differentiate between Web Browsers with highly similar attributes.

   - **Sequence Nonce Required** to require a sequence nonce for authentication. This increases security by reducing the validity period for the machine information and making it more difficult for an attacker to steal a machine secret without being detected.

     Including a sequence nonce makes it very difficult for an unwanted party to copy a machine authenticator from one Web browser to another. A sequence nonce is created after each successful authentication and stored on your Web browser for the next one. Copying over a machine secret from one Web browser to another is insufficient to log in successfully if the latest sequence nonce is not included.

   - **Device Fingerprint Required** to require a device fingerprint for authentication. See [Manage device fingerprint attributes](/docs/authentication-and-security/manage-authenticators/manage-device-fingerprint-attributes.md).

   note
   Entrust recommends including a machine nonce as it provides the highest level of security. Only disable this setting if machine secrets cannot be stored on your users' computers. Machine secrets cannot be stored on the client computer if cookies or Flash are disabled. If this setting is disabled, you must enable **Device Fingerprinting Required** for Machine Authentication to be available.

7. Set **Machine Secret Lifetime in Hours** to set the lifetime, in hours, of a machine secret. A value of `0` gives the machine secret an infinite lifetime. The maximum value is `876,000` hours, or `100` years.

8. Select **Count Failed Machine Authentication** to count every failed machine authentication as a failed login attempt, which counts toward the number of failed attempts required to lock a user out of their account.

9. Click **Save**.

### Validate your changes

After you save, verify the following:

1. Updated machine authenticator settings remain selected after refresh.
2. A test user can register a machine authenticator when the configured minimum authenticator requirement is met.
3. Machine authentication risk behavior matches the selected security level (machine nonce, sequence nonce, or device fingerprint).
4. Machine secret limits and lifetime settings are enforced as configured.
5. If enabled, failed machine authentication attempts count toward account lockout as expected.