You cannot find and delete inactive MFA TOTP devices from the console, but you can use OCI CLI commands with Cloud Shell to find them and delete them.Īn inactive MFA TOTP device can happen when MFA is enabled for a user, and the user has clicked Enable Multi-Factor Authentication, but then has failed to authenticate the device. The authenticator app on your registered mobile device generates the TOTP that you need to enter every time you sign in to Oracle Cloud Infrastructure.

TIME-BASED ONE-TIME PASSWORD (TOTP) A TOTP is a password (or passcode) that is generated by an algorithm that computes a one-time password from a shared secret key and the current time, as defined in RFC 6238. If the registered mobile device becomes unavailable, an administrator must disable MFA for the user so that MFA can be re-enabled with a new device. This same device must be used to generate the time-based one-time passcode every time the user signs in. The procedure to enable MFA for a user includes the registration of the mobile device. REGISTERED MOBILE DEVICE Multi-factor authentication is enabled for a specific user and for a specific device.

You'll use the app to register your device and then you'll use the same app (on the same device) to generate a time-based one-time passcode every time you sign in. To enable MFA for the IAM service, you'll need a device with an authenticator app installed. Examples of authenticator apps are Oracle Mobile Authenticator and Google Authenticator. AUTHENTICATOR APP An app you install on your mobile device that can provide software-based secure tokens for identity verification. Examples of authentication factors are a password (something you know) and a device (something you have). MULTI-FACTOR AUTHENTICATION (MFA) Multi-factor authentication (MFA) is a method of authentication that requires the use of more than one factor to verify a user’s identity. Here's a list of the basic concepts you need to be familiar with.

Set up multi factor authentication