Multi-factor authentication settings - Port Swigger
Summary: PortSwigger's documentation describes how Burp Suite DAST administrators can enable TOTP-based multi-factor authentication for all users, requiring each user to scan a QR code and enter a 6-digit code from an authenticator app before logging in. The setup generates one-time backup codes, and the documentation warns that a primary administrator who loses access to their authenticator app cannot access the account without those codes.
Key Takeaway: The documentation states plainly that without stored backup codes, a primary administrator locked out of their authenticator app cannot access the account at all - a single lost phone becomes an instance-wide lockout.
Read the original at PortSwigger Research ↗
- Topics
- Identity & Access Management
- Related
- FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’ Cyber Risks · Nov 13, 2026Connect Wise Cloud Backup application abused in cross-tenant token sweep Cyber Risks · Oct 19, 2026Sponsored: Specter Ops on the impact of AI agents on Blood Hound Cyber Risks · Sep 20, 2026