Skip to main content

​
MFA recovery

If a user can no longer satisfy their MFA requirements (e.g., they lose access to their passkey or phone number), they will be unable to perform any activities that trigger that MFA policy. There is no way to bypass MFA once it is enforced. Most applications that support MFA offer a recovery path through customer support (e.g., “contact support to reset your 2FA”). Turnkey cannot do this because Turnkey has no write access to your organizations. Only authenticators within the organization can modify its state. By default, there is no MFA recovery mechanism. If your security posture allows it and you want to protect against users locking themselves out, you can set one up using delegated access users that have permission to delete MFA policies on behalf of locked-out users. The delegated access user’s policy should be scoped to only allow MFA policy deletion:
With this setup, when a user is locked out, you can verify their identity through your own process and then delete the MFA policy using the DA user to restore access.

​
Quorum-based recovery

A single DA user with the ability to delete MFA policies is a single point of failure. If that DA user’s API key is compromised, an attacker could remove a user’s MFA protections entirely. To prevent this, you can set up multiple delegated access users for MFA recovery with a consensus policy requiring multiple approvals before an MFA policy can be deleted. This way, no single party can unilaterally remove a user’s MFA.
We recommend having more DA users than required approvals (e.g., 3-4 DA users requiring 2 approvals). If you require all DA users to approve and one loses access, recovery is permanently blocked.
To set this up:
  1. Create multiple delegated access users in the sub-organization, each with an API key controlled by different parties in the parent organization.
  2. Create a policy scoped to MFA policy deletion with a consensus requirement:
With this configuration, deleting an MFA policy requires at least two delegated access users to approve the DeleteMfaPolicy activity. Even if one DA user’s key is compromised, the attacker cannot remove MFA protections alone. And if one DA user loses access, the remaining users can still reach the approval threshold.