A 'quick' question from a newbie about: Per-application MFA enforcement

[j-wit]

Hi everyone,

I'm new to authentik and currently trying to migrate over from Authelia. First off, a huge thank you to all the developers and contributors - authentik is truly a fantastic piece of software!

Overall, I've been very happy with Authelia, but having a proper web UI to manage users without needing to SSH into the server to edit config files is a massive quality-of-life improvement.

Environment & Setup

The initial system setup went smoothly without issues:

• Dedicated Ubuntu Server
• Native NGINX reverse proxy
• authentik deployed via Docker
• Additional websites running in Docker containers
• authentik version: 2026.8.5

---

The Problem / Use Case

I stumbled across an issue regarding per-application MFA requirements:

• User_A should access sso.my-domain.com (authentik's admin/user interface) with 2FA.
• User_A should access project1.my-domain.com without 2FA.

Observed behavior:
When User_A accesses project1.my-domain.com and signs in without 2FA, their session is automatically authenticated across the board. If they then navigate to sso.my-domain.com, they are already logged in without ever being prompted for a 2FA code.

I tried using an AI-suggested custom policy named require-mfa-session bound to the default-authentication-flow:

# Check if a second factor was already used in the current session
return not request.user.has_usable_mfa_devices() or not request.http_request.session.get('authentik_mfa_authenticated', False)

Unfortunately, this did not work as expected.

Question

• What is the recommended way in authentik to enforce MFA strictly for specific applications (like the Authentik Admin interface) while allowing 1FA-only access to others?

Thanks in advance for any insights!

[benitoalba]

Hi @j-wit! The login to project1 creates an authentik session that the authentik UI can reuse. A policy on default-authentication-flow only applies when that flow runs, it doesn't add an MFA check when an existing session opens the UI.

For applications behind a provider, put the extra MFA check in that provider's authorization flow. Add an Authenticator Validation stage, with Not configured action set to Deny or Configure if MFA is required. Skip would let users without a compatible authenticator continue.

The built-in authentik UI is a separate case. In 2026.8.5, /if/admin/ is served directly, rather than through an application's provider authorization flow. So that per-provider recipe doesn't cover your admin-interface requirement.

With this shared-session setup, keep MFA mandatory on every authentication path available to the admin account. If project1 must allow password-only login, a separate non-admin account for it avoids creating a password-only session for your admin identity. That changes your same-account requirement, changing the default authentication-flow policy alone doesn't enforce the split you described.