KB-2430 Multi-Factor Authentication (MFA) Default Enablement FAQ
Purpose
The purpose of this article is to provide answers to common questions to Multi-Factor Authentication (MFA) initiative enforcement in Appian.
How does MFA work?
Multi-Factor Authentication (MFA) is a security method that requires users to provide two or more distinct pieces of evidence to verify their identity before gaining access to an account or system.
Appian requires MFA for users that sign in with Appian authentication. This adds an extra layer of security to the sign-in process since users must provide their Appian username and password, and a custom verification code. Please refer to the documentation for additional information
Is MFA mandatory for all users?
Yes, MFA is a mandatory requirement for all production sites. The deadline for compliance is November 30, 2026, with enforcement beginning on December 1, 2026. While currently only recommended for lower/non-production environments, it is highly encouraged.
Which users are impacted by Default MFA?
Any user authenticating via an Appian-native login will be required to use MFA. Users are not impacted if they fall into the following categories:
- Members of the Service Accounts group.
- Users authenticating via SSO (SAML, OIDC, LDAP, PIEE, etc.), as these rely on your organization's own Identity Provider (IdP) for MFA.
Do external users need MFA too?
Yes. If external users authenticate natively with Appian, they are subject to the same Default MFA requirement. If they authenticate via SSO, they are already considered compliant. You may choose to migrate external users to SSO as an alternative to native MFA.
What are my options for enabling MFA?
There are two paths to enable MFA:
- Self-service: Configure a group in the Admin Console requiring MFA for specific accounts. This provides granular control and does not require a maintenance window.
- Default MFA (Appian-enabled): Appian applies a global setting enforcing MFA for all native users (excluding Service Accounts/SSO). This requires customer confirmation of prerequisites and typically involves a maintenance window (though it can be deployed with zero downtime).
What authentication methods are available to customers?
Users can select their preferred verification method when they sign in.
Can customers skip the Authenticator app?
By default, basic users must complete authenticator app enrollment before they can access the application. When multi-factor authentication (MFA) is enabled and Authenticator App is selected, you can enable the Allow users to skip authenticator app setup setting.
What are the prerequisites for enabling Default MFA?
Before Appian can enable Default MFA, you must confirm that:
- Customers on Appian Version 26.1 or later
- All native users have a valid email address associated with their account.
- Outbound email is enabled on the site.(Both are required to ensure users receive the necessary communications to avoid lockouts during MFA enrollment.)
Can Default MFA be enabled in DEV / TEST before PROD?
Yes. Appian can enable Default MFA in a lower environment first, allowing you to validate the experience before applying it to your PROD environment.
Once Default MFA is enabled, can it be turned off or can specific users opt out?
No. Once enabled globally, the "Enable multi-factor authentication" setting in the Admin Console cannot be unchecked. There is no way to selectively exempt standard native accounts (exceptions apply only to the Service Accounts group and SSO users).
What happens to users without a smartphone, lacking a valid email, or with duplicate accounts?
All native users will be redirected to the MFA enrollment page upon their next login. Login cannot proceed without completing the enrollment and verification process. There is no system bypass for users lacking a compatible device or a valid email address
Does this affect WebAPI / REST API integrations using basic authentication?
Yes. While default MFA primarily targets native Appian web and application logins, enabling the global MFA requirement will cause any inbound Web API calls using basic authentication (username and password) to fail. To ensure uninterrupted service and maintain compliance, all integrations must be transitioned to a secure, modern authentication method (such as API Keys or OAuth 2.0) before MFA is enforced.
What if an administrator or break-glass account gets locked out after enabling MFA?
If a critical account is locked out, please open a support case. Appian Support is available to assist in troubleshooting and resolving lockouts following an MFA enforcement event.
Can an account used for system or background processing have MFA disabled?
Yes, but they must be configured correctly. We recommend that system or background processing accounts be added to the Service Accounts group. This exempts them from the native MFA requirement and prevents automated integrations from breaking.
How do we reset a user's Authenticator App (e.g., in the event of a lost or replaced device)?
System Administrators can assist users with resetting or reconfiguring their MFA settings via the Admin Console. For detailed step-by-step instructions, please refer to the Appian Documentation or open a support case for further assistance
If the site is configured for MFA, is there anything else to do?
Appian needs to apply a custom property change to each production site in order to confirm the compliance of the site. Please liaise via the support case to have this applied.
What if you are currently engaged in a review process?
Please continue communicating through your existing Support Case for any updates or questions.
Is there a way of checking user login methods?
Yes, there is a specific package you can install to track this information. If you would like to deploy this in your environment, please request it in the Support Case you already have open for MFA enforcement. Once requested, we will provide the package along with the necessary prerequisites and installation steps.
Affected Versions
This article applies to Appian 26.1 and later.
Last Reviewed: November 2026