> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Configure authenticator policies

Configure which authenticators users can view and manage in the User Portal, including authenticator preference controls.

User Portal authenticator management can help users keep recovery authenticators current before they need account recovery. For planning guidance, see [Account recovery and authenticator readiness](/docs/authentication-and-security/manage-authenticators/account-recovery-and-authenticator-readiness.md).

## Configure the authenticators users can see and manage in the User Portal

1. Click Menu icon **>** **Policies > User Portal**. The **User Portal** **page** appears.
2. Click **Authenticators**. The **Authenticators** page appears.
3. Select **Allow users to view their Authenticators** to allow users to access the **Authenticators** tab and see their authenticators.
4. Select **Allow users to manage authenticator preferences**. When enabled, users can change the order of the second-factor authenticators presented to them at login. The authenticators available to users must be configured in the resource rule regardless of the user preference.
5. In the **Authenticators** table, select whether users can view, add, edit, or remove an authenticator. When options other than view only are selected, users see a menu button next to the authenticator to allow them to manage it based on the permissions given to them.
   - If an authenticator is required for password reset or another recovery flow, review whether users can remove it.
   - User Portal self-service does not provide general self-unlock for locked authenticators. Password reset can unlock password-related lockout when **Unlock User Account** is enabled in the password reset settings.
6. Click **Save**.