> For the complete documentation index, see [llms.txt](https://docs.devolutions.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devolutions.net/server/knowledge-base/how-to-articles/configure-mfa-for-pam-checkout-in-devolutions-server.md).

# Configure MFA for PAM checkout in Devolutions Server

Administrators can enforce multifactor authentication globally, configure it per user, or require it specifically when a privileged entry is checked out.

Before you begin, configure multifactor authenticators in ***Administration – Server settings – Multi-factor***. Make sure the users you want to protect have an MFA method configured, either individually by editing a user in ***Administration – Users*** and going to the ***Multi-factor*** section, or enforced globally through ***Administration – Server settings – Conditional access policies*** by setting the MFA target to:

* ***MFA Required***: MFA is enforced for all users. A default MFA type is set for all users.
* ***MFA Skipped***: MFA is not enforced.
* ***MFA Optional per User***: MFA is enforced on an individual basis. The administrator chooses who uses MFA and what product or technology they use. Choose this option if not all users are set up for MFA authentication.

{% hint style="info" %}
When ***MFA usage*** is set to ***MFA Optional per User*** , the MFA method must be configured in ***Administration – Users*** for each user. Edit or add a user, then go to the ***Multi-factor*** section to configure it. You can also set an MFA type on the user if they are using a product different than the default method. See [Multifactor (Edit User)](https://docs.devolutions.net/server/web-interface/administration/user-and-security-management/users/multifactor).
{% endhint %}

#### MFA on PAM checkout

The currently supported multifactor authenticators for PAM checkout are ***Authenticator (TOTP)***, ***Email***, and ***SMS***.  When the user signs in, they will be prompted to configure their MFA.

MFA can be required on privileged accounts either directly on the entry, or through a checkout policy assigned to it. In both cases, the ***MFA on checkout*** setting can be set to ***Default***, ***None***, ***Mandatory***, or ***Mandatory on JIT elevation only***.

{% hint style="warning" %}
MFA enforced at login through an external identity provider (Entra ID, PingOne, Okta, etc.) does not automatically satisfy the MFA on checkout requirement. These are two separate verifications.

Even if MFA is already enforced at login, the user still needs an MFA method configured for MFA on checkout to work. This method does not need to be enforced at login, only available for use at checkout.
{% endhint %}

1. Edit a PAM entry and go to ***Checkout policy***.
2. Set ***Source*** to ***Default*** to apply the Default checkout policy, or to ***Custom*** to define one specifically for this entry.
3. When ***Source*** is set to ***Custom***, either configure the checkout policy settings manually on the entry, or select an already [created checkout policy](https://docs.devolutions.net/server/web-interface/administration/modules/privileged-access/checkout-policies) from the list.
4. Make sure the ***MFA on checkout*** setting is set to ***Default***, ***None***, ***Mandatory***, or ***Mandatory on JIT elevation only***, depending on when MFA should be enforced in your checkout policy.
5. Select ***Update*** to save. The requirement applies the next time the entry is checked out.

#### See also

* [MFA on PAM Checkout: Prove it's really you before checking out a privileged account](https://www.youtube.com/watch?v=aWcV1HwJxTY)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.devolutions.net/server/knowledge-base/how-to-articles/configure-mfa-for-pam-checkout-in-devolutions-server.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.