Configure authenticator policies

Configure which authenticators users can view and manage in the User Portal, including authenticator preference controls.

User Portal authenticator management can help users keep recovery authenticators current before they need account recovery. For planning guidance, see Account recovery and authenticator readiness.

Configure the authenticators users can see and manage in the User Portal

1. Click > Policies > User Portal. The User Portal page appears.
2. Click Authenticators. The Authenticators page appears.
3. Select Allow users to view their Authenticators to allow users to access the Authenticators tab and see their authenticators.
4. Select Allow users to manage authenticator preferences. When enabled, users can change the order of the second-factor authenticators presented to them at login. The authenticators available to users must be configured in the resource rule regardless of the user preference.
5. In the Authenticators table, select whether users can view, add, edit, or remove an authenticator. When options other than view only are selected, users see a menu button next to the authenticator to allow them to manage it based on the permissions given to them.
   • If an authenticator is required for password reset or another recovery flow, review whether users can remove it.
   • User Portal self-service does not provide general self-unlock for locked authenticators. Password reset can unlock password-related lockout when Unlock User Account is enabled in the password reset settings.
6. Click Save.