Multi-Factor Authentication

1. Download one of these authenticator applications to your mobile phone:

   • Google Authentication

   • Microsoft Authenticator

   • Authy

2. In the Check Point Portal, click your user avatar in the upper-right corner and select Profile Settings.

3. Select Sign-in Options.

4. In the Multi-Factor Authentication section, click Configure.

5. In the Secure your account window, select your country from the list.

6. Toggle the Enforce Multi-Factor Authentication switch to ON.

   The Enforce Multi-Factor Authentication configuration wizard opens.

7. Follow the on-screen instructions to connect the authentication app to the Check Point Portal.

   Note - If you did not verify your phone number in the Profile Settings window, you must verify it in the Multi-Factor Authentication configuration wizard.

8. If you want to require yourself to use MFA for all Check Point Portal accounts, keep the toggle on. If you want to use MFA only when a Primary Administrator of an account requires it, switch the toggle off.

9. Click Finish to close the wizard.

1. In the Check Point Portal, click your user avatar and select Profile Settings.

2. Select Sign-in Options.

3. In the Multi-Factor Authentication section, click Configure. The first MFA method is with an authenticator app. If this method is configured, you can verify your phone number as a second method.

4. In the Secure your account window, select your country from the list.

5. Enter your mobile phone number.

6. Click Send code.

   Check Point sends an SMS to your phone with a six-digit code.

7. Enter the code in the Code field.

8. Click Verify code.

To configure a passkey, see Configuring a Passkey

If your organization uses SSO authentication and does not enable MFA as part of it, you can require yourself to use MFA every time you log in to the Check Point Portal. This is valid even when the Primary Administrator of the Check Point Portal account does not require MFA.

Use Case: A security administrator works for a Check Point MSSP to manage child accounts. One of the MSSP's customers does not require its own security administrators to use MFA. The MSSP's corporate policy requires MFA for all Check Point Portal logins.

Configuring Multi-Factor Authentication on your account:

1. Download one of these authenticator applications to your mobile device:

   • Google Authenticator

   • Microsoft Authenticator

   • Authy

2. In the Check Point Portal, click your user avatar in the upper right.

3. Select Profile Settings > Sign-in Options.

4. In the Multi-Factor Authentication (MFA) section, click Configure.

5. In the Secure your account window, scan the displayed QR code with your mobile device. The authenticator app displays a verification code for 30 seconds.

6. Enter the code in the Code field.

7. Click Continue.

MFA is configured successfully.

In the Check Point Portal, click > Users.

The 2FA configured column of the table shows one of these Multi-Factor Authentication configurations for each user:

The MFA table row shows you the MFA authentication method(s) that the user configured for themselves in Profile Settings. This table row is not related to the MFA enforcement policy for the account.

Reset a user's phone number in these scenarios:

• The user gets a new phone with a new number.

• The user's phone is lost or stolen.

• The user has a problem using MFA with SMS.

To reset the user phone number:

1. In the Check Point Portal, click > Users.

2. Click the table row with the name of the user.

3. Click Edit.

   The Edit User window opens.

4. In the Phone number field, enter a phone number for the user.

5. Click Save.

Reset an authentication app for a user when the user gets a new phone (with the same phone number) or has a problem with the app.

After the reset, if MFA is required for account login, Check Point sends an SMS with an authentication code to the user's verified phone number. Then, the user can log in to the Check Point Portal and create a new authenticator app configuration (see Configure an authentication app for MFA).

To reset an MFA application:

1. In the Check Point Portal, click > Users.

   The 2FA configured column of the table shows one of these Multi-Factor Authentication configurations for each user:

   Icon	MFA Configuration
   No icon	The user does not have MFA configured.
   By app	The user has MFA configured with an authenticator app.
   By phone	The user has MFA configured with SMS.
   App and phone	The user has MFA configured with an authenticator app and with SMS.

2. Select a user from the table and click Reset MFA.

3. To see updated user information, click Refresh.

MFA enforcement settings on the Identity & Access page apply to all users of this Check Point Portal account. Only a Primary Administrator can change these settings.

1. In the Check Point Portal, click > Identity & Access.

2. In the Multi-Factor Authentication (MFA) to the Check Point Portal section, select when to enforce MFA:

   • Enforce MFA for all logins, including SSO - Users must use MFA to log in with username and password and for login with SSO through an Identity Provider.

   • Enforce MFA for login with username and password - This option is selected by default.

   A confirmation window opens.

3. In the confirmation window, click Enforce.

A Primary Administrator can allow Check Point Portal users to bypass the MFA verification for 14 days after they successfully sign in to the Check Point Portal with a trusted device.

1. In the Check Point Portal, click > Identity & Access.

2. In the Multi-Factor Authentication (MFA) to the Check Point Portal section, select Allow trusted devices to skip MFA for 14 days.

When users enter their verification code on their login to the Check Point Portal, they can select the option Remember this device for 14 days.