Configure MFA for PAM checkout in Devolutions Server

Administrators can enforce multifactor authentication globally, configure it per user, or require it specifically when a privileged entry is checked out.

Before you begin, configure multifactor authenticators in Administration – Server settings – Multi-factor. Make sure the users you want to protect have an MFA method configured, either individually by editing a user in Administration – Users and going to the Multi-factor section, or enforced globally through Administration – Server settings – Conditional access policies by setting the MFA target to:

• MFA Required: MFA is enforced for all users. A default MFA type is set for all users.
• MFA Skipped: MFA is not enforced.
• MFA Optional per User: MFA is enforced on an individual basis. The administrator chooses who uses MFA and what product or technology they use. Choose this option if not all users are set up for MFA authentication.

When MFA usage is set to MFA Optional per User , the MFA method must be configured in Administration – Users for each user. Edit or add a user, then go to the Multi-factor section to configure it. You can also set an MFA type on the user if they are using a product different than the default method. See Multifactor (Edit User).

MFA on PAM checkout

The currently supported multifactor authenticators for PAM checkout are Authenticator (TOTP), Email, and SMS. When the user signs in, they will be prompted to configure their MFA.

MFA can be required on privileged accounts either directly on the entry, or through a checkout policy assigned to it. In both cases, the MFA on checkout setting can be set to Default, None, Mandatory, or Mandatory on JIT elevation only.

MFA enforced at login through an external identity provider (Entra ID, PingOne, Okta, etc.) does not automatically satisfy the MFA on checkout requirement. These are two separate verifications.

Even if MFA is already enforced at login, the user still needs an MFA method configured for MFA on checkout to work. This method does not need to be enforced at login, only available for use at checkout.

1. Edit a PAM entry and go to Checkout policy.
2. Set Source to Default to apply the Default checkout policy, or to Custom to define one specifically for this entry.
3. When Source is set to Custom, either configure the checkout policy settings manually on the entry, or select an already created checkout policy from the list.
4. Make sure the MFA on checkout setting is set to Default, None, Mandatory, or Mandatory on JIT elevation only, depending on when MFA should be enforced in your checkout policy.
5. Select Update to save. The requirement applies the next time the entry is checked out.

See also

• MFA on PAM Checkout: Prove it's really you before checking out a privileged account