diff --git a/TwoFactorAuth/Api/CountryRepositoryInterface.php b/TwoFactorAuth/Api/CountryRepositoryInterface.php
new file mode 100644
index 00000000..6a12aca6
--- /dev/null
+++ b/TwoFactorAuth/Api/CountryRepositoryInterface.php
@@ -0,0 +1,55 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Api;
+
+use Magento\Framework\Api\SearchCriteriaInterface;
+use Magento\Framework\Api\SearchResultsInterface;
+use Magento\TwoFactorAuth\Api\Data\CountryInterface;
+use Magento\TwoFactorAuth\Api\Data\CountrySearchResultsInterface;
+
+/**
+ * Countries repository
+ * @SuppressWarnings(PHPMD.ShortVariable)
+ */
+interface CountryRepositoryInterface
+{
+    /**
+     * Save object
+     * @param CountryInterface $object
+     * @return CountryInterface
+     */
+    public function save(CountryInterface $object): CountryInterface;
+
+    /**
+     * Get object by id
+     * @param int $id
+     * @return CountryInterface
+     */
+    public function getById(int $id): CountryInterface;
+
+    /**
+     * Get by Code value
+     * @param string $value
+     * @return CountryInterface
+     */
+    public function getByCode(string $value): CountryInterface;
+
+    /**
+     * Delete object
+     * @param CountryInterface $object
+     * @return void
+     */
+    public function delete(CountryInterface $object): void;
+
+    /**
+     * Get a list of object
+     * @param SearchCriteriaInterface $searchCriteria
+     * @return CountrySearchResultsInterface
+     */
+    public function getList(SearchCriteriaInterface $searchCriteria): SearchResultsInterface;
+}
diff --git a/TwoFactorAuth/Api/Data/CountryInterface.php b/TwoFactorAuth/Api/Data/CountryInterface.php
new file mode 100644
index 00000000..a3744cdd
--- /dev/null
+++ b/TwoFactorAuth/Api/Data/CountryInterface.php
@@ -0,0 +1,101 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Api\Data;
+
+use Magento\Framework\Api\ExtensibleDataInterface;
+
+/**
+ * Country entity interface
+ */
+interface CountryInterface extends ExtensibleDataInterface
+{
+    /**
+     * ID field name
+     */
+    public const ID = 'country_id';
+
+    /**
+     * Code field name
+     */
+    public const CODE = 'code';
+
+    /**
+     * Country name field name
+     */
+    public const NAME = 'name';
+
+    /**
+     * Dial code field name
+     */
+    public const DIAL_CODE = 'dial_code';
+
+    /**
+     * Get value for tfa_country_codes_id
+     * @return int
+     */
+    public function getId(): int;
+
+    /**
+     * Set value for country_id
+     * @param int $value
+     */
+    public function setId(int $value): void;
+
+    /**
+     * Get value for code
+     * @return string
+     */
+    public function getCode(): string;
+
+    /**
+     * Set value for code
+     * @param string $value
+     */
+    public function setCode(string $value): void;
+
+    /**
+     * Get value for name
+     * @return string
+     */
+    public function getName(): string;
+
+    /**
+     * Set value for name
+     * @param string $value
+     */
+    public function setName(string $value): void;
+
+    /**
+     * Get value for dial_code
+     * @return string
+     */
+    public function getDialCode(): string;
+
+    /**
+     * Set value for dial_code
+     * @param string $value
+     */
+    public function setDialCode(string $value): void;
+
+    /**
+     * Retrieve existing extension attributes object or create a new one
+     *
+     * Used fully qualified namespaces in annotations for proper work of extension interface/class code generation
+     *
+     * @return \Magento\TwoFactorAuth\Api\Data\CountryExtensionInterface|null
+     */
+    public function getExtensionAttributes(): ?CountryExtensionInterface;
+
+    /**
+     * Set an extension attributes object
+     * @param \Magento\TwoFactorAuth\Api\Data\CountryExtensionInterface $extensionAttributes
+     */
+    public function setExtensionAttributes(
+        CountryExtensionInterface $extensionAttributes
+    ): void;
+}
diff --git a/TwoFactorAuth/Api/Data/CountrySearchResultsInterface.php b/TwoFactorAuth/Api/Data/CountrySearchResultsInterface.php
new file mode 100644
index 00000000..92cb0b59
--- /dev/null
+++ b/TwoFactorAuth/Api/Data/CountrySearchResultsInterface.php
@@ -0,0 +1,29 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Api\Data;
+
+use Magento\Framework\Api\SearchResultsInterface;
+
+/**
+ * Country search results interface
+ */
+interface CountrySearchResultsInterface extends SearchResultsInterface
+{
+    /**
+     * Get an array of objects
+     * @return CountryInterface[]
+     */
+    public function getItems(): array;
+
+    /**
+     * Set objects list
+     * @param CountryInterface[] $items
+     * @return CountrySearchResultsInterface
+     */
+    public function setItems(array $items): CountrySearchResultsInterface;
+}
diff --git a/TwoFactorAuth/Api/Data/UserConfigInterface.php b/TwoFactorAuth/Api/Data/UserConfigInterface.php
new file mode 100644
index 00000000..36235c1e
--- /dev/null
+++ b/TwoFactorAuth/Api/Data/UserConfigInterface.php
@@ -0,0 +1,99 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Api\Data;
+
+use Magento\Framework\Api\ExtensibleDataInterface;
+
+/**
+ * User configuration interface
+ */
+interface UserConfigInterface extends ExtensibleDataInterface
+{
+    /**
+     * Entity ID field name
+     */
+    public const ID = 'config_id';
+
+    /**
+     * User ID field name
+     */
+    public const USER_ID = 'user_id';
+
+    /**
+     * Encoded providers filed name
+     */
+    public const ENCODED_PROVIDERS = 'encoded_providers';
+
+    /**
+     * Selected default provider field name
+     */
+    public const DEFAULT_PROVIDER = 'default_provider';
+
+    /**
+     * Get value for config_id
+     * @return int
+     */
+    public function getId(): int;
+
+    /**
+     * Set value for config_id
+     * @param int $value
+     */
+    public function setId(int $value): void;
+
+    /**
+     * Get value for user_id
+     * @return int
+     */
+    public function getUserId(): int;
+
+    /**
+     * Set value for user_id
+     * @param int $value
+     */
+    public function setUserId(int $value): void;
+
+    /**
+     * Get value for encoded_providers
+     * @return string
+     */
+    public function getEncodedProviders(): string;
+
+    /**
+     * Set value for encoded_providers
+     * @param string $value
+     */
+    public function setEncodedProviders(string $value): void;
+
+    /**
+     * Get value for default_provider
+     * @return string
+     */
+    public function getDefaultProvider(): string;
+
+    /**
+     * Set value for default_provider
+     * @param string $value
+     */
+    public function setDefaultProvider(string $value): void;
+
+    /**
+     * Retrieve existing extension attributes object or create a new one
+     *
+     * Used fully qualified namespaces in annotations for proper work of extension interface/class code generation
+     *
+     * @return \Magento\TwoFactorAuth\Api\Data\UserConfigExtensionInterface|null
+     */
+    public function getExtensionAttributes(): ?UserConfigExtensionInterface;
+
+    /**
+     * Set an extension attributes object
+     * @param \Magento\TwoFactorAuth\Api\Data\UserConfigExtensionInterface $extensionAttributes
+     */
+    public function setExtensionAttributes(UserConfigExtensionInterface $extensionAttributes): void;
+}
diff --git a/TwoFactorAuth/Api/Data/UserConfigSearchResultsInterface.php b/TwoFactorAuth/Api/Data/UserConfigSearchResultsInterface.php
new file mode 100644
index 00000000..5385400a
--- /dev/null
+++ b/TwoFactorAuth/Api/Data/UserConfigSearchResultsInterface.php
@@ -0,0 +1,29 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Api\Data;
+
+use Magento\Framework\Api\SearchResultsInterface;
+
+/**
+ * User config search result
+ */
+interface UserConfigSearchResultsInterface extends SearchResultsInterface
+{
+    /**
+     * Get an array of objects
+     * @return UserConfigInterface[]
+     */
+    public function getItems(): array;
+
+    /**
+     * Set objects list
+     * @param UserConfigInterface[] $items
+     * @return UserConfigSearchResultsInterface
+     */
+    public function setItems(array $items): UserConfigSearchResultsInterface;
+}
diff --git a/TwoFactorAuth/Api/EngineInterface.php b/TwoFactorAuth/Api/EngineInterface.php
new file mode 100644
index 00000000..87fb5e8c
--- /dev/null
+++ b/TwoFactorAuth/Api/EngineInterface.php
@@ -0,0 +1,32 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Api;
+
+use Magento\Framework\DataObject;
+use Magento\User\Api\Data\UserInterface;
+
+/**
+ * 2FA engine interface
+ */
+interface EngineInterface
+{
+    /**
+     * Return true if this provider has been enabled by admin
+     *
+     * @return bool
+     */
+    public function isEnabled(): bool;
+
+    /**
+     * Return true on token validation
+     * @param UserInterface $user
+     * @param DataObject $request
+     * @return bool
+     */
+    public function verify(UserInterface $user, DataObject $request): bool;
+}
diff --git a/TwoFactorAuth/Api/Exception/NotificationExceptionInterface.php b/TwoFactorAuth/Api/Exception/NotificationExceptionInterface.php
new file mode 100644
index 00000000..86bfed07
--- /dev/null
+++ b/TwoFactorAuth/Api/Exception/NotificationExceptionInterface.php
@@ -0,0 +1,17 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Api\Exception;
+
+/**
+ * Occurs when failed to notify a user.
+ */
+interface NotificationExceptionInterface extends \Throwable
+{
+
+}
diff --git a/TwoFactorAuth/Api/ProviderInterface.php b/TwoFactorAuth/Api/ProviderInterface.php
new file mode 100644
index 00000000..f3d094b4
--- /dev/null
+++ b/TwoFactorAuth/Api/ProviderInterface.php
@@ -0,0 +1,95 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Api;
+
+/**
+ * 2FA proviced interface
+ */
+interface ProviderInterface
+{
+    /**
+     * Return true if this provider has been enabled by admin
+     *
+     * @return bool
+     */
+    public function isEnabled(): bool;
+
+    /**
+     * Get provider engine
+     * @return \Magento\TwoFactorAuth\Api\EngineInterface
+     */
+    public function getEngine();
+
+    /**
+     * Get provider code
+     * @return string
+     */
+    public function getCode(): string;
+
+    /**
+     * Get provider name
+     * @return string
+     */
+    public function getName(): string;
+
+    /**
+     * Get icon
+     * @return string
+     */
+    public function getIcon(): string;
+
+    /**
+     * Return true if this provider configuration can be reset
+     * @return bool
+     */
+    public function isResetAllowed(): bool;
+
+    /**
+     * Reset provider configuration
+     * @param int $userId
+     */
+    public function resetConfiguration(int $userId): void;
+
+    /**
+     * Return true if this provider has been configured
+     * @param int $userId
+     * @return bool
+     */
+    public function isConfigured(int $userId): bool;
+
+    /**
+     * Return true if current provider has been activated
+     * @param int $userId
+     * @return bool
+     */
+    public function isActive(int $userId): bool;
+
+    /**
+     * Activate provider
+     * @param int $userId
+     */
+    public function activate(int $userId): void;
+
+    /**
+     * Get configure action
+     * @return string
+     */
+    public function getConfigureAction(): string;
+
+    /**
+     * Get auth action
+     * @return string
+     */
+    public function getAuthAction(): string;
+
+    /**
+     * Get allowed extra actions
+     * @return string[]
+     */
+    public function getExtraActions(): array;
+}
diff --git a/TwoFactorAuth/Api/ProviderPoolInterface.php b/TwoFactorAuth/Api/ProviderPoolInterface.php
new file mode 100644
index 00000000..c9ac8bbf
--- /dev/null
+++ b/TwoFactorAuth/Api/ProviderPoolInterface.php
@@ -0,0 +1,30 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Api;
+
+use Magento\Framework\Exception\NoSuchEntityException;
+
+/**
+ * Providers pool
+ */
+interface ProviderPoolInterface
+{
+    /**
+     * Get a list of providers
+     * @return \Magento\TwoFactorAuth\Api\ProviderInterface[]
+     */
+    public function getProviders(): array;
+
+    /**
+     * Get provider by code
+     * @param string $code
+     * @return \Magento\TwoFactorAuth\Api\ProviderInterface
+     * @throws NoSuchEntityException
+     */
+    public function getProviderByCode(string $code): ProviderInterface;
+}
diff --git a/TwoFactorAuth/Api/TfaInterface.php b/TwoFactorAuth/Api/TfaInterface.php
new file mode 100644
index 00000000..7dd0fc75
--- /dev/null
+++ b/TwoFactorAuth/Api/TfaInterface.php
@@ -0,0 +1,119 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Api;
+
+/**
+ * 2FA configuration manager.
+ */
+interface TfaInterface
+{
+    /**
+     * Forced providers fields
+     */
+    public const XML_PATH_FORCED_PROVIDERS = 'twofactorauth/general/force_providers';
+
+    /**
+     * Return true if 2FA is enabled
+     *
+     * @return bool
+     */
+    public function isEnabled(): bool;
+
+    /**
+     * Get provider by code
+     * @param string $providerCode
+     * @param bool $onlyEnabled = true
+     * @return ProviderInterface|null
+     */
+    public function getProvider(string $providerCode, bool $onlyEnabled = true): ?ProviderInterface;
+
+    /**
+     * Retrieve forced providers list
+     * @return \Magento\TwoFactorAuth\Api\ProviderInterface[]
+     */
+    public function getForcedProviders(): array;
+
+    /**
+     * Get a user provider
+     * @param int $userId
+     * @return \Magento\TwoFactorAuth\Api\ProviderInterface[]
+     */
+    public function getUserProviders(int $userId): array;
+
+    /**
+     * Get a list of providers
+     * @return \Magento\TwoFactorAuth\Api\ProviderInterface[]
+     */
+    public function getAllProviders(): array;
+
+    /**
+     * Get a list of providers
+     * @param string $code
+     * @return \Magento\TwoFactorAuth\Api\ProviderInterface|null
+     */
+
+    public function getProviderByCode(string $code): ?ProviderInterface;
+
+    /**
+     * Get a list of providers
+     * @return \Magento\TwoFactorAuth\Api\ProviderInterface[]
+     */
+    public function getAllEnabledProviders(): array;
+
+    /**
+     * Get allowed URLs
+     * @return array
+     */
+    public function getAllowedUrls(): array;
+
+    /**
+     * Returns a list of providers to configure/enroll
+     * @param int $userId
+     * @return \Magento\TwoFactorAuth\Api\ProviderInterface[]
+     */
+    public function getProvidersToActivate(int $userId): array;
+
+    /**
+     * Return true if a provider is allowed for a given user
+     * @param int $userId
+     * @param string $providerCode
+     * @return bool
+     */
+    public function getProviderIsAllowed(int $userId, string $providerCode): bool;
+
+    /**
+     * Get default provider code
+     * @param int $userId
+     * @return string
+     */
+    public function getDefaultProviderCode(int $userId): string;
+
+    /**
+     * Set default provider code
+     * @param int $userId
+     * @param string $providerCode
+     * @return bool
+     */
+    public function setDefaultProviderCode(int $userId, string $providerCode): bool;
+
+    /**
+     * Set providers
+     * @param int $userId
+     * @param string $providersCodes
+     * @return bool
+     */
+    public function setProvidersCodes(int $userId, string $providersCodes): bool;
+
+    /**
+     * Reset default provider code
+     * @param int $userId
+     * @param string $providerCode
+     * @return bool
+     */
+    public function resetProviderConfig(int $userId, string $providerCode): bool;
+}
diff --git a/TwoFactorAuth/Api/TfaSessionInterface.php b/TwoFactorAuth/Api/TfaSessionInterface.php
new file mode 100644
index 00000000..89cc7318
--- /dev/null
+++ b/TwoFactorAuth/Api/TfaSessionInterface.php
@@ -0,0 +1,44 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Api;
+
+/**
+ * 2FA session interface
+ */
+interface TfaSessionInterface
+{
+    /**
+     * Passed 2FA key name
+     */
+    public const KEY_PASSED = '2fa_passed';
+
+    /**
+     * Set 2FA session as passed
+     */
+    public function grantAccess(): void;
+
+    /**
+     * Return true if 2FA session has been passed
+     * @return bool
+     */
+    public function isGranted(): bool;
+
+    /**
+     * Get the current configuration for skipped providers
+     *
+     * @return array
+     */
+    public function getSkippedProviderConfig(): array;
+
+    /**
+     * Set the configuration of skipped providers
+     *
+     * @param array $config
+     */
+    public function setSkippedProviderConfig(array $config): void;
+}
diff --git a/TwoFactorAuth/Api/UserConfigManagerInterface.php b/TwoFactorAuth/Api/UserConfigManagerInterface.php
new file mode 100644
index 00000000..789d6d02
--- /dev/null
+++ b/TwoFactorAuth/Api/UserConfigManagerInterface.php
@@ -0,0 +1,109 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Api;
+
+use Magento\Framework\Exception\NoSuchEntityException;
+
+/**
+ * User configuration manager
+ */
+interface UserConfigManagerInterface
+{
+    /**
+     * Active configuration key
+     */
+    public const ACTIVE_CONFIG_KEY = 'active';
+
+    /**
+     * Get a provider configuration for a given user
+     * @param int $userId
+     * @param string $providerCode
+     * @return array|null
+     * @throws NoSuchEntityException
+     */
+    public function getProviderConfig(int $userId, string $providerCode): ?array;
+
+    /**
+     * Set provider configuration
+     * @param int $userId
+     * @param string $providerCode
+     * @param array|null $config
+     * @return bool
+     * @throws NoSuchEntityException
+     */
+    public function setProviderConfig(int $userId, string $providerCode, ?array $config=null): bool;
+
+    /**
+     * Set provider configuration
+     * @param int $userId
+     * @param string $providerCode
+     * @param array|null $config
+     * @return bool
+     * @throws NoSuchEntityException
+     */
+    public function addProviderConfig(int $userId, string $providerCode, ?array $config=null): bool;
+
+    /**
+     * Reset provider configuration
+     * @param int $userId
+     * @param string $providerCode
+     * @return bool
+     * @throws NoSuchEntityException
+     */
+    public function resetProviderConfig(int $userId, string $providerCode): bool;
+
+    /**
+     * Set providers list for a given user
+     * @param int $userId
+     * @param string|array $providersCodes
+     * @return bool
+     * @throws NoSuchEntityException
+     */
+    public function setProvidersCodes(int $userId, $providersCodes): bool;
+
+    /**
+     * Set providers list for a given user
+     * @param int $userId
+     * @return string[]
+     */
+    public function getProvidersCodes(int $userId): array;
+
+    /**
+     * Activate a provider configuration
+     * @param int $userId
+     * @param string $providerCode
+     * @return bool
+     * @throws NoSuchEntityException
+     */
+    public function activateProviderConfiguration(int $userId, string $providerCode): bool;
+
+    /**
+     * Return true if a provider configuration has been activated
+     * @param int $userId
+     * @param string $providerCode
+     * @return bool
+     * @throws NoSuchEntityException
+     */
+    public function isProviderConfigurationActive(int $userId, string $providerCode): bool;
+
+    /**
+     * Set default provider
+     * @param int $userId
+     * @param string $providerCode
+     * @return bool
+     * @throws NoSuchEntityException
+     */
+    public function setDefaultProvider(int $userId, string $providerCode): bool;
+
+    /**
+     * get default provider
+     * @param int $userId
+     * @return string
+     */
+    public function getDefaultProvider(int $userId): string;
+}
diff --git a/TwoFactorAuth/Api/UserConfigRepositoryInterface.php b/TwoFactorAuth/Api/UserConfigRepositoryInterface.php
new file mode 100644
index 00000000..569b3078
--- /dev/null
+++ b/TwoFactorAuth/Api/UserConfigRepositoryInterface.php
@@ -0,0 +1,55 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Api;
+
+use Magento\Framework\Api\SearchCriteriaInterface;
+use Magento\Framework\Api\SearchResultsInterface;
+use Magento\TwoFactorAuth\Api\Data\UserConfigInterface;
+use Magento\TwoFactorAuth\Api\Data\UserConfigSearchResultsInterface;
+
+/**
+ * User configuration repository
+ * @SuppressWarnings(PHPMD.ShortVariable)
+ */
+interface UserConfigRepositoryInterface
+{
+    /**
+     * Save object
+     * @param UserConfigInterface $object
+     * @return UserConfigInterface
+     */
+    public function save(UserConfigInterface $object): UserConfigInterface;
+
+    /**
+     * Get object by id
+     * @param int $id
+     * @return UserConfigInterface
+     */
+    public function getById(int $id): UserConfigInterface;
+
+    /**
+     * Get by UserId value
+     * @param int $value
+     * @return UserConfigInterface
+     */
+    public function getByUserId(int $value): UserConfigInterface;
+
+    /**
+     * Delete object
+     * @param UserConfigInterface $object
+     * @return bool
+     */
+    public function delete(UserConfigInterface $object): bool;
+
+    /**
+     * Get a list of object
+     * @param SearchCriteriaInterface $searchCriteria
+     * @return UserConfigSearchResultsInterface
+     */
+    public function getList(SearchCriteriaInterface $searchCriteria): SearchResultsInterface;
+}
diff --git a/TwoFactorAuth/Api/UserConfigRequestManagerInterface.php b/TwoFactorAuth/Api/UserConfigRequestManagerInterface.php
new file mode 100644
index 00000000..b81bada1
--- /dev/null
+++ b/TwoFactorAuth/Api/UserConfigRequestManagerInterface.php
@@ -0,0 +1,37 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Api;
+
+use Magento\Framework\Exception\AuthorizationException;
+use Magento\User\Model\User;
+use Magento\TwoFactorAuth\Api\Exception\NotificationExceptionInterface;
+
+/**
+ * Manages configuration requests for users.
+ */
+interface UserConfigRequestManagerInterface
+{
+    /**
+     * Is user required to configure 2FA?
+     *
+     * @param int $userId
+     * @return bool
+     */
+    public function isConfigurationRequiredFor(int $userId): bool;
+
+    /**
+     * Request configurations from the user.
+     *
+     * @param User $user
+     * @return void
+     * @throws AuthorizationException When user is not allowed to configure 2FA.
+     * @throws NotificationExceptionInterface When failed to send the message.
+     */
+    public function sendConfigRequestTo(User $user): void;
+}
diff --git a/TwoFactorAuth/Api/UserConfigTokenManagerInterface.php b/TwoFactorAuth/Api/UserConfigTokenManagerInterface.php
new file mode 100644
index 00000000..b5d9662d
--- /dev/null
+++ b/TwoFactorAuth/Api/UserConfigTokenManagerInterface.php
@@ -0,0 +1,32 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Api;
+
+/**
+ * Manages tokens issued to users to authorize them to configure 2FA.
+ */
+interface UserConfigTokenManagerInterface
+{
+    /**
+     * Issue token for the user.
+     *
+     * @param int $userId
+     * @return string
+     */
+    public function issueFor(int $userId): string;
+
+    /**
+     * Is given token valid for given user?
+     *
+     * @param int $userId
+     * @param string $token
+     * @return bool
+     */
+    public function isValidFor(int $userId, string $token): bool;
+}
diff --git a/TwoFactorAuth/Api/UserNotifierInterface.php b/TwoFactorAuth/Api/UserNotifierInterface.php
new file mode 100644
index 00000000..6ba67f45
--- /dev/null
+++ b/TwoFactorAuth/Api/UserNotifierInterface.php
@@ -0,0 +1,38 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Api;
+
+use Magento\User\Model\User;
+use Magento\TwoFactorAuth\Api\Exception\NotificationExceptionInterface;
+
+/**
+ * Sends notifications to users regarding 2FA.
+ */
+interface UserNotifierInterface
+{
+    /**
+     * Send message allowing an admin user to configure personal 2FA.
+     *
+     * @param User $user
+     * @param string $token Token that will allow not fully authenticated user to edit configurations.
+     * @return void
+     * @throws NotificationExceptionInterface
+     */
+    public function sendUserConfigRequestMessage(User $user, string $token): void;
+
+    /**
+     * Send message requesting 2FA for the whole application to be configured.
+     *
+     * @param User $user
+     * @param string $token Token that will allow not fully authenticated user to edit configurations.
+     * @return void
+     * @throws NotificationExceptionInterface
+     */
+    public function sendAppConfigRequestMessage(User $user, string $token): void;
+}
diff --git a/TwoFactorAuth/Block/Adminhtml/System/Config/Providers.php b/TwoFactorAuth/Block/Adminhtml/System/Config/Providers.php
new file mode 100644
index 00000000..caa0d6ac
--- /dev/null
+++ b/TwoFactorAuth/Block/Adminhtml/System/Config/Providers.php
@@ -0,0 +1,81 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+namespace Magento\TwoFactorAuth\Block\Adminhtml\System\Config;
+
+use Magento\Config\Block\System\Config\Form\Field;
+use Magento\Framework\Data\Form\Element\AbstractElement;
+use Magento\Backend\Block\Template\Context;
+use Magento\Framework\Phrase;
+use Magento\Framework\Serialize\Serializer\Json;
+
+/**
+ * Displays a warning modal if the all currently available providers are deselected
+ */
+class Providers extends Field
+{
+    /**
+     * @var Json
+     */
+    private $json;
+
+    /**
+     * @param Context $context
+     * @param Json $json
+     * @param array $data
+     */
+    public function __construct(
+        Context $context,
+        Json $json,
+        array $data = []
+    ) {
+        parent::__construct($context, $data);
+        $this->json = $json;
+    }
+
+    /**
+     * @inheritdoc
+     */
+    protected function _getElementHtml(AbstractElement $element)
+    {
+        $html = parent::_getElementHtml($element);
+        $config = [
+            '#twofactorauth_general_force_providers' => [
+                'Magento_TwoFactorAuth/js/system/config/providers' => [
+                    'modalTitleText' => $this->getModalTitleText(),
+                    'modalContentBody' => $this->getModalContentBody()
+                ]
+            ]
+        ];
+        $html .= '<script type="text/x-magento-init">' . $this->json->serialize($config) . '</script>';
+
+        return $html;
+    }
+
+    /**
+     * Get text for the modal title heading when user switches to disable
+     *
+     * @return Phrase
+     */
+    private function getModalTitleText() : Phrase
+    {
+        return __('Are you sure you want to disable all currently active providers?');
+    }
+
+    /**
+     * Get HTML for the modal content body when user switches to disable
+     *
+     * @return string
+     */
+    private function getModalContentBody(): string
+    {
+        $templateFileName = $this->getTemplateFile(
+            'Magento_TwoFactorAuth::system/config/providers/modal_content_body.phtml'
+        );
+
+        return $this->fetchView($templateFileName);
+    }
+}
diff --git a/TwoFactorAuth/Block/ChangeProvider.php b/TwoFactorAuth/Block/ChangeProvider.php
new file mode 100644
index 00000000..e7c9a7c7
--- /dev/null
+++ b/TwoFactorAuth/Block/ChangeProvider.php
@@ -0,0 +1,115 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Block;
+
+use Magento\Authorization\Model\UserContextInterface;
+use Magento\Backend\Block\Template;
+use Magento\Backend\Model\Auth\Session;
+use Magento\TwoFactorAuth\Api\TfaInterface;
+use Magento\TwoFactorAuth\Api\ProviderInterface;
+
+/**
+ * @api
+ */
+class ChangeProvider extends Template
+{
+    /**
+     * @var TfaInterface
+     */
+    private $tfa;
+
+    /**
+     * @var UserContextInterface
+     */
+    private $userContext;
+
+    /**
+     * @var Session
+     */
+    private $session;
+
+    /**
+     * ChangeProvider constructor.
+     * @param Template\Context $context
+     * @param Session $session
+     * @param UserContextInterface $userContext
+     * @param TfaInterface $tfa
+     * @param array $data
+     */
+    public function __construct(
+        Template\Context $context,
+        Session $session,
+        UserContextInterface $userContext,
+        TfaInterface $tfa,
+        array $data = []
+    ) {
+        parent::__construct($context, $data);
+        $this->tfa = $tfa;
+        $this->session = $session;
+        $this->userContext = $userContext;
+    }
+
+    /**
+     * @inheritDoc
+     */
+    protected function _toHtml()
+    {
+        $toActivate = $this->tfa->getProvidersToActivate($this->userContext->getUserId());
+
+        foreach ($toActivate as $toActivateProvider) {
+            if ($toActivateProvider->getCode() === $this->getData('provider')) {
+                return '';
+            }
+        }
+
+        return parent::_toHtml();
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function getJsLayout()
+    {
+        $providers = [];
+        foreach ($this->getProvidersList() as $provider) {
+            if (!$provider->isActive($this->userContext->getUserId())) {
+                continue;
+            }
+            $providers[] = [
+                'code' => $provider->getCode(),
+                'name' => $provider->getName(),
+                'auth' => $this->getUrl($provider->getAuthAction()),
+                'icon' => $this->getViewFileUrl($provider->getIcon()),
+            ];
+        }
+
+        $this->jsLayout['components']['tfa-change-provider']['switchIcon'] =
+            $this->getViewFileUrl('Magento_TwoFactorAuth::images/change_provider.png');
+        $this->jsLayout['components']['tfa-change-provider']['providers'] = $providers;
+
+        return parent::getJsLayout();
+    }
+
+    /**
+     * Get a list of available providers
+     * @return ProviderInterface[]
+     */
+    private function getProvidersList(): array
+    {
+        $res = [];
+
+        $providers = $this->tfa->getUserProviders((int) $this->userContext->getUserId());
+        foreach ($providers as $provider) {
+            if ($provider->getCode() !== $this->getData('provider')) {
+                $res[] = $provider;
+            }
+        }
+
+        return $res;
+    }
+}
diff --git a/TwoFactorAuth/Block/Configure.php b/TwoFactorAuth/Block/Configure.php
new file mode 100644
index 00000000..6a12dacd
--- /dev/null
+++ b/TwoFactorAuth/Block/Configure.php
@@ -0,0 +1,69 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Block;
+
+use Magento\Backend\Block\Template;
+use Magento\User\Model\User;
+use Magento\TwoFactorAuth\Api\TfaInterface;
+use Magento\TwoFactorAuth\Api\ProviderInterface;
+
+/**
+ * Block with providers list allowing to configure 2FA providers to be used to authorize users.
+ *
+ * @api
+ */
+class Configure extends Template
+{
+    /**
+     * @var TfaInterface
+     */
+    private $tfa;
+
+    /**
+     * @param Template\Context $context
+     * @param array $data
+     * @param TfaInterface $tfa
+     */
+    public function __construct(Template\Context $context, TfaInterface $tfa, array $data = [])
+    {
+        parent::__construct($context, $data);
+        $this->tfa = $tfa;
+    }
+
+    /**
+     * Create list of providers for user to choose.
+     *
+     * @return array
+     */
+    public function getProvidersList(): array
+    {
+        $selected = $this->tfa->getForcedProviders();
+        $list = [];
+        foreach ($this->tfa->getAllEnabledProviders() as $provider) {
+            $list[] = [
+                'code' => $provider->getCode(),
+                'name' => $provider->getName(),
+                'icon' => $this->getViewFileUrl($provider->getIcon()),
+                'selected' => in_array($provider, $selected, true)
+            ];
+        }
+
+        return $list;
+    }
+
+    /**
+     * Get the form's action URL.
+     *
+     * @return string
+     */
+    public function getActionUrl(): string
+    {
+        return $this->getUrl('tfa/tfa/configurepost');
+    }
+}
diff --git a/TwoFactorAuth/Block/ConfigureLater.php b/TwoFactorAuth/Block/ConfigureLater.php
new file mode 100644
index 00000000..446caca8
--- /dev/null
+++ b/TwoFactorAuth/Block/ConfigureLater.php
@@ -0,0 +1,96 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Block;
+
+use Magento\Authorization\Model\UserContextInterface;
+use Magento\Backend\Block\Template;
+use Magento\Backend\Block\Template\Context;
+use Magento\Framework\Data\Form\FormKey;
+use Magento\Framework\Serialize\SerializerInterface;
+use Magento\TwoFactorAuth\Api\TfaInterface;
+
+/**
+ * @api
+ */
+class ConfigureLater extends Template
+{
+    /**
+     * @var TfaInterface
+     */
+    private $tfa;
+
+    /**
+     * @var SerializerInterface
+     */
+    private $serializer;
+
+    /**
+     * @var UserContextInterface
+     */
+    private $userContext;
+
+    /**
+     * ChangeProvider constructor.
+     * @param Context $context
+     * @param TfaInterface $tfa
+     * @param SerializerInterface $serializer
+     * @param FormKey $formKey
+     * @param UserContextInterface $userContext
+     * @param array $data
+     */
+    public function __construct(
+        Context $context,
+        TfaInterface $tfa,
+        SerializerInterface $serializer,
+        FormKey $formKey,
+        UserContextInterface $userContext,
+        array $data = []
+    ) {
+        parent::__construct($context, $data);
+        $this->tfa = $tfa;
+        $this->serializer = $serializer;
+        $this->formKey = $formKey;
+        $this->userContext = $userContext;
+    }
+
+    /**
+     * @inheritDoc
+     */
+    protected function _toHtml()
+    {
+        $userId = $this->userContext->getUserId();
+        $providers = $this->tfa->getUserProviders($userId);
+        $toActivate = $this->tfa->getProvidersToActivate($userId);
+
+        foreach ($toActivate as $toActivateProvider) {
+            if ($toActivateProvider->getCode() === $this->getData('provider') && count($providers) > 1) {
+                return parent::_toHtml();
+            }
+        }
+
+        return '';
+    }
+
+    /**
+     * Get a serialized string of post data for the configure later endpoint
+     *
+     * @return string
+     */
+    public function getPostData(): string
+    {
+        return $this->serializer->serialize(
+            [
+                'action' => $this->getUrl('tfa/tfa/configurelater'),
+                'data' => [
+                    'provider' => $this->getData('provider'),
+                    'form_key' => $this->formKey->getFormKey()
+                ]
+            ]
+        );
+    }
+}
diff --git a/TwoFactorAuth/Block/Provider/Authy/Auth.php b/TwoFactorAuth/Block/Provider/Authy/Auth.php
new file mode 100644
index 00000000..18182240
--- /dev/null
+++ b/TwoFactorAuth/Block/Provider/Authy/Auth.php
@@ -0,0 +1,39 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Block\Provider\Authy;
+
+use Magento\Backend\Block\Template;
+
+/**
+ * @api
+ */
+class Auth extends Template
+{
+    /**
+     * @inheritdoc
+     */
+    public function getJsLayout()
+    {
+        $this->jsLayout['components']['tfa-auth']['postUrl'] =
+            $this->getUrl('*/*/authpost');
+
+        $this->jsLayout['components']['tfa-auth']['tokenRequestUrl'] =
+            $this->getUrl('*/*/token');
+
+        $this->jsLayout['components']['tfa-auth']['oneTouchUrl'] =
+            $this->getUrl('*/*/onetouch');
+
+        $this->jsLayout['components']['tfa-auth']['verifyOneTouchUrl'] =
+            $this->getUrl('*/*/verifyonetouch');
+
+        $this->jsLayout['components']['tfa-auth']['successUrl'] =
+            $this->getUrl($this->_urlBuilder->getStartupPageUrl());
+
+        return parent::getJsLayout();
+    }
+}
diff --git a/TwoFactorAuth/Block/Provider/Authy/Configure.php b/TwoFactorAuth/Block/Provider/Authy/Configure.php
new file mode 100644
index 00000000..87c84ed5
--- /dev/null
+++ b/TwoFactorAuth/Block/Provider/Authy/Configure.php
@@ -0,0 +1,68 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Block\Provider\Authy;
+
+use Magento\Backend\Block\Template;
+use Magento\TwoFactorAuth\Model\ResourceModel\Country\CollectionFactory as CountryCollectionFactory;
+
+/**
+ * @api
+ */
+class Configure extends Template
+{
+    /**
+     * @var CountryCollectionFactory
+     */
+    private $countryCollectionFactory;
+
+    public function __construct(
+        Template\Context $context,
+        CountryCollectionFactory $countryCollectionFactory,
+        array $data = []
+    ) {
+        parent::__construct($context, $data);
+        $this->countryCollectionFactory = $countryCollectionFactory;
+    }
+
+    /**
+     * Get a country list
+     * return array
+     */
+    private function getCountriesList()
+    {
+        return $this->countryCollectionFactory->create()->addOrder('name', 'asc')->getItems();
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function getJsLayout()
+    {
+        $countries = [];
+        foreach ($this->getCountriesList() as $country) {
+            $countries[] = [
+                'dial_code' => $country->getDialCode(),
+                'name' => $country->getName(),
+            ];
+        }
+
+        $this->jsLayout['components']['tfa-configure']['children']['register']['configurePostUrl'] =
+            $this->getUrl('*/*/configurepost');
+
+        $this->jsLayout['components']['tfa-configure']['children']['verify']['verifyPostUrl'] =
+            $this->getUrl('*/*/configureverifypost');
+
+        $this->jsLayout['components']['tfa-configure']['children']['verify']['successUrl'] =
+            $this->getUrl($this->_urlBuilder->getStartupPageUrl());
+
+        $this->jsLayout['components']['tfa-configure']['children']['register']['countries'] =
+            $countries;
+
+        return parent::getJsLayout();
+    }
+}
diff --git a/TwoFactorAuth/Block/Provider/Duo/Auth.php b/TwoFactorAuth/Block/Provider/Duo/Auth.php
new file mode 100644
index 00000000..4f07843a
--- /dev/null
+++ b/TwoFactorAuth/Block/Provider/Duo/Auth.php
@@ -0,0 +1,62 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Block\Provider\Duo;
+
+use Magento\Backend\Block\Template;
+use Magento\Backend\Model\Auth\Session;
+use Magento\TwoFactorAuth\Model\Provider\Engine\DuoSecurity;
+
+/**
+ * @api
+ */
+class Auth extends Template
+{
+    /**
+     * @var DuoSecurity
+     */
+    private $duoSecurity;
+
+    /**
+     * @var Session
+     */
+    private $session;
+
+    /**
+     * @param Template\Context $context
+     * @param Session $session
+     * @param DuoSecurity $duoSecurity
+     * @param array $data
+     */
+    public function __construct(
+        Template\Context $context,
+        Session $session,
+        DuoSecurity $duoSecurity,
+        array $data = []
+    ) {
+        parent::__construct($context, $data);
+        $this->duoSecurity = $duoSecurity;
+        $this->session = $session;
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function getJsLayout()
+    {
+        $this->jsLayout['components']['tfa-auth']['postUrl'] =
+            $this->getUrl('*/*/authpost', ['form_key' => $this->getFormKey()]);
+
+        $this->jsLayout['components']['tfa-auth']['signature'] =
+            $this->duoSecurity->getRequestSignature($this->session->getUser());
+
+        $this->jsLayout['components']['tfa-auth']['apiHost'] =
+            $this->duoSecurity->getApiHostname();
+
+        return parent::getJsLayout();
+    }
+}
diff --git a/TwoFactorAuth/Block/Provider/Google/Auth.php b/TwoFactorAuth/Block/Provider/Google/Auth.php
new file mode 100644
index 00000000..221c44ca
--- /dev/null
+++ b/TwoFactorAuth/Block/Provider/Google/Auth.php
@@ -0,0 +1,30 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Block\Provider\Google;
+
+use Magento\Backend\Block\Template;
+
+/**
+ * @api
+ */
+class Auth extends Template
+{
+    /**
+     * @inheritdoc
+     */
+    public function getJsLayout()
+    {
+        $this->jsLayout['components']['tfa-auth']['postUrl'] =
+            $this->getUrl('*/*/authpost');
+
+        $this->jsLayout['components']['tfa-auth']['successUrl'] =
+            $this->getUrl($this->_urlBuilder->getStartupPageUrl());
+
+        return parent::getJsLayout();
+    }
+}
diff --git a/TwoFactorAuth/Block/Provider/Google/Configure.php b/TwoFactorAuth/Block/Provider/Google/Configure.php
new file mode 100644
index 00000000..1d1227d3
--- /dev/null
+++ b/TwoFactorAuth/Block/Provider/Google/Configure.php
@@ -0,0 +1,62 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Block\Provider\Google;
+
+use Magento\Backend\Block\Template;
+use Magento\Backend\Model\Auth\Session;
+use Magento\TwoFactorAuth\Model\Provider\Engine\Google;
+
+/**
+ * @api
+ */
+class Configure extends Template
+{
+    /**
+     * @var Session
+     */
+    private $session;
+
+    /**
+     * @var Google
+     */
+    private $google;
+
+    /**
+     * @param Template\Context $context
+     * @param Google $google
+     * @param Session $session
+     * @param array $data
+     */
+    public function __construct(Template\Context $context, Google $google, Session $session, array $data = [])
+    {
+        $this->session = $session;
+        $this->google  = $google;
+
+        parent::__construct($context, $data);
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function getJsLayout()
+    {
+        $this->jsLayout['components']['tfa-configure']['postUrl'] =
+            $this->getUrl('*/*/configurepost');
+
+        $this->jsLayout['components']['tfa-configure']['qrCodeUrl'] =
+            $this->getUrl('*/*/qr');
+
+        $this->jsLayout['components']['tfa-configure']['successUrl'] =
+            $this->getUrl($this->_urlBuilder->getStartupPageUrl());
+
+        $this->jsLayout['components']['tfa-configure']['secretCode'] =
+            $this->google->getSecretCode($this->session->getUser());
+
+        return parent::getJsLayout();
+    }
+}
diff --git a/TwoFactorAuth/Block/Provider/U2fKey/Auth.php b/TwoFactorAuth/Block/Provider/U2fKey/Auth.php
new file mode 100644
index 00000000..b884c75a
--- /dev/null
+++ b/TwoFactorAuth/Block/Provider/U2fKey/Auth.php
@@ -0,0 +1,85 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Block\Provider\U2fKey;
+
+use Magento\Backend\Block\Template;
+use Magento\Backend\Model\Auth\Session;
+use Magento\TwoFactorAuth\Model\Provider\Engine\U2fKey;
+use Magento\TwoFactorAuth\Model\Provider\Engine\U2fKey\Session as U2fSession;
+
+/**
+ * @api
+ */
+class Auth extends Template
+{
+    /**
+     * @var U2fKey
+     */
+    private $u2fKey;
+
+    /**
+     * @var U2fSession
+     */
+    private $u2fSession;
+
+    /**
+     * @var Session
+     */
+    private $session;
+
+    /**
+     * @param Template\Context $context
+     * @param U2fSession $u2fSession
+     * @param U2fKey $u2fKey
+     * @param Session $session
+     * @param array $data
+     */
+    public function __construct(
+        Template\Context $context,
+        U2fSession $u2fSession,
+        U2fKey $u2fKey,
+        Session $session,
+        array $data = []
+    ) {
+        parent::__construct($context, $data);
+        $this->u2fKey = $u2fKey;
+        $this->u2fSession = $u2fSession;
+        $this->session = $session;
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function getJsLayout()
+    {
+        $this->jsLayout['components']['tfa-auth']['postUrl'] =
+            $this->getUrl('*/*/authpost');
+
+        $this->jsLayout['components']['tfa-auth']['successUrl'] =
+            $this->getUrl($this->_urlBuilder->getStartupPageUrl());
+
+        $this->jsLayout['components']['tfa-auth']['touchImageUrl'] =
+            $this->getViewFileUrl('Magento_TwoFactorAuth::images/u2f/touch.png');
+
+        $this->jsLayout['components']['tfa-auth']['authenticateData'] = $this->generateAuthenticateData();
+        return parent::getJsLayout();
+    }
+
+    /**
+     * Get the data needed to authenticate a webauthn request
+     *
+     * @return array
+     */
+    public function generateAuthenticateData(): array
+    {
+        $authenticateData = $this->u2fKey->getAuthenticateData($this->session->getUser());
+        $this->u2fSession->setU2fChallenge($authenticateData['credentialRequestOptions']['challenge']);
+
+        return $authenticateData;
+    }
+}
diff --git a/TwoFactorAuth/Block/Provider/U2fKey/Configure.php b/TwoFactorAuth/Block/Provider/U2fKey/Configure.php
new file mode 100644
index 00000000..f11b2351
--- /dev/null
+++ b/TwoFactorAuth/Block/Provider/U2fKey/Configure.php
@@ -0,0 +1,87 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Block\Provider\U2fKey;
+
+use Magento\Backend\Block\Template;
+use Magento\Backend\Model\Auth\Session;
+use Magento\TwoFactorAuth\Model\Provider\Engine\U2fKey;
+use Magento\TwoFactorAuth\Model\Provider\Engine\U2fKey\Session as U2fSession;
+
+/**
+ * @api
+ */
+class Configure extends Template
+{
+    /**
+     * @var U2fKey
+     */
+    private $u2fKey;
+
+    /**
+     * @var U2fSession
+     */
+    private $u2fSession;
+
+    /**
+     * @var Session
+     */
+    private $session;
+
+    /**
+     * @param Template\Context $context
+     * @param U2fKey $u2fKey
+     * @param U2fSession $u2fSession
+     * @param Session $session
+     * @param array $data
+     */
+    public function __construct(
+        Template\Context $context,
+        U2fKey $u2fKey,
+        U2fSession $u2fSession,
+        Session $session,
+        array $data = []
+    ) {
+
+        parent::__construct($context, $data);
+        $this->u2fKey = $u2fKey;
+        $this->u2fSession = $u2fSession;
+        $this->session = $session;
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function getJsLayout()
+    {
+        $this->jsLayout['components']['tfa-configure']['postUrl'] =
+            $this->getUrl('*/*/configurepost');
+
+        $this->jsLayout['components']['tfa-configure']['successUrl'] =
+            $this->getUrl($this->_urlBuilder->getStartupPageUrl());
+
+        $this->jsLayout['components']['tfa-configure']['touchImageUrl'] =
+            $this->getViewFileUrl('Magento_TwoFactorAuth::images/u2f/touch.png');
+
+        $this->jsLayout['components']['tfa-configure']['registerData'] = $this->getRegisterData();
+
+        return parent::getJsLayout();
+    }
+
+    /**
+     * Get the data required to issue a WebAuthn request
+     *
+     * @return array
+     */
+    public function getRegisterData(): array
+    {
+        $registerData = $this->u2fKey->getRegisterData($this->session->getUser());
+        $this->u2fSession->setU2fChallenge($registerData['publicKey']['challenge']);
+
+        return $registerData;
+    }
+}
diff --git a/TwoFactorAuth/Command/TfaProviders.php b/TwoFactorAuth/Command/TfaProviders.php
new file mode 100644
index 00000000..d076b76e
--- /dev/null
+++ b/TwoFactorAuth/Command/TfaProviders.php
@@ -0,0 +1,57 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Command;
+
+use Magento\TwoFactorAuth\Api\ProviderPoolInterface;
+use Symfony\Component\Console\Command\Command;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Output\OutputInterface;
+
+/**
+ * 2FA providers list command
+ */
+class TfaProviders extends Command
+{
+    /**
+     * @var ProviderPoolInterface
+     */
+    private $providerPool;
+
+    /**
+     * @param ProviderPoolInterface $providerPool
+     */
+    public function __construct(
+        ProviderPoolInterface $providerPool
+    ) {
+        parent::__construct();
+        $this->providerPool = $providerPool;
+    }
+
+    /**
+     * @inheritDoc
+     */
+    protected function configure()
+    {
+        $this->setName('security:tfa:providers');
+        $this->setDescription('List all available providers');
+
+        parent::configure();
+    }
+
+    /**
+     * @SuppressWarnings("PHPMD.UnusedFormalParameter")
+     */
+    protected function execute(InputInterface $input, OutputInterface $output)
+    {
+        $providers = $this->providerPool->getProviders();
+
+        foreach ($providers as $provider) {
+            $output->writeln(sprintf("%16s: %s", $provider->getCode(), $provider->getName()));
+        }
+    }
+}
diff --git a/TwoFactorAuth/Command/TfaReset.php b/TwoFactorAuth/Command/TfaReset.php
new file mode 100644
index 00000000..67050c45
--- /dev/null
+++ b/TwoFactorAuth/Command/TfaReset.php
@@ -0,0 +1,100 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Command;
+
+use Magento\Framework\Exception\LocalizedException;
+use Magento\TwoFactorAuth\Api\ProviderPoolInterface;
+use Magento\TwoFactorAuth\Api\UserConfigManagerInterface;
+use Symfony\Component\Console\Command\Command;
+use Symfony\Component\Console\Input\InputArgument;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Output\OutputInterface;
+use Magento\User\Model\UserFactory;
+use Magento\User\Model\ResourceModel\User;
+
+/**
+ * 2FA reset commandline
+ */
+class TfaReset extends Command
+{
+    /**
+     * @var UserConfigManagerInterface
+     */
+    private $userConfigManager;
+
+    /**
+     * @var User
+     */
+    private $userResource;
+
+    /**
+     * @var UserFactory
+     */
+    private $userFactory;
+
+    /**
+     * @var ProviderPoolInterface
+     */
+    private $providerPool;
+
+    /**
+     * @param UserConfigManagerInterface $userConfigManager
+     * @param ProviderPoolInterface $providerPool
+     * @param UserFactory $userFactory
+     * @param User $userResource
+     */
+    public function __construct(
+        UserConfigManagerInterface $userConfigManager,
+        ProviderPoolInterface $providerPool,
+        UserFactory $userFactory,
+        User $userResource
+    ) {
+        parent::__construct();
+        $this->userConfigManager = $userConfigManager;
+        $this->userResource = $userResource;
+        $this->userFactory = $userFactory;
+        $this->providerPool = $providerPool;
+    }
+
+    /**
+     * @inheritDoc
+     */
+    protected function configure()
+    {
+        $this->setName('security:tfa:reset');
+        $this->setDescription('Reset configuration for one user');
+
+        $this->addArgument('user', InputArgument::REQUIRED, __('Username'));
+        $this->addArgument('provider', InputArgument::REQUIRED, __('Provider code'));
+
+        parent::configure();
+    }
+
+    /**
+     * @SuppressWarnings("PHPMD.UnusedFormalParameter")
+     * @throws LocalizedException
+     */
+    protected function execute(InputInterface $input, OutputInterface $output)
+    {
+        $userName = $input->getArgument('user');
+        $providerCode = $input->getArgument('provider');
+
+        $user = $this->userFactory->create();
+
+        $this->userResource->load($user, $userName, 'username');
+        if (!$user->getId()) {
+            throw new LocalizedException(__('Unknown user %1', $userName));
+        }
+
+        $provider = $this->providerPool->getProviderByCode($providerCode);
+
+        $this->userConfigManager->resetProviderConfig((int) $user->getId(), $providerCode);
+
+        $output->writeln('' . __('Provider %1 has been reset for user %2', $provider->getName(), $userName));
+    }
+}
diff --git a/TwoFactorAuth/Controller/Adminhtml/AbstractAction.php b/TwoFactorAuth/Controller/Adminhtml/AbstractAction.php
new file mode 100644
index 00000000..d6c9cee7
--- /dev/null
+++ b/TwoFactorAuth/Controller/Adminhtml/AbstractAction.php
@@ -0,0 +1,30 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Controller\Adminhtml;
+
+use Magento\Backend\App\Action;
+use Magento\Framework\App\RequestInterface;
+
+/**
+ * Abstraction for 2FA controllers
+ */
+abstract class AbstractAction extends Action
+{
+    /**
+     * @inheritDoc
+     */
+    public function dispatch(RequestInterface $request)
+    {
+        if (!$this->_isAllowed()) {
+            $this->_response->setStatusHeader(403, '1.1', 'Forbidden');
+            return $this->_redirect('*/auth/login');
+        }
+
+        return parent::dispatch($request);
+    }
+}
diff --git a/TwoFactorAuth/Controller/Adminhtml/AbstractConfigureAction.php b/TwoFactorAuth/Controller/Adminhtml/AbstractConfigureAction.php
new file mode 100644
index 00000000..e7892d60
--- /dev/null
+++ b/TwoFactorAuth/Controller/Adminhtml/AbstractConfigureAction.php
@@ -0,0 +1,46 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Controller\Adminhtml;
+
+use Magento\Backend\App\Action\Context;
+use Magento\TwoFactorAuth\Model\UserConfig\HtmlAreaTokenVerifier;
+
+/**
+ * Base action class for controllers related to 2FA provider configuration.
+ */
+abstract class AbstractConfigureAction extends AbstractAction
+{
+    /**
+     * @var HtmlAreaTokenVerifier
+     */
+    private $tokenVerifier;
+
+    /**
+     * @param Context $context
+     * @param HtmlAreaTokenVerifier $tokenVerifier
+     */
+    public function __construct(Context $context, HtmlAreaTokenVerifier $tokenVerifier)
+    {
+        parent::__construct($context);
+        $this->tokenVerifier = $tokenVerifier;
+    }
+
+    /**
+     * @inheritDoc
+     */
+    protected function _isAllowed()
+    {
+        $isAllowed = parent::_isAllowed();
+        if ($isAllowed) {
+            $isAllowed = $this->tokenVerifier->isConfigTokenProvided();
+        }
+
+        return $isAllowed;
+    }
+}
diff --git a/TwoFactorAuth/Controller/Adminhtml/Authy/Auth.php b/TwoFactorAuth/Controller/Adminhtml/Authy/Auth.php
new file mode 100644
index 00000000..7c68ea64
--- /dev/null
+++ b/TwoFactorAuth/Controller/Adminhtml/Authy/Auth.php
@@ -0,0 +1,98 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Controller\Adminhtml\Authy;
+
+use Magento\Backend\Model\Auth\Session;
+use Magento\Backend\App\Action;
+use Magento\Framework\App\Action\HttpGetActionInterface;
+use Magento\Framework\Exception\NoSuchEntityException;
+use Magento\Framework\View\Result\PageFactory;
+use Magento\TwoFactorAuth\Api\TfaInterface;
+use Magento\TwoFactorAuth\Api\UserConfigManagerInterface;
+use Magento\TwoFactorAuth\Controller\Adminhtml\AbstractAction;
+use Magento\TwoFactorAuth\Model\Provider\Engine\Authy;
+use Magento\User\Model\User;
+
+/**
+ * @SuppressWarnings(PHPMD.CamelCaseMethodName)
+ */
+class Auth extends AbstractAction implements HttpGetActionInterface
+{
+    /**
+     * @var TfaInterface
+     */
+    private $tfa;
+
+    /**
+     * @var Session
+     */
+    private $session;
+
+    /**
+     * @var PageFactory
+     */
+    private $pageFactory;
+
+    /**
+     * @var UserConfigManagerInterface
+     */
+    private $userConfigManager;
+
+    /**
+     * @param Action\Context $context
+     * @param Session $session
+     * @param PageFactory $pageFactory
+     * @param UserConfigManagerInterface $userConfigManager
+     * @param TfaInterface $tfa
+     */
+    public function __construct(
+        Action\Context $context,
+        Session $session,
+        PageFactory $pageFactory,
+        UserConfigManagerInterface $userConfigManager,
+        TfaInterface $tfa
+    ) {
+        parent::__construct($context);
+        $this->tfa = $tfa;
+        $this->session = $session;
+        $this->pageFactory = $pageFactory;
+        $this->userConfigManager = $userConfigManager;
+    }
+
+    /**
+     * Get current user
+     * @return User|null
+     */
+    private function getUser()
+    {
+        return $this->session->getUser();
+    }
+
+    /**
+     * @inheritdoc
+     * @throws NoSuchEntityException
+     */
+    public function execute()
+    {
+        $this->userConfigManager->setDefaultProvider((int) $this->getUser()->getId(), Authy::CODE);
+        return $this->pageFactory->create();
+    }
+
+    /**
+     * @inheritdoc
+     */
+    protected function _isAllowed()
+    {
+        $user = $this->getUser();
+
+        return
+            $user &&
+            $this->tfa->getProviderIsAllowed((int) $user->getId(), Authy::CODE) &&
+            $this->tfa->getProvider(Authy::CODE)->isActive((int) $user->getId());
+    }
+}
diff --git a/TwoFactorAuth/Controller/Adminhtml/Authy/Authpost.php b/TwoFactorAuth/Controller/Adminhtml/Authy/Authpost.php
new file mode 100644
index 00000000..08c17fc0
--- /dev/null
+++ b/TwoFactorAuth/Controller/Adminhtml/Authy/Authpost.php
@@ -0,0 +1,143 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Controller\Adminhtml\Authy;
+
+use Exception;
+use Magento\Backend\Model\Auth\Session;
+use Magento\Backend\App\Action;
+use Magento\Framework\App\Action\HttpPostActionInterface;
+use Magento\Framework\DataObjectFactory;
+use Magento\Framework\Controller\Result\JsonFactory;
+use Magento\TwoFactorAuth\Model\AlertInterface;
+use Magento\TwoFactorAuth\Api\TfaInterface;
+use Magento\TwoFactorAuth\Api\TfaSessionInterface;
+use Magento\TwoFactorAuth\Controller\Adminhtml\AbstractAction;
+use Magento\TwoFactorAuth\Model\Provider\Engine\Authy;
+use Magento\User\Model\User;
+
+/**
+ * @SuppressWarnings(PHPMD.CamelCaseMethodName)
+ */
+class Authpost extends AbstractAction implements HttpPostActionInterface
+{
+    /**
+     * @var TfaInterface
+     */
+    private $tfa;
+
+    /**
+     * @var Session
+     */
+    private $session;
+
+    /**
+     * @var JsonFactory
+     */
+    private $jsonFactory;
+
+    /**
+     * @var TfaSessionInterface
+     */
+    private $tfaSession;
+
+    /**
+     * @var Authy
+     */
+    private $authy;
+
+    /**
+     * @var DataObjectFactory
+     */
+    private $dataObjectFactory;
+
+    /**
+     * @var AlertInterface
+     */
+    private $alert;
+
+    /**
+     * @param Action\Context $context
+     * @param Session $session
+     * @param JsonFactory $jsonFactory
+     * @param Authy $authy
+     * @param TfaSessionInterface $tfaSession
+     * @param TfaInterface $tfa
+     * @param AlertInterface $alert
+     * @param DataObjectFactory $dataObjectFactory
+     */
+    public function __construct(
+        Action\Context $context,
+        Session $session,
+        JsonFactory $jsonFactory,
+        Authy $authy,
+        TfaSessionInterface $tfaSession,
+        TfaInterface $tfa,
+        AlertInterface $alert,
+        DataObjectFactory $dataObjectFactory
+    ) {
+        parent::__construct($context);
+        $this->tfa = $tfa;
+        $this->session = $session;
+        $this->jsonFactory = $jsonFactory;
+        $this->tfaSession = $tfaSession;
+        $this->authy = $authy;
+        $this->dataObjectFactory = $dataObjectFactory;
+        $this->alert = $alert;
+    }
+
+    /**
+     * Get current user
+     * @return User|null
+     */
+    private function getUser(): ?User
+    {
+        return $this->session->getUser();
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function execute()
+    {
+        $user = $this->getUser();
+        $result = $this->jsonFactory->create();
+
+        try {
+            $this->authy->verify($user, $this->dataObjectFactory->create([
+                'data' => $this->getRequest()->getParams(),
+            ]));
+            $this->tfaSession->grantAccess();
+            $result->setData(['success' => true]);
+        } catch (Exception $e) {
+            $this->alert->event(
+                'Magento_TwoFactorAuth',
+                'Authy error',
+                AlertInterface::LEVEL_ERROR,
+                $this->getUser()->getUserName(),
+                $e->getMessage()
+            );
+
+            $result->setData(['success' => false, 'message' => $e->getMessage()]);
+        }
+
+        return $result;
+    }
+
+    /**
+     * @inheritdoc
+     */
+    protected function _isAllowed()
+    {
+        $user = $this->getUser();
+
+        return
+            $user &&
+            $this->tfa->getProviderIsAllowed((int) $user->getId(), Authy::CODE) &&
+            $this->tfa->getProvider(Authy::CODE)->isActive((int) $user->getId());
+    }
+}
diff --git a/TwoFactorAuth/Controller/Adminhtml/Authy/Configure.php b/TwoFactorAuth/Controller/Adminhtml/Authy/Configure.php
new file mode 100644
index 00000000..a35c52ab
--- /dev/null
+++ b/TwoFactorAuth/Controller/Adminhtml/Authy/Configure.php
@@ -0,0 +1,93 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Controller\Adminhtml\Authy;
+
+use Magento\Backend\App\Action;
+use Magento\Backend\Model\Auth\Session;
+use Magento\Framework\App\Action\HttpGetActionInterface;
+use Magento\Framework\View\Result\PageFactory;
+use Magento\TwoFactorAuth\Api\TfaInterface;
+use Magento\TwoFactorAuth\Controller\Adminhtml\AbstractConfigureAction;
+use Magento\TwoFactorAuth\Model\Provider\Engine\Authy;
+use Magento\User\Model\User;
+use Magento\TwoFactorAuth\Model\UserConfig\HtmlAreaTokenVerifier;
+
+/**
+ * @SuppressWarnings(PHPMD.CamelCaseMethodName)
+ */
+class Configure extends AbstractConfigureAction implements HttpGetActionInterface
+{
+    /**
+     * @var PageFactory
+     */
+    private $pageFactory;
+
+    /**
+     * @var Session
+     */
+    private $session;
+
+    /**
+     * @var TfaInterface
+     */
+    private $tfa;
+
+    /**
+     * @param Action\Context $context
+     * @param Session $session
+     * @param TfaInterface $tfa
+     * @param PageFactory $pageFactory
+     * @param HtmlAreaTokenVerifier $tokenVerifier
+     */
+    public function __construct(
+        Action\Context $context,
+        Session $session,
+        TfaInterface $tfa,
+        PageFactory $pageFactory,
+        HtmlAreaTokenVerifier $tokenVerifier
+    ) {
+        parent::__construct($context, $tokenVerifier);
+        $this->pageFactory = $pageFactory;
+        $this->session = $session;
+        $this->tfa = $tfa;
+    }
+
+    /**
+     * Get current user
+     * @return User|null
+     */
+    private function getUser(): ?User
+    {
+        return $this->session->getUser();
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function execute()
+    {
+        return $this->pageFactory->create();
+    }
+
+    /**
+     * @inheritdoc
+     */
+    protected function _isAllowed()
+    {
+        if (!parent::_isAllowed()) {
+            return false;
+        }
+
+        $user = $this->getUser();
+
+        return
+            $user &&
+            $this->tfa->getProviderIsAllowed((int) $user->getId(), Authy::CODE) &&
+            !$this->tfa->getProvider(Authy::CODE)->isActive((int) $user->getId());
+    }
+}
diff --git a/TwoFactorAuth/Controller/Adminhtml/Authy/Configurepost.php b/TwoFactorAuth/Controller/Adminhtml/Authy/Configurepost.php
new file mode 100644
index 00000000..63efa4f6
--- /dev/null
+++ b/TwoFactorAuth/Controller/Adminhtml/Authy/Configurepost.php
@@ -0,0 +1,148 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Controller\Adminhtml\Authy;
+
+use Exception;
+use Magento\Backend\App\Action;
+use Magento\Backend\Model\Auth\Session;
+use Magento\Framework\App\Action\HttpPostActionInterface;
+use Magento\Framework\Controller\Result\JsonFactory;
+use Magento\Framework\View\Result\PageFactory;
+use Magento\TwoFactorAuth\Model\AlertInterface;
+use Magento\TwoFactorAuth\Api\TfaInterface;
+use Magento\TwoFactorAuth\Controller\Adminhtml\AbstractConfigureAction;
+use Magento\TwoFactorAuth\Model\Provider\Engine\Authy;
+use Magento\User\Model\User;
+use Magento\TwoFactorAuth\Model\UserConfig\HtmlAreaTokenVerifier;
+
+/**
+ * @SuppressWarnings(PHPMD.CamelCaseMethodName)
+ */
+class Configurepost extends AbstractConfigureAction implements HttpPostActionInterface
+{
+    /**
+     * @var PageFactory
+     */
+    private $jsonFactory;
+
+    /**
+     * @var Session
+     */
+    private $session;
+
+    /**
+     * @var TfaInterface
+     */
+    private $tfa;
+
+    /**
+     * @var AlertInterface
+     */
+    private $alert;
+
+    /**
+     * @var Authy\Verification
+     */
+    private $verification;
+
+    /**
+     * @param Action\Context $context
+     * @param Session $session
+     * @param Authy\Verification $verification
+     * @param TfaInterface $tfa
+     * @param AlertInterface $alert
+     * @param JsonFactory $jsonFactory
+     * @param HtmlAreaTokenVerifier $tokenVerifier
+     */
+    public function __construct(
+        Action\Context $context,
+        Session $session,
+        Authy\Verification $verification,
+        TfaInterface $tfa,
+        AlertInterface $alert,
+        JsonFactory $jsonFactory,
+        HtmlAreaTokenVerifier $tokenVerifier
+    ) {
+        parent::__construct($context, $tokenVerifier);
+        $this->jsonFactory = $jsonFactory;
+        $this->session = $session;
+        $this->tfa = $tfa;
+        $this->alert = $alert;
+        $this->verification = $verification;
+    }
+
+    /**
+     * Get current user
+     * @return User|null
+     */
+    private function getUser(): ?User
+    {
+        return $this->session->getUser();
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function execute()
+    {
+        $request = $this->getRequest();
+        $response = $this->jsonFactory->create();
+
+        try {
+            $res = [];
+            $this->verification->request(
+                $this->getUser(),
+                (string) $request->getParam('tfa_country'),
+                (string) $request->getParam('tfa_phone'),
+                (string) $request->getParam('tfa_method'),
+                $res
+            );
+
+            $this->alert->event(
+                'Magento_TwoFactorAuth',
+                'New authy verification request via ' . $request->getParam('tfa_method'),
+                AlertInterface::LEVEL_INFO,
+                $this->getUser()->getUserName()
+            );
+
+            $response->setData([
+                'success' => true,
+                'message' => $res['message'],
+                'seconds_to_expire' => (int) $res['seconds_to_expire'],
+            ]);
+        } catch (Exception $e) {
+            $this->alert->event(
+                'Magento_TwoFactorAuth',
+                'Authy verification request failure via ' . $request->getParam('tfa_method'),
+                AlertInterface::LEVEL_ERROR,
+                $this->getUser()->getUserName(),
+                $e->getMessage()
+            );
+            $response->setData(['success' => false, 'message' => $e->getMessage()]);
+        }
+
+        return $response;
+    }
+
+    /**
+     * @inheritdoc
+     */
+    protected function _isAllowed()
+    {
+        if (!parent::_isAllowed()) {
+            return false;
+        }
+
+        $user = $this->getUser();
+
+        return
+            $user &&
+            $this->tfa->getProviderIsAllowed((int) $user->getId(), Authy::CODE) &&
+            !$this->tfa->getProvider(Authy::CODE)->isActive((int) $user->getId());
+    }
+}
diff --git a/TwoFactorAuth/Controller/Adminhtml/Authy/Configureverifypost.php b/TwoFactorAuth/Controller/Adminhtml/Authy/Configureverifypost.php
new file mode 100644
index 00000000..6b6c091e
--- /dev/null
+++ b/TwoFactorAuth/Controller/Adminhtml/Authy/Configureverifypost.php
@@ -0,0 +1,161 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Controller\Adminhtml\Authy;
+
+use Exception;
+use Magento\Backend\App\Action;
+use Magento\Backend\Model\Auth\Session;
+use Magento\Framework\App\Action\HttpPostActionInterface;
+use Magento\Framework\Controller\Result\JsonFactory;
+use Magento\TwoFactorAuth\Model\AlertInterface;
+use Magento\TwoFactorAuth\Api\TfaInterface;
+use Magento\TwoFactorAuth\Api\TfaSessionInterface;
+use Magento\TwoFactorAuth\Controller\Adminhtml\AbstractConfigureAction;
+use Magento\TwoFactorAuth\Model\Provider\Engine\Authy;
+use Magento\User\Model\User;
+use Magento\TwoFactorAuth\Model\UserConfig\HtmlAreaTokenVerifier;
+
+/**
+ * @SuppressWarnings(PHPMD.CamelCaseMethodName)
+ */
+class Configureverifypost extends AbstractConfigureAction implements HttpPostActionInterface
+{
+    /**
+     * @var JsonFactory
+     */
+    private $jsonFactory;
+
+    /**
+     * @var Session
+     */
+    private $session;
+
+    /**
+     * @var TfaInterface
+     */
+    private $tfa;
+
+    /**
+     * @var Authy
+     */
+    private $authy;
+
+    /**
+     * @var TfaSessionInterface
+     */
+    private $tfaSession;
+
+    /**
+     * @var AlertInterface
+     */
+    private $alert;
+
+    /**
+     * @var Authy\Verification
+     */
+    private $verification;
+
+    /**
+     * @param Action\Context $context
+     * @param Session $session
+     * @param TfaInterface $tfa
+     * @param TfaSessionInterface $tfaSession
+     * @param AlertInterface $alert
+     * @param Authy $authy
+     * @param Authy\Verification $verification
+     * @param JsonFactory $jsonFactory
+     * @param HtmlAreaTokenVerifier $tokenVerifier
+     */
+    public function __construct(
+        Action\Context $context,
+        Session $session,
+        TfaInterface $tfa,
+        TfaSessionInterface $tfaSession,
+        AlertInterface $alert,
+        Authy $authy,
+        Authy\Verification $verification,
+        JsonFactory $jsonFactory,
+        HtmlAreaTokenVerifier $tokenVerifier
+    ) {
+        parent::__construct($context, $tokenVerifier);
+        $this->jsonFactory = $jsonFactory;
+        $this->session = $session;
+        $this->tfa = $tfa;
+        $this->tfaSession = $tfaSession;
+        $this->alert = $alert;
+        $this->verification = $verification;
+        $this->authy = $authy;
+    }
+
+    /**
+     * Get current user
+     * @return User|null
+     */
+    private function getUser(): ?User
+    {
+        return $this->session->getUser();
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function execute()
+    {
+        $verificationCode = $this->getRequest()->getParam('tfa_verify');
+        $response = $this->jsonFactory->create();
+
+        try {
+            $this->verification->verify($this->getUser(), $verificationCode);
+            $this->authy->enroll($this->getUser());
+            $this->tfaSession->grantAccess();
+
+            $this->alert->event(
+                'Magento_TwoFactorAuth',
+                'Authy identity verified',
+                AlertInterface::LEVEL_INFO,
+                $this->getUser()->getUserName()
+            );
+
+            $response->setData([
+                'success' => true,
+            ]);
+        } catch (Exception $e) {
+            $this->alert->event(
+                'Magento_TwoFactorAuth',
+                'Authy identity verification failure',
+                AlertInterface::LEVEL_ERROR,
+                $this->getUser()->getUserName(),
+                $e->getMessage()
+            );
+
+            $response->setData([
+                'success' => false,
+                'message' => $e->getMessage(),
+            ]);
+        }
+
+        return $response;
+    }
+
+    /**
+     * @inheritdoc
+     */
+    protected function _isAllowed()
+    {
+        if (!parent::_isAllowed()) {
+            return false;
+        }
+
+        $user = $this->getUser();
+
+        return
+            $user &&
+            $this->tfa->getProviderIsAllowed((int) $user->getId(), Authy::CODE) &&
+            !$this->tfa->getProvider(Authy::CODE)->isActive((int) $user->getId());
+    }
+}
diff --git a/TwoFactorAuth/Controller/Adminhtml/Authy/Onetouch.php b/TwoFactorAuth/Controller/Adminhtml/Authy/Onetouch.php
new file mode 100644
index 00000000..45c9fd5c
--- /dev/null
+++ b/TwoFactorAuth/Controller/Adminhtml/Authy/Onetouch.php
@@ -0,0 +1,106 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Controller\Adminhtml\Authy;
+
+use Exception;
+use Magento\Backend\Model\Auth\Session;
+use Magento\Backend\App\Action;
+use Magento\Framework\App\Action\HttpGetActionInterface;
+use Magento\Framework\Controller\Result\JsonFactory;
+use Magento\TwoFactorAuth\Api\TfaInterface;
+use Magento\TwoFactorAuth\Controller\Adminhtml\AbstractAction;
+use Magento\TwoFactorAuth\Model\Provider\Engine\Authy;
+use Magento\User\Model\User;
+
+/**
+ * @SuppressWarnings(PHPMD.CamelCaseMethodName)
+ */
+class Onetouch extends AbstractAction implements HttpGetActionInterface
+{
+    /**
+     * @var Session
+     */
+    private $session;
+
+    /**
+     * @var JsonFactory
+     */
+    private $jsonFactory;
+
+    /**
+     * @var TfaInterface
+     */
+    private $tfa;
+
+    /**
+     * @var Authy\OneTouch
+     */
+    private $oneTouch;
+
+    /**
+     * @param Action\Context $context
+     * @param JsonFactory $jsonFactory
+     * @param TfaInterface $tfa
+     * @param Authy\OneTouch $oneTouch
+     * @param Session $session
+     */
+    public function __construct(
+        Action\Context $context,
+        JsonFactory $jsonFactory,
+        TfaInterface $tfa,
+        Authy\OneTouch $oneTouch,
+        Session $session
+    ) {
+        parent::__construct($context);
+        $this->session = $session;
+        $this->jsonFactory = $jsonFactory;
+        $this->tfa = $tfa;
+        $this->oneTouch = $oneTouch;
+    }
+
+    /**
+     * Get current user
+     * @return User|null
+     */
+    private function getUser(): ?User
+    {
+        return $this->session->getUser();
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function execute()
+    {
+        $result = $this->jsonFactory->create();
+
+        try {
+            $approvalCode = $this->oneTouch->request($this->getUser());
+            $res = ['success' => true, 'code' => $approvalCode];
+        } catch (Exception $e) {
+            $result->setHttpResponseCode(500);
+            $res = ['success' => false, 'message' => $e->getMessage()];
+        }
+
+        $result->setData($res);
+        return $result;
+    }
+
+    /**
+     * @inheritdoc
+     */
+    protected function _isAllowed()
+    {
+        $user = $this->getUser();
+
+        return
+            $user &&
+            $this->tfa->getProviderIsAllowed((int) $user->getId(), Authy::CODE) &&
+            $this->tfa->getProvider(Authy::CODE)->isActive((int) $user->getId());
+    }
+}
diff --git a/TwoFactorAuth/Controller/Adminhtml/Authy/Token.php b/TwoFactorAuth/Controller/Adminhtml/Authy/Token.php
new file mode 100644
index 00000000..b1aa7700
--- /dev/null
+++ b/TwoFactorAuth/Controller/Adminhtml/Authy/Token.php
@@ -0,0 +1,108 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Controller\Adminhtml\Authy;
+
+use Exception;
+use Magento\Backend\Model\Auth\Session;
+use Magento\Backend\App\Action;
+use Magento\Framework\App\Action\HttpGetActionInterface;
+use Magento\Framework\App\Action\HttpPostActionInterface;
+use Magento\Framework\Controller\Result\JsonFactory;
+use Magento\TwoFactorAuth\Api\TfaInterface;
+use Magento\TwoFactorAuth\Controller\Adminhtml\AbstractAction;
+use Magento\TwoFactorAuth\Model\Provider\Engine\Authy;
+use Magento\User\Model\User;
+
+/**
+ * @SuppressWarnings(PHPMD.CamelCaseMethodName)
+ */
+class Token extends AbstractAction implements HttpGetActionInterface, HttpPostActionInterface
+{
+    /**
+     * @var Session
+     */
+    private $session;
+
+    /**
+     * @var JsonFactory
+     */
+    private $jsonFactory;
+
+    /**
+     * @var TfaInterface
+     */
+    private $tfa;
+
+    /**
+     * @var Authy\Token
+     */
+    private $token;
+
+    /**
+     * @param Action\Context $context
+     * @param JsonFactory $jsonFactory
+     * @param TfaInterface $tfa
+     * @param Authy\Token $token
+     * @param Session $session
+     */
+    public function __construct(
+        Action\Context $context,
+        JsonFactory $jsonFactory,
+        TfaInterface $tfa,
+        Authy\Token $token,
+        Session $session
+    ) {
+        parent::__construct($context);
+        $this->session = $session;
+        $this->jsonFactory = $jsonFactory;
+        $this->tfa = $tfa;
+        $this->token = $token;
+    }
+
+    /**
+     * Get current user
+     * @return User|null
+     */
+    private function getUser(): ?User
+    {
+        return $this->session->getUser();
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function execute()
+    {
+        $via = $this->getRequest()->getParam('via');
+        $result = $this->jsonFactory->create();
+
+        try {
+            $this->token->request($this->getUser(), $via);
+            $res = ['success' => true];
+        } catch (Exception $e) {
+            $result->setHttpResponseCode(500);
+            $res = ['success' => false, 'message' => $e->getMessage()];
+        }
+
+        $result->setData($res);
+        return $result;
+    }
+
+    /**
+     * @inheritdoc
+     */
+    protected function _isAllowed()
+    {
+        $user = $this->getUser();
+
+        return
+            $user &&
+            $this->tfa->getProviderIsAllowed((int) $user->getId(), Authy::CODE) &&
+            $this->tfa->getProvider(Authy::CODE)->isActive((int) $user->getId());
+    }
+}
diff --git a/TwoFactorAuth/Controller/Adminhtml/Authy/Verify.php b/TwoFactorAuth/Controller/Adminhtml/Authy/Verify.php
new file mode 100644
index 00000000..21b8f4c0
--- /dev/null
+++ b/TwoFactorAuth/Controller/Adminhtml/Authy/Verify.php
@@ -0,0 +1,126 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Controller\Adminhtml\Authy;
+
+use Magento\Backend\App\Action;
+use Magento\Backend\Model\Auth\Session;
+use Magento\Framework\App\Action\HttpGetActionInterface;
+use Magento\Framework\App\Action\HttpPostActionInterface;
+use Magento\Framework\Exception\NoSuchEntityException;
+use Magento\Framework\Registry;
+use Magento\Framework\View\Result\PageFactory;
+use Magento\TwoFactorAuth\Api\TfaInterface;
+use Magento\TwoFactorAuth\Api\UserConfigManagerInterface;
+use Magento\TwoFactorAuth\Controller\Adminhtml\AbstractAction;
+use Magento\TwoFactorAuth\Model\Provider\Engine\Authy;
+use Magento\User\Model\User;
+
+/**
+ * @SuppressWarnings(PHPMD.CamelCaseMethodName)
+ */
+class Verify extends AbstractAction implements HttpPostActionInterface, HttpGetActionInterface
+{
+    /**
+     * @var PageFactory
+     */
+    private $pageFactory;
+
+    /**
+     * @var Session
+     */
+    private $session;
+
+    /**
+     * @var TfaInterface
+     */
+    private $tfa;
+
+    /**
+     * @var UserConfigManagerInterface
+     */
+    private $userConfigManager;
+
+    /**
+     * @var Registry
+     */
+    private $registry;
+
+    /**
+     * Verify constructor.
+     * @param Action\Context $context
+     * @param Session $session
+     * @param TfaInterface $tfa
+     * @param Registry $registry
+     * @param UserConfigManagerInterface $userConfigManager
+     * @param PageFactory $pageFactory
+     */
+    public function __construct(
+        Action\Context $context,
+        Session $session,
+        TfaInterface $tfa,
+        Registry $registry,
+        UserConfigManagerInterface $userConfigManager,
+        PageFactory $pageFactory
+    ) {
+        parent::__construct($context);
+        $this->pageFactory = $pageFactory;
+        $this->session = $session;
+        $this->tfa = $tfa;
+        $this->userConfigManager = $userConfigManager;
+        $this->registry = $registry;
+    }
+
+    /**
+     * Get current user
+     * @return User|null
+     */
+    private function getUser(): ?User
+    {
+        return $this->session->getUser();
+    }
+
+    /**
+     * Get verify information
+     * @return verify payload
+     * @throws NoSuchEntityException
+     */
+    private function getVerifyInformation()
+    {
+        $providerConfig = $this->userConfigManager->getProviderConfig((int) $this->getUser()->getId(), Authy::CODE);
+        if (!isset($providerConfig['verify'])) {
+            return null;
+        }
+
+        return $providerConfig['verify'];
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function execute()
+    {
+        $verifyInfo = $this->getVerifyInformation();
+        $this->registry->register('tfa_authy_verify', $verifyInfo);
+
+        return $this->pageFactory->create();
+    }
+
+    /**
+     * @inheritdoc
+     */
+    protected function _isAllowed()
+    {
+        $user = $this->getUser();
+
+        return
+            $user &&
+            $this->tfa->getProviderIsAllowed((int) $user->getId(), Authy::CODE) &&
+            $this->getVerifyInformation() &&
+            !$this->tfa->getProvider(Authy::CODE)->isActive((int) $user->getId());
+    }
+}
diff --git a/TwoFactorAuth/Controller/Adminhtml/Authy/Verifyonetouch.php b/TwoFactorAuth/Controller/Adminhtml/Authy/Verifyonetouch.php
new file mode 100644
index 00000000..ee0befce
--- /dev/null
+++ b/TwoFactorAuth/Controller/Adminhtml/Authy/Verifyonetouch.php
@@ -0,0 +1,148 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Controller\Adminhtml\Authy;
+
+use Exception;
+use Magento\Backend\Model\Auth\Session;
+use Magento\Backend\App\Action;
+use Magento\Framework\App\Action\HttpGetActionInterface;
+use Magento\Framework\App\Action\HttpPostActionInterface;
+use Magento\Framework\Controller\Result\JsonFactory;
+use Magento\TwoFactorAuth\Model\AlertInterface;
+use Magento\TwoFactorAuth\Api\TfaInterface;
+use Magento\TwoFactorAuth\Api\TfaSessionInterface;
+use Magento\TwoFactorAuth\Controller\Adminhtml\AbstractAction;
+use Magento\TwoFactorAuth\Model\Provider\Engine\Authy;
+use Magento\User\Model\User;
+
+/**
+ * @SuppressWarnings(PHPMD.CamelCaseMethodName)
+ */
+class Verifyonetouch extends AbstractAction implements HttpGetActionInterface, HttpPostActionInterface
+{
+    /**
+     * @var Session
+     */
+    private $session;
+
+    /**
+     * @var JsonFactory
+     */
+    private $jsonFactory;
+
+    /**
+     * @var TfaInterface
+     */
+    private $tfa;
+
+    /**
+     * @var TfaSessionInterface
+     */
+    private $tfaSession;
+
+    /**
+     * @var AlertInterface
+     */
+    private $alert;
+
+    /**
+     * @var Authy\OneTouch
+     */
+    private $oneTouch;
+
+    /**
+     * Verifyonetouch constructor.
+     * @param Action\Context $context
+     * @param JsonFactory $jsonFactory
+     * @param TfaSessionInterface $tfaSession
+     * @param TfaInterface $tfa
+     * @param AlertInterface $alert
+     * @param Authy\OneTouch $oneTouch
+     * @param Session $session
+     */
+    public function __construct(
+        Action\Context $context,
+        JsonFactory $jsonFactory,
+        TfaSessionInterface $tfaSession,
+        TfaInterface $tfa,
+        AlertInterface $alert,
+        Authy\OneTouch $oneTouch,
+        Session $session
+    ) {
+        parent::__construct($context);
+        $this->session = $session;
+        $this->jsonFactory = $jsonFactory;
+        $this->tfa = $tfa;
+        $this->tfaSession = $tfaSession;
+        $this->alert = $alert;
+        $this->oneTouch = $oneTouch;
+    }
+
+    /**
+     * Get current user
+     * @return User|null
+     */
+    private function getUser(): ?User
+    {
+        return $this->session->getUser();
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function execute()
+    {
+        $result = $this->jsonFactory->create();
+
+        try {
+            $res = $this->oneTouch->verify($this->getUser());
+            if ($res === 'approved') {
+                $this->tfaSession->grantAccess();
+                $res = ['success' => true, 'status' => 'approved'];
+            } else {
+                $res = ['success' => false, 'status' => $res];
+
+                if ($res === 'denied') {
+                    $this->alert->event(
+                        'Magento_TwoFactorAuth',
+                        'Authy onetouch auth denied',
+                        AlertInterface::LEVEL_WARNING,
+                        $this->getUser()->getUserName()
+                    );
+                }
+            }
+        } catch (Exception $e) {
+            $result->setHttpResponseCode(500);
+            $res = ['success' => false, 'message' => $e->getMessage()];
+
+            $this->alert->event(
+                'Magento_TwoFactorAuth',
+                'Authy onetouch error',
+                AlertInterface::LEVEL_ERROR,
+                $this->getUser()->getUserName(),
+                $e->getMessage()
+            );
+        }
+
+        $result->setData($res);
+        return $result;
+    }
+
+    /**
+     * @inheritdoc
+     */
+    protected function _isAllowed()
+    {
+        $user = $this->getUser();
+
+        return
+            $user &&
+            $this->tfa->getProviderIsAllowed((int) $user->getId(), Authy::CODE) &&
+            $this->tfa->getProvider(Authy::CODE)->isActive((int) $user->getId());
+    }
+}
diff --git a/TwoFactorAuth/Controller/Adminhtml/Duo/Auth.php b/TwoFactorAuth/Controller/Adminhtml/Duo/Auth.php
new file mode 100644
index 00000000..6c9bb734
--- /dev/null
+++ b/TwoFactorAuth/Controller/Adminhtml/Duo/Auth.php
@@ -0,0 +1,107 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Controller\Adminhtml\Duo;
+
+use Magento\Backend\Model\Auth\Session;
+use Magento\Backend\App\Action;
+use Magento\Framework\App\Action\HttpGetActionInterface;
+use Magento\Framework\View\Result\PageFactory;
+use Magento\TwoFactorAuth\Api\TfaInterface;
+use Magento\TwoFactorAuth\Api\UserConfigManagerInterface;
+use Magento\TwoFactorAuth\Controller\Adminhtml\AbstractAction;
+use Magento\TwoFactorAuth\Model\Provider\Engine\DuoSecurity;
+use Magento\TwoFactorAuth\Model\UserConfig\HtmlAreaTokenVerifier;
+
+/**
+ * Duo security authentication page
+ * @SuppressWarnings(PHPMD.CamelCaseMethodName)
+ */
+class Auth extends AbstractAction implements HttpGetActionInterface
+{
+    /**
+     * @var TfaInterface
+     */
+    private $tfa;
+
+    /**
+     * @var Session
+     */
+    private $session;
+
+    /**
+     * @var PageFactory
+     */
+    private $pageFactory;
+
+    /**
+     * @var UserConfigManagerInterface
+     */
+    private $userConfigManager;
+
+    /**
+     * @var HtmlAreaTokenVerifier
+     */
+    private $tokenVerifier;
+
+    public function __construct(
+        Action\Context $context,
+        Session $session,
+        PageFactory $pageFactory,
+        UserConfigManagerInterface $userConfigManager,
+        TfaInterface $tfa,
+        HtmlAreaTokenVerifier $tokenVerifier
+    ) {
+        parent::__construct($context);
+        $this->tfa = $tfa;
+        $this->session = $session;
+        $this->pageFactory = $pageFactory;
+        $this->userConfigManager = $userConfigManager;
+        $this->tokenVerifier = $tokenVerifier;
+    }
+
+    /**
+     * Get current user
+     * @return \Magento\User\Model\User|null
+     */
+    private function getUser()
+    {
+        return $this->session->getUser();
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function execute()
+    {
+        $this->userConfigManager->setDefaultProvider((int)$this->getUser()->getId(), DuoSecurity::CODE);
+        return $this->pageFactory->create();
+    }
+
+    /**
+     * Check if admin has permissions to visit related pages
+     *
+     * @return bool
+     */
+    protected function _isAllowed()
+    {
+        if (!parent::_isAllowed()) {
+            return false;
+        }
+
+        // 1st time users must have the token.
+        $user = $this->getUser();
+
+        return
+            $user &&
+            $this->tfa->getProviderIsAllowed((int)$user->getId(), DuoSecurity::CODE)
+            && (
+                $this->userConfigManager->isProviderConfigurationActive((int)$user->getId(), DuoSecurity::CODE)
+                || $this->tokenVerifier->isConfigTokenProvided()
+            );
+    }
+}
diff --git a/TwoFactorAuth/Controller/Adminhtml/Duo/Authpost.php b/TwoFactorAuth/Controller/Adminhtml/Duo/Authpost.php
new file mode 100644
index 00000000..f21d5a8a
--- /dev/null
+++ b/TwoFactorAuth/Controller/Adminhtml/Duo/Authpost.php
@@ -0,0 +1,164 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Controller\Adminhtml\Duo;
+
+use Magento\Backend\Model\Auth\Session;
+use Magento\Backend\App\Action;
+use Magento\Framework\App\Action\HttpPostActionInterface;
+use Magento\Framework\DataObjectFactory;
+use Magento\TwoFactorAuth\Model\AlertInterface;
+use Magento\TwoFactorAuth\Api\TfaInterface;
+use Magento\TwoFactorAuth\Api\TfaSessionInterface;
+use Magento\TwoFactorAuth\Controller\Adminhtml\AbstractAction;
+use Magento\TwoFactorAuth\Model\Provider\Engine\DuoSecurity;
+use Magento\TwoFactorAuth\Api\UserConfigManagerInterface;
+use Magento\TwoFactorAuth\Model\UserConfig\HtmlAreaTokenVerifier;
+
+/**
+ * Duo security authentication post controller
+ * @SuppressWarnings(PHPMD.CamelCaseMethodName)
+ */
+class Authpost extends AbstractAction implements HttpPostActionInterface
+{
+    /**
+     * @var TfaInterface
+     */
+    private $tfa;
+
+    /**
+     * @var Session
+     */
+    private $session;
+
+    /**
+     * @var TfaSessionInterface
+     */
+    private $tfaSession;
+
+    /**
+     * @var DuoSecurity
+     */
+    private $duoSecurity;
+
+    /**
+     * @var DataObjectFactory
+     */
+    private $dataObjectFactory;
+
+    /**
+     * @var AlertInterface
+     */
+    private $alert;
+
+    /**
+     * @var Action\Context
+     */
+    private $context;
+
+    /**
+     * @var HtmlAreaTokenVerifier
+     */
+    private $tokenVerifier;
+
+    /**
+     * @var UserConfigManagerInterface
+     */
+    private $userConfig;
+
+    /**
+     * Authpost constructor.
+     * @param Action\Context $context
+     * @param Session $session
+     * @param DuoSecurity $duoSecurity
+     * @param TfaSessionInterface $tfaSession
+     * @param DataObjectFactory $dataObjectFactory
+     * @param AlertInterface $alert
+     * @param TfaInterface $tfa
+     * @param HtmlAreaTokenVerifier $tokenVerifier
+     * @param UserConfigManagerInterface $userConfig
+     */
+    public function __construct(
+        Action\Context $context,
+        Session $session,
+        DuoSecurity $duoSecurity,
+        TfaSessionInterface $tfaSession,
+        DataObjectFactory $dataObjectFactory,
+        AlertInterface $alert,
+        TfaInterface $tfa,
+        HtmlAreaTokenVerifier $tokenVerifier,
+        UserConfigManagerInterface $userConfig
+    ) {
+        parent::__construct($context);
+        $this->tfa = $tfa;
+        $this->session = $session;
+        $this->tfaSession = $tfaSession;
+        $this->duoSecurity = $duoSecurity;
+        $this->dataObjectFactory = $dataObjectFactory;
+        $this->alert = $alert;
+        $this->context = $context;
+        $this->tokenVerifier = $tokenVerifier;
+        $this->userConfig = $userConfig;
+    }
+
+    /**
+     * Get current user
+     * @return \Magento\User\Model\User|null
+     */
+    private function getUser()
+    {
+        return $this->session->getUser();
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function execute()
+    {
+        $user = $this->getUser();
+
+        if ($this->duoSecurity->verify($user, $this->dataObjectFactory->create([
+            'data' => $this->getRequest()->getParams(),
+        ]))) {
+            $this->tfa->getProvider(DuoSecurity::CODE)->activate((int) $user->getId());
+            $this->tfaSession->grantAccess();
+            return $this->_redirect($this->context->getBackendUrl()->getStartupPageUrl());
+        } else {
+            $this->alert->event(
+                'Magento_TwoFactorAuth',
+                'DuoSecurity invalid auth',
+                AlertInterface::LEVEL_WARNING,
+                $user->getUserName()
+            );
+
+            return $this->_redirect('*/*/auth');
+        }
+    }
+
+    /**
+     * Check if admin has permissions to visit related pages
+     *
+     * @return bool
+     */
+    protected function _isAllowed()
+    {
+        if (!parent::_isAllowed()) {
+            return false;
+        }
+
+        // 1st time users must have the token.
+        $user = $this->getUser();
+
+        return
+            $user &&
+            $this->tfa->getProviderIsAllowed((int)$user->getId(), DuoSecurity::CODE)
+            && (
+                $this->userConfig->isProviderConfigurationActive((int)$user->getId(), DuoSecurity::CODE)
+                || $this->tokenVerifier->isConfigTokenProvided()
+            );
+    }
+}
diff --git a/TwoFactorAuth/Controller/Adminhtml/Duo/Configure.php b/TwoFactorAuth/Controller/Adminhtml/Duo/Configure.php
new file mode 100644
index 00000000..a02debaf
--- /dev/null
+++ b/TwoFactorAuth/Controller/Adminhtml/Duo/Configure.php
@@ -0,0 +1,30 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Controller\Adminhtml\Duo;
+
+use Magento\Framework\App\Action\HttpGetActionInterface;
+use Magento\TwoFactorAuth\Controller\Adminhtml\AbstractAction;
+
+/**
+ * Duo Security configuration controller
+ */
+class Configure extends AbstractAction implements HttpGetActionInterface
+{
+    /**
+     * @see _isAllowed()
+     */
+    const ADMIN_RESOURCE = 'Magento_TwoFactorAuth::config';
+
+    /**
+     * @inheritdoc
+     */
+    public function execute()
+    {
+        return $this->_redirect('*/*/auth');
+    }
+}
diff --git a/TwoFactorAuth/Controller/Adminhtml/Google/Auth.php b/TwoFactorAuth/Controller/Adminhtml/Google/Auth.php
new file mode 100644
index 00000000..75a788ad
--- /dev/null
+++ b/TwoFactorAuth/Controller/Adminhtml/Google/Auth.php
@@ -0,0 +1,97 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Controller\Adminhtml\Google;
+
+use Magento\Backend\Model\Auth\Session;
+use Magento\Backend\App\Action;
+use Magento\Framework\App\Action\HttpGetActionInterface;
+use Magento\Framework\View\Result\PageFactory;
+use Magento\TwoFactorAuth\Api\TfaInterface;
+use Magento\TwoFactorAuth\Api\UserConfigManagerInterface;
+use Magento\TwoFactorAuth\Controller\Adminhtml\AbstractAction;
+use Magento\TwoFactorAuth\Model\Provider\Engine\Google;
+use Magento\User\Model\User;
+
+/**
+ * Google authenticator page
+ * @SuppressWarnings(PHPMD.CamelCaseMethodName)
+ */
+class Auth extends AbstractAction implements HttpGetActionInterface
+{
+    /**
+     * @var TfaInterface
+     */
+    private $tfa;
+
+    /**
+     * @var Session
+     */
+    private $session;
+
+    /**
+     * @var PageFactory
+     */
+    private $pageFactory;
+
+    /**
+     * @var UserConfigManagerInterface
+     */
+    private $userConfigManager;
+
+    /**
+     * @param Action\Context $context
+     * @param Session $session
+     * @param PageFactory $pageFactory
+     * @param UserConfigManagerInterface $userConfigManager
+     * @param TfaInterface $tfa
+     */
+    public function __construct(
+        Action\Context $context,
+        Session $session,
+        PageFactory $pageFactory,
+        UserConfigManagerInterface $userConfigManager,
+        TfaInterface $tfa
+    ) {
+        parent::__construct($context);
+        $this->tfa = $tfa;
+        $this->session = $session;
+        $this->pageFactory = $pageFactory;
+        $this->userConfigManager = $userConfigManager;
+    }
+
+    /**
+     * Get current user
+     * @return User|null
+     */
+    private function getUser(): ?User
+    {
+        return $this->session->getUser();
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function execute()
+    {
+        $this->userConfigManager->setDefaultProvider((int) $this->getUser()->getId(), Google::CODE);
+        return $this->pageFactory->create();
+    }
+
+    /**
+     * @inheritDoc
+     */
+    protected function _isAllowed()
+    {
+        $user = $this->getUser();
+
+        return
+            $user &&
+            $this->tfa->getProviderIsAllowed((int) $user->getId(), Google::CODE) &&
+            $this->tfa->getProvider(Google::CODE)->isActive((int) $user->getId());
+    }
+}
diff --git a/TwoFactorAuth/Controller/Adminhtml/Google/Authpost.php b/TwoFactorAuth/Controller/Adminhtml/Google/Authpost.php
new file mode 100644
index 00000000..75eac2e3
--- /dev/null
+++ b/TwoFactorAuth/Controller/Adminhtml/Google/Authpost.php
@@ -0,0 +1,134 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Controller\Adminhtml\Google;
+
+use Magento\Backend\Model\Auth\Session;
+use Magento\Backend\App\Action;
+use Magento\Framework\App\Action\HttpPostActionInterface;
+use Magento\Framework\Controller\Result\JsonFactory;
+use Magento\Framework\DataObjectFactory;
+use Magento\Framework\Exception\NoSuchEntityException;
+use Magento\TwoFactorAuth\Model\AlertInterface;
+use Magento\TwoFactorAuth\Api\TfaInterface;
+use Magento\TwoFactorAuth\Api\TfaSessionInterface;
+use Magento\TwoFactorAuth\Controller\Adminhtml\AbstractAction;
+use Magento\TwoFactorAuth\Model\Provider\Engine\Google;
+use Magento\User\Model\User;
+
+/**
+ * Google authenticator post controller
+ * @SuppressWarnings(PHPMD.CamelCaseMethodName)
+ */
+class Authpost extends AbstractAction implements HttpPostActionInterface
+{
+    /**
+     * @var TfaInterface
+     */
+    private $tfa;
+
+    /**
+     * @var Session
+     */
+    private $session;
+
+    /**
+     * @var JsonFactory
+     */
+    private $jsonFactory;
+    /**
+     * @var Google
+     */
+    private $google;
+
+    /**
+     * @var TfaSessionInterface
+     */
+    private $tfaSession;
+
+    /**
+     * @var DataObjectFactory
+     */
+    private $dataObjectFactory;
+
+    /**
+     * @var AlertInterface
+     */
+    private $alert;
+
+    /**
+     * @param Action\Context $context
+     * @param Session $session
+     * @param JsonFactory $jsonFactory
+     * @param Google $google
+     * @param TfaSessionInterface $tfaSession
+     * @param TfaInterface $tfa
+     * @param AlertInterface $alert
+     * @param DataObjectFactory $dataObjectFactory
+     */
+    public function __construct(
+        Action\Context $context,
+        Session $session,
+        JsonFactory $jsonFactory,
+        Google $google,
+        TfaSessionInterface $tfaSession,
+        TfaInterface $tfa,
+        AlertInterface $alert,
+        DataObjectFactory $dataObjectFactory
+    ) {
+        parent::__construct($context);
+        $this->tfa = $tfa;
+        $this->session = $session;
+        $this->jsonFactory = $jsonFactory;
+        $this->google = $google;
+        $this->tfaSession = $tfaSession;
+        $this->dataObjectFactory = $dataObjectFactory;
+        $this->alert = $alert;
+    }
+
+    /**
+     * @inheritdoc
+     * @throws NoSuchEntityException
+     */
+    public function execute()
+    {
+        $user = $this->session->getUser();
+        $response = $this->jsonFactory->create();
+        /** @var \Magento\Framework\DataObject $request */
+        $request = $this->dataObjectFactory->create(['data' => $this->getRequest()->getParams()]);
+
+        if ($this->google->verify($user, $request)) {
+            $this->tfaSession->grantAccess();
+            $response->setData(['success' => true]);
+        } else {
+            $this->alert->event(
+                'Magento_TwoFactorAuth',
+                'Google auth invalid token',
+                AlertInterface::LEVEL_WARNING,
+                $user->getUserName()
+            );
+
+            $response->setData(['success' => false, 'message' => 'Invalid code']);
+        }
+
+        return $response;
+    }
+
+    /**
+     * Check if admin has permissions to visit related pages
+     *
+     * @return bool
+     */
+    protected function _isAllowed()
+    {
+        $user = $this->session->getUser();
+
+        return $user
+            && $this->tfa->getProviderIsAllowed((int)$user->getId(), Google::CODE)
+            && $this->tfa->getProvider(Google::CODE)->isActive((int)$user->getId());
+    }
+}
diff --git a/TwoFactorAuth/Controller/Adminhtml/Google/Configure.php b/TwoFactorAuth/Controller/Adminhtml/Google/Configure.php
new file mode 100644
index 00000000..121469b5
--- /dev/null
+++ b/TwoFactorAuth/Controller/Adminhtml/Google/Configure.php
@@ -0,0 +1,94 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Controller\Adminhtml\Google;
+
+use Magento\Backend\Model\Auth\Session;
+use Magento\Backend\App\Action;
+use Magento\Framework\App\Action\HttpGetActionInterface;
+use Magento\Framework\View\Result\PageFactory;
+use Magento\TwoFactorAuth\Api\TfaInterface;
+use Magento\TwoFactorAuth\Controller\Adminhtml\AbstractConfigureAction;
+use Magento\TwoFactorAuth\Model\Provider\Engine\Google;
+use Magento\User\Model\User;
+use Magento\TwoFactorAuth\Model\UserConfig\HtmlAreaTokenVerifier;
+
+/**
+ * Google authenticator configuration page
+ * @SuppressWarnings(PHPMD.CamelCaseMethodName)
+ */
+class Configure extends AbstractConfigureAction implements HttpGetActionInterface
+{
+    /**
+     * @var TfaInterface
+     */
+    private $tfa;
+
+    /**
+     * @var Session
+     */
+    private $session;
+
+    /**
+     * @var PageFactory
+     */
+    private $pageFactory;
+
+    /**
+     * @param Action\Context $context
+     * @param Session $session
+     * @param PageFactory $pageFactory
+     * @param TfaInterface $tfa
+     * @param HtmlAreaTokenVerifier $tokenVerifier
+     */
+    public function __construct(
+        Action\Context $context,
+        Session $session,
+        PageFactory $pageFactory,
+        TfaInterface $tfa,
+        HtmlAreaTokenVerifier $tokenVerifier
+    ) {
+        parent::__construct($context, $tokenVerifier);
+        $this->tfa = $tfa;
+        $this->session = $session;
+        $this->pageFactory = $pageFactory;
+    }
+
+    /**
+     * Get current user
+     * @return User|null
+     */
+    private function getUser(): ?User
+    {
+        return $this->session->getUser();
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function execute()
+    {
+        return $this->pageFactory->create();
+    }
+
+    /**
+     * @inheritDoc
+     */
+    protected function _isAllowed()
+    {
+        if (!parent::_isAllowed()) {
+            return false;
+        }
+
+        $user = $this->getUser();
+
+        return
+            $user &&
+            $this->tfa->getProviderIsAllowed((int) $user->getId(), Google::CODE) &&
+            !$this->tfa->getProvider(Google::CODE)->isActive((int) $user->getId());
+    }
+}
diff --git a/TwoFactorAuth/Controller/Adminhtml/Google/Configurepost.php b/TwoFactorAuth/Controller/Adminhtml/Google/Configurepost.php
new file mode 100644
index 00000000..7467660b
--- /dev/null
+++ b/TwoFactorAuth/Controller/Adminhtml/Google/Configurepost.php
@@ -0,0 +1,161 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Controller\Adminhtml\Google;
+
+use Magento\Backend\Model\Auth\Session;
+use Magento\Backend\App\Action;
+use Magento\Framework\App\Action\HttpPostActionInterface;
+use Magento\Framework\App\ResponseInterface;
+use Magento\Framework\Controller\Result\JsonFactory;
+use Magento\Framework\Controller\ResultInterface;
+use Magento\Framework\DataObjectFactory;
+use Magento\Framework\Exception\NoSuchEntityException;
+use Magento\TwoFactorAuth\Model\AlertInterface;
+use Magento\TwoFactorAuth\Api\TfaInterface;
+use Magento\TwoFactorAuth\Api\TfaSessionInterface;
+use Magento\TwoFactorAuth\Controller\Adminhtml\AbstractConfigureAction;
+use Magento\TwoFactorAuth\Model\Provider\Engine\Google;
+use Magento\User\Model\User;
+use Magento\TwoFactorAuth\Model\UserConfig\HtmlAreaTokenVerifier;
+
+/**
+ * Google authenticator configuration post controller
+ * @SuppressWarnings(PHPMD.CamelCaseMethodName)
+ */
+class Configurepost extends AbstractConfigureAction implements HttpPostActionInterface
+{
+    /**
+     * @var TfaInterface
+     */
+    private $tfa;
+
+    /**
+     * @var Session
+     */
+    private $session;
+
+    /**
+     * @var JsonFactory
+     */
+    private $jsonFactory;
+
+    /**
+     * @var Google
+     */
+    private $google;
+
+    /**
+     * @var TfaSessionInterface
+     */
+    private $tfaSession;
+
+    /**
+     * @var DataObjectFactory
+     */
+    private $dataObjectFactory;
+
+    /**
+     * @var AlertInterface
+     */
+    private $alert;
+
+    /**
+     * @param Action\Context $context
+     * @param Session $session
+     * @param JsonFactory $jsonFactory
+     * @param Google $google
+     * @param TfaSessionInterface $tfaSession
+     * @param TfaInterface $tfa
+     * @param AlertInterface $alert
+     * @param DataObjectFactory $dataObjectFactory
+     * @param HtmlAreaTokenVerifier $tokenVerifier
+     */
+    public function __construct(
+        Action\Context $context,
+        Session $session,
+        JsonFactory $jsonFactory,
+        Google $google,
+        TfaSessionInterface $tfaSession,
+        TfaInterface $tfa,
+        AlertInterface $alert,
+        DataObjectFactory $dataObjectFactory,
+        HtmlAreaTokenVerifier $tokenVerifier
+    ) {
+        parent::__construct($context, $tokenVerifier);
+        $this->tfa = $tfa;
+        $this->session = $session;
+        $this->jsonFactory = $jsonFactory;
+        $this->google = $google;
+        $this->tfaSession = $tfaSession;
+        $this->dataObjectFactory = $dataObjectFactory;
+        $this->alert = $alert;
+    }
+
+    /**
+     * Get current user
+     * @return User|null
+     */
+    private function getUser(): ?User
+    {
+        return $this->session->getUser();
+    }
+
+    /**
+     * @inheritdoc
+     * @return ResponseInterface|ResultInterface
+     * @throws NoSuchEntityException
+     */
+    public function execute()
+    {
+        $response = $this->jsonFactory->create();
+
+        $user = $this->getUser();
+
+        if ($this->google->verify($user, $this->dataObjectFactory->create([
+            'data' => $this->getRequest()->getParams(),
+        ]))) {
+            $this->tfa->getProvider(Google::CODE)->activate((int) $user->getId());
+            $this->tfaSession->grantAccess();
+
+            $this->alert->event(
+                'Magento_TwoFactorAuth',
+                'New Google Authenticator code issued',
+                AlertInterface::LEVEL_INFO,
+                $user->getUserName()
+            );
+
+            $response->setData([
+                'success' => true,
+            ]);
+        } else {
+            $response->setData([
+                'success' => false,
+                'message' => 'Invalid code',
+            ]);
+        }
+
+        return $response;
+    }
+
+    /**
+     * @inheritDoc
+     */
+    protected function _isAllowed()
+    {
+        if (!parent::_isAllowed()) {
+            return false;
+        }
+
+        $user = $this->getUser();
+
+        return
+            $user &&
+            $this->tfa->getProviderIsAllowed((int) $user->getId(), Google::CODE) &&
+            !$this->tfa->getProvider(Google::CODE)->isActive((int) $user->getId());
+    }
+}
diff --git a/TwoFactorAuth/Controller/Adminhtml/Google/Qr.php b/TwoFactorAuth/Controller/Adminhtml/Google/Qr.php
new file mode 100644
index 00000000..53f30bdf
--- /dev/null
+++ b/TwoFactorAuth/Controller/Adminhtml/Google/Qr.php
@@ -0,0 +1,101 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Controller\Adminhtml\Google;
+
+use Magento\Backend\Model\Auth\Session;
+use Magento\Backend\App\Action;
+use Magento\Framework\App\Action\HttpGetActionInterface;
+use Magento\Framework\Controller\Result\Raw;
+use Magento\TwoFactorAuth\Api\TfaInterface;
+use Magento\TwoFactorAuth\Controller\Adminhtml\AbstractAction;
+use Magento\TwoFactorAuth\Model\Provider\Engine\Google;
+use Magento\User\Model\User;
+
+/**
+ * QR code generator for google authenticator
+ * @SuppressWarnings(PHPMD.CamelCaseMethodName)
+ */
+class Qr extends AbstractAction implements HttpGetActionInterface
+{
+    /**
+     * @var TfaInterface
+     */
+    private $tfa;
+
+    /**
+     * @var Session
+     */
+    private $session;
+
+    /**
+     * @var Raw
+     */
+    private $rawResult;
+
+    /**
+     * @var Google
+     */
+    private $google;
+
+    /**
+     * @param Action\Context $context
+     * @param Session $session
+     * @param TfaInterface $tfa
+     * @param Google $google
+     * @param Raw $rawResult
+     */
+    public function __construct(
+        Action\Context $context,
+        Session $session,
+        TfaInterface $tfa,
+        Google $google,
+        Raw $rawResult
+    ) {
+        parent::__construct($context);
+        $this->tfa = $tfa;
+        $this->session = $session;
+        $this->rawResult = $rawResult;
+        $this->google = $google;
+    }
+
+    /**
+     * Get current user
+     * @return User|null
+     */
+    private function getUser(): ?User
+    {
+        return $this->session->getUser();
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function execute()
+    {
+        $pngData = $this->google->getQrCodeAsPng($this->getUser());
+        $this->rawResult
+            ->setHttpResponseCode(200)
+            ->setHeader('Content-Type', 'image/png')
+            ->setContents($pngData);
+
+        return $this->rawResult;
+    }
+
+    /**
+     * @inheritDoc
+     */
+    protected function _isAllowed()
+    {
+        $user = $this->getUser();
+
+        return
+            $user &&
+            $this->tfa->getProviderIsAllowed((int) $user->getId(), Google::CODE) &&
+            !$this->tfa->getProvider(Google::CODE)->isActive((int) $user->getId());
+    }
+}
diff --git a/TwoFactorAuth/Controller/Adminhtml/Tfa/AccessDenied.php b/TwoFactorAuth/Controller/Adminhtml/Tfa/AccessDenied.php
new file mode 100644
index 00000000..e064bcc1
--- /dev/null
+++ b/TwoFactorAuth/Controller/Adminhtml/Tfa/AccessDenied.php
@@ -0,0 +1,26 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Controller\Adminhtml\Tfa;
+
+use Magento\Backend\App\AbstractAction;
+use Magento\Framework\App\Action\HttpGetActionInterface;
+use Magento\Framework\Controller\ResultFactory;
+
+/**
+ * Access denied page for missing 2fa permissions
+ */
+class AccessDenied extends AbstractAction implements HttpGetActionInterface
+{
+    /**
+     * @inheritdoc
+     */
+    public function execute()
+    {
+        return $this->resultFactory->create(ResultFactory::TYPE_PAGE);
+    }
+}
diff --git a/TwoFactorAuth/Controller/Adminhtml/Tfa/Configure.php b/TwoFactorAuth/Controller/Adminhtml/Tfa/Configure.php
new file mode 100644
index 00000000..6643e85c
--- /dev/null
+++ b/TwoFactorAuth/Controller/Adminhtml/Tfa/Configure.php
@@ -0,0 +1,71 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Controller\Adminhtml\Tfa;
+
+use Magento\Backend\App\Action\Context;
+use Magento\Framework\App\Action\HttpGetActionInterface;
+use Magento\Framework\Controller\ResultFactory;
+use Magento\TwoFactorAuth\Api\TfaInterface;
+use Magento\TwoFactorAuth\Controller\Adminhtml\AbstractAction;
+use Magento\TwoFactorAuth\Model\UserConfig\HtmlAreaTokenVerifier;
+use Magento\Backend\Model\Auth\Session;
+
+/**
+ * Configure 2FA for the application.
+ */
+class Configure extends AbstractAction implements HttpGetActionInterface
+{
+    const ADMIN_RESOURCE = 'Magento_TwoFactorAuth::config';
+
+    /**
+     * @var TfaInterface
+     */
+    private $tfa;
+
+    /**
+     * @var HtmlAreaTokenVerifier
+     */
+    private $tokenVerifier;
+
+    /**
+     * @var Session
+     */
+    private $session;
+
+    /**
+     * @param Context $context
+     * @param TfaInterface $tfa
+     * @param HtmlAreaTokenVerifier $tokenVerifier
+     * @param Session $session
+     */
+    public function __construct(
+        Context $context,
+        TfaInterface $tfa,
+        HtmlAreaTokenVerifier $tokenVerifier,
+        Session $session
+    ) {
+        parent::__construct($context);
+        $this->tfa = $tfa;
+        $this->tokenVerifier = $tokenVerifier;
+        $this->session = $session;
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function execute()
+    {
+        $user = $this->session->getUser();
+        if (!$this->tfa->getUserProviders((int)$user->getId()) && !$this->tokenVerifier->isConfigTokenProvided()) {
+            return $this->_redirect('tfa/tfa/requestconfig');
+        }
+
+        return $this->resultFactory->create(ResultFactory::TYPE_PAGE);
+    }
+}
diff --git a/TwoFactorAuth/Controller/Adminhtml/Tfa/ConfigureLater.php b/TwoFactorAuth/Controller/Adminhtml/Tfa/ConfigureLater.php
new file mode 100644
index 00000000..dc07f8d6
--- /dev/null
+++ b/TwoFactorAuth/Controller/Adminhtml/Tfa/ConfigureLater.php
@@ -0,0 +1,108 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Controller\Adminhtml\Tfa;
+
+use Magento\Authorization\Model\UserContextInterface;
+use Magento\Backend\App\Action\Context;
+use Magento\Framework\App\Action\HttpPostActionInterface;
+use Magento\TwoFactorAuth\Api\TfaInterface;
+use Magento\TwoFactorAuth\Api\TfaSessionInterface;
+use Magento\TwoFactorAuth\Controller\Adminhtml\AbstractAction;
+
+/**
+ * Configure 2FA for the application.
+ */
+class ConfigureLater extends AbstractAction implements HttpPostActionInterface
+{
+    const ADMIN_RESOURCE = 'Magento_TwoFactorAuth::tfa';
+
+    /**
+     * @var TfaInterface
+     */
+    private $tfa;
+
+    /**
+     * @var TfaSessionInterface
+     */
+    private $session;
+
+    /**
+     * @var UserContextInterface
+     */
+    private $userContext;
+
+    /**
+     * @param Context $context
+     * @param TfaInterface $tfa
+     * @param TfaSessionInterface $session
+     * @param UserContextInterface $userContext
+     */
+    public function __construct(
+        Context $context,
+        TfaInterface $tfa,
+        TfaSessionInterface $session,
+        UserContextInterface $userContext
+    ) {
+        parent::__construct($context);
+        $this->tfa = $tfa;
+        $this->session = $session;
+        $this->userContext = $userContext;
+    }
+
+    /**
+     * @inheritDoc
+     */
+    protected function _isAllowed()
+    {
+        $userId = $this->userContext->getUserId();
+        $providers = $this->tfa->getUserProviders($userId);
+        $toActivate = $this->tfa->getProvidersToActivate($userId);
+
+        foreach ($toActivate as $toActivateProvider) {
+            if ($toActivateProvider->getCode() === $this->_request->getParam('provider') && count($providers) > 1) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function execute()
+    {
+        $provider = $this->getRequest()->getParam('provider');
+        $userId = $this->userContext->getUserId();
+        $providers = $this->tfa->getUserProviders($userId);
+        $needActivation = $this->tfa->getProvidersToActivate($userId);
+        $providerCodes = [];
+        foreach ($providers as $forcedProvider) {
+            $providerCodes[] = $forcedProvider->getCode();
+        }
+
+        $currentlySkipped = $this->session->getSkippedProviderConfig();
+        $currentlySkipped[$provider] = true;
+
+        // Catch users trying to skip all available providers when there are none configured
+        if (count($needActivation) === count($providers)
+            && count($providerCodes) === count(array_intersect($providerCodes, array_keys($currentlySkipped)))
+        ) {
+            $this->messageManager->addErrorMessage(
+                __('At least one two-factor authentication provider must be configured.')
+            );
+            $currentlySkipped = [];
+        }
+
+        $this->session->setSkippedProviderConfig($currentlySkipped);
+
+        $redirect = $this->resultRedirectFactory->create();
+        return $redirect->setPath('tfa/tfa/index');
+    }
+}
diff --git a/TwoFactorAuth/Controller/Adminhtml/Tfa/Configurepost.php b/TwoFactorAuth/Controller/Adminhtml/Tfa/Configurepost.php
new file mode 100644
index 00000000..e47ef0ea
--- /dev/null
+++ b/TwoFactorAuth/Controller/Adminhtml/Tfa/Configurepost.php
@@ -0,0 +1,137 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Controller\Adminhtml\Tfa;
+
+use Magento\Backend\App\Action\Context;
+use Magento\Framework\App\Action\HttpPostActionInterface;
+use Magento\TwoFactorAuth\Api\ProviderInterface;
+use Magento\TwoFactorAuth\Api\TfaInterface;
+use Magento\TwoFactorAuth\Controller\Adminhtml\AbstractAction;
+use Magento\TwoFactorAuth\Model\UserConfig\HtmlAreaTokenVerifier;
+use Magento\Backend\Model\Auth\Session;
+use Magento\Framework\App\Config\ConfigResource\ConfigInterface as ConfigResource;
+use Magento\Framework\App\Config\ReinitableConfigInterface as ConfigInterface;
+
+/**
+ * Configure 2FA for the application.
+ */
+class Configurepost extends AbstractAction implements HttpPostActionInterface
+{
+    const ADMIN_RESOURCE = 'Magento_TwoFactorAuth::config';
+
+    /**
+     * @var ConfigInterface
+     */
+    private $config;
+
+    /**
+     * @var ConfigResource
+     */
+    private $configResource;
+
+    /**
+     * @var TfaInterface
+     */
+    private $tfa;
+
+    /**
+     * @var HtmlAreaTokenVerifier
+     */
+    private $tokenVerifier;
+
+    /**
+     * @var string
+     */
+    private $startUpUrl;
+
+    /**
+     * @var Session
+     */
+    private $session;
+
+    /**
+     * @param Context $context
+     * @param ConfigInterface $config
+     * @param ConfigResource $configResource
+     * @param TfaInterface $tfa
+     * @param HtmlAreaTokenVerifier $tokenVerifier
+     * @param Session $session
+     */
+    public function __construct(
+        Context $context,
+        ConfigInterface $config,
+        ConfigResource $configResource,
+        TfaInterface $tfa,
+        HtmlAreaTokenVerifier $tokenVerifier,
+        Session $session
+    ) {
+        parent::__construct($context);
+        $this->startUpUrl = $context->getBackendUrl()->getStartupPageUrl();
+        $this->config = $config;
+        $this->configResource = $configResource;
+        $this->tfa = $tfa;
+        $this->tokenVerifier = $tokenVerifier;
+        $this->session = $session;
+    }
+
+    /**
+     * Validate user input
+     *
+     * @param mixed $selected
+     * @return bool
+     */
+    private function validate($selected): bool
+    {
+        $providerCodes = array_map(
+            function (ProviderInterface $provider): string {
+                return $provider->getCode();
+            },
+            $this->tfa->getAllEnabledProviders()
+        );
+
+        return is_array($selected) && !array_diff(array_keys($selected), $providerCodes);
+    }
+
+    /**
+     * @inheritDoc
+     */
+    protected function _isAllowed()
+    {
+        $user = $this->session->getUser();
+        if ($user && !$this->tokenVerifier->isConfigTokenProvided()) {
+            return false;
+        }
+
+        return parent::_isAllowed();
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function execute()
+    {
+        $selected = $this->getRequest()->getParam('tfa_selected');
+        if ($this->validate($selected)) {
+            $this->configResource->saveConfig(
+                TfaInterface::XML_PATH_FORCED_PROVIDERS,
+                implode(',', array_keys($selected))
+            );
+            $this->config->reinit();
+            $this->getMessageManager()->addSuccessMessage(
+                __('Two-Factory Authorization providers have been successfully configured')
+            );
+
+            return $this->_redirect($this->startUpUrl);
+        } else {
+            $this->getMessageManager()->addErrorMessage(__('Please select valid providers.'));
+
+            return $this->_redirect('tfa/tfa/configure');
+        }
+    }
+}
diff --git a/TwoFactorAuth/Controller/Adminhtml/Tfa/Index.php b/TwoFactorAuth/Controller/Adminhtml/Tfa/Index.php
new file mode 100644
index 00000000..1b57203c
--- /dev/null
+++ b/TwoFactorAuth/Controller/Adminhtml/Tfa/Index.php
@@ -0,0 +1,160 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Controller\Adminhtml\Tfa;
+
+use Magento\Authorization\Model\UserContextInterface;
+use Magento\Backend\App\Action\Context;
+use Magento\Framework\App\Action\HttpGetActionInterface;
+use Magento\Framework\Exception\LocalizedException;
+use Magento\TwoFactorAuth\Api\TfaInterface;
+use Magento\TwoFactorAuth\Api\TfaSessionInterface;
+use Magento\TwoFactorAuth\Api\UserConfigManagerInterface;
+use Magento\TwoFactorAuth\Controller\Adminhtml\AbstractAction;
+use Magento\TwoFactorAuth\Api\UserConfigRequestManagerInterface;
+
+/**
+ * 2FA entry point controller
+ */
+class Index extends AbstractAction implements HttpGetActionInterface
+{
+    // To give the email link a place to set the token without causing a loop
+    protected $_publicActions = ['index'];
+
+    /**
+     * @see _isAllowed()
+     */
+    public const ADMIN_RESOURCE = 'Magento_TwoFactorAuth::tfa';
+
+    /**
+     * @var TfaInterface
+     */
+    private $tfa;
+
+    /**
+     * @var TfaSessionInterface
+     */
+    private $session;
+
+    /**
+     * @var UserConfigManagerInterface
+     */
+    private $userConfigManager;
+
+    /**
+     * @var Context
+     */
+    private $context;
+
+    /**
+     * @var UserConfigRequestManagerInterface
+     */
+    private $userConfigRequest;
+
+    /**
+     * @var UserContextInterface
+     */
+    private $userContext;
+
+    /**
+     * @param Context $context
+     * @param TfaSessionInterface $session
+     * @param UserConfigManagerInterface $userConfigManager
+     * @param TfaInterface $tfa
+     * @param UserConfigRequestManagerInterface $userConfigRequestManager
+     * @param UserContextInterface $userContext
+     */
+    public function __construct(
+        Context $context,
+        TfaSessionInterface $session,
+        UserConfigManagerInterface $userConfigManager,
+        TfaInterface $tfa,
+        UserConfigRequestManagerInterface $userConfigRequestManager,
+        UserContextInterface $userContext
+    ) {
+        parent::__construct($context);
+        $this->tfa = $tfa;
+        $this->session = $session;
+        $this->userConfigManager = $userConfigManager;
+        $this->context = $context;
+        $this->userConfigRequest = $userConfigRequestManager;
+        $this->userContext = $userContext;
+    }
+
+    /**
+     * @inheritdoc
+     * @throws LocalizedException
+     */
+    public function execute()
+    {
+        $userId = $this->userContext->getUserId();
+
+        if (!$this->tfa->getUserProviders($userId)) {
+            //If 2FA is not configured - request configuration.
+            return $this->_redirect('tfa/tfa/requestconfig');
+        }
+
+        $providersToConfigure = $this->tfa->getProvidersToActivate($userId);
+        $toActivateCodes = [];
+        foreach ($providersToConfigure as $toActivateProvider) {
+            $toActivateCodes[] = $toActivateProvider->getCode();
+        }
+        $currentlySkipped = array_keys($this->session->getSkippedProviderConfig());
+        $notSkippedProvidersToConfigured = array_diff($toActivateCodes, $currentlySkipped);
+
+        if ($notSkippedProvidersToConfigured) {
+            foreach ($providersToConfigure as $providerToConfigure) {
+                if (in_array($providerToConfigure->getCode(), $notSkippedProvidersToConfigured)) {
+                    //2FA provider not activated - redirect to the provider form.
+                    return $this->_redirect($providerToConfigure->getConfigureAction());
+                }
+            }
+        }
+
+        $providerCode = '';
+
+        $defaultProviderCode = $this->userConfigManager->getDefaultProvider($userId);
+        if ($this->tfa->getProviderIsAllowed($userId, $defaultProviderCode)
+            && $this->tfa->getProvider($defaultProviderCode)->isActive($userId)
+        ) {
+            //If default provider was configured - select it.
+            $providerCode = $defaultProviderCode;
+        }
+
+        if (!$providerCode) {
+            //Select one random provider.
+            $providers = $this->tfa->getUserProviders($userId);
+            if (!empty($providers)) {
+                foreach ($providers as $enabledProvider) {
+                    /*
+                     * The user has skipped all providers that need to be configured but there is
+                     * also at least one already configured
+                     */
+                    if (!in_array($enabledProvider->getCode(), $currentlySkipped)
+                        && !in_array($enabledProvider->getCode(), $toActivateCodes)
+                    ) {
+                        $providerCode = $enabledProvider->getCode();
+                        break;
+                    }
+                }
+            }
+        }
+
+        if (!$providerCode) {
+            //Couldn't find provider - perhaps something is not configured properly.
+            return $this->_redirect($this->context->getBackendUrl()->getStartupPageUrl());
+        }
+
+        $provider = $this->tfa->getProvider($providerCode);
+        if ($provider) {
+            //Provider found, user will be challenged.
+            return $this->_redirect($provider->getAuthAction());
+        }
+
+        throw new LocalizedException(__('Internal error accessing 2FA index page'));
+    }
+}
diff --git a/TwoFactorAuth/Controller/Adminhtml/Tfa/Requestconfig.php b/TwoFactorAuth/Controller/Adminhtml/Tfa/Requestconfig.php
new file mode 100644
index 00000000..ad21f41b
--- /dev/null
+++ b/TwoFactorAuth/Controller/Adminhtml/Tfa/Requestconfig.php
@@ -0,0 +1,103 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Controller\Adminhtml\Tfa;
+
+use Magento\Backend\App\Action\Context;
+use Magento\Backend\Model\Auth\Session;
+use Magento\Framework\App\Action\HttpGetActionInterface;
+use Magento\Framework\App\Action\HttpPostActionInterface;
+use Magento\Framework\Controller\ResultFactory;
+use Magento\Framework\Exception\AuthorizationException;
+use Magento\TwoFactorAuth\Api\Exception\NotificationExceptionInterface;
+use Magento\TwoFactorAuth\Api\TfaInterface;
+use Magento\TwoFactorAuth\Api\UserConfigRequestManagerInterface;
+use Magento\TwoFactorAuth\Controller\Adminhtml\AbstractAction;
+use Magento\TwoFactorAuth\Model\UserConfig\HtmlAreaTokenVerifier;
+
+/**
+ * Request 2FA config from the user.
+ */
+class Requestconfig extends AbstractAction implements HttpGetActionInterface, HttpPostActionInterface
+{
+    /**
+     * @see _isAllowed()
+     */
+    public const ADMIN_RESOURCE = 'Magento_TwoFactorAuth::tfa';
+
+    /**
+     * @var UserConfigRequestManagerInterface
+     */
+    private $configRequestManager;
+
+    /**
+     * @var HtmlAreaTokenVerifier
+     */
+    private $tokenVerifier;
+
+    /**
+     * @var TfaInterface
+     */
+    private $tfa;
+
+    /**
+     * @var Session
+     */
+    private $session;
+
+    /**
+     * @param Context $context
+     * @param UserConfigRequestManagerInterface $configRequestManager
+     * @param HtmlAreaTokenVerifier $tokenVerifier
+     * @param TfaInterface $tfa
+     * @param Session $session
+     */
+    public function __construct(
+        Context $context,
+        UserConfigRequestManagerInterface $configRequestManager,
+        HtmlAreaTokenVerifier $tokenVerifier,
+        TfaInterface $tfa,
+        Session $session
+    ) {
+        parent::__construct($context);
+        $this->configRequestManager = $configRequestManager;
+        $this->tokenVerifier = $tokenVerifier;
+        $this->tfa = $tfa;
+        $this->session = $session;
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function execute()
+    {
+        $user = $this->session->getUser();
+        if (!$this->configRequestManager->isConfigurationRequiredFor((int)$user->getId())) {
+            throw new AuthorizationException(__('2FA is already configured for the user.'));
+        }
+        if ($this->tokenVerifier->isConfigTokenProvided()) {
+            if (!$this->tfa->getForcedProviders()) {
+                return $this->_redirect('tfa/tfa/configure');
+            } else {
+                return $this->_redirect('tfa/tfa/index');
+            }
+        }
+
+        try {
+            $this->configRequestManager->sendConfigRequestTo($user);
+        } catch (AuthorizationException $exception) {
+            $this->messageManager->addErrorMessage(
+                'Please ask an administrator with sufficient access to configure 2FA first'
+            );
+        } catch (NotificationExceptionInterface $exception) {
+            $this->messageManager->addErrorMessage('Failed to send the message. Please contact the administrator');
+        }
+
+        return $this->resultFactory->create(ResultFactory::TYPE_PAGE);
+    }
+}
diff --git a/TwoFactorAuth/Controller/Adminhtml/Tfa/Reset.php b/TwoFactorAuth/Controller/Adminhtml/Tfa/Reset.php
new file mode 100644
index 00000000..57a99c04
--- /dev/null
+++ b/TwoFactorAuth/Controller/Adminhtml/Tfa/Reset.php
@@ -0,0 +1,92 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Controller\Adminhtml\Tfa;
+
+use Magento\Backend\App\Action\Context;
+use Magento\Framework\App\Action\HttpGetActionInterface;
+use Magento\Framework\App\Action\HttpPostActionInterface;
+use Magento\Framework\Exception\LocalizedException;
+use Magento\User\Model\UserFactory;
+use Magento\User\Model\ResourceModel\User as UserResourceModel;
+use Magento\TwoFactorAuth\Api\TfaInterface;
+use Magento\TwoFactorAuth\Controller\Adminhtml\AbstractAction;
+
+/**
+ * Reset 2FA configuration controller
+ * @SuppressWarnings(PHPMD.CamelCaseMethodName)
+ */
+class Reset extends AbstractAction implements HttpGetActionInterface, HttpPostActionInterface
+{
+    /**
+     * @var UserResourceModel
+     */
+    private $userResourceModel;
+
+    /**
+     * @var UserFactory
+     */
+    private $userInterfaceFactory;
+
+    /**
+     * @var TfaInterface
+     */
+    private $tfa;
+
+    /**
+     * @param Context $context
+     * @param UserResourceModel $userResourceModel
+     * @param TfaInterface $tfa
+     * @param UserFactory $userFactory
+     */
+    public function __construct(
+        Context $context,
+        UserResourceModel $userResourceModel,
+        TfaInterface $tfa,
+        UserFactory $userFactory
+    ) {
+        parent::__construct($context);
+        $this->userResourceModel = $userResourceModel;
+        $this->userInterfaceFactory = $userFactory;
+        $this->tfa = $tfa;
+    }
+
+    /**
+     * @inheritdoc
+     * @throws LocalizedException
+     */
+    public function execute()
+    {
+        $userId = $this->getRequest()->getParam('id');
+        $providerCode = $this->getRequest()->getParam('provider');
+
+        $user = $this->userInterfaceFactory->create();
+        $this->userResourceModel->load($user, $userId);
+
+        if (!$user->getId()) {
+            throw new LocalizedException(__('Invalid user'));
+        }
+
+        $provider = $this->tfa->getProvider($providerCode);
+        if (!$provider) {
+            throw new LocalizedException(__('Unknown provider'));
+        }
+
+        $provider->resetConfiguration((int) $user->getId());
+
+        $this->messageManager->addSuccessMessage(__('Configuration has been reset for this user'));
+        return $this->_redirect('adminhtml/user/edit', ['user_id' => $userId]);
+    }
+
+    /**
+     * @inheritdoc
+     */
+    protected function _isAllowed()
+    {
+        return parent::_isAllowed() && $this->_authorization->isAllowed('Magento_TwoFactorAuth::tfa');
+    }
+}
diff --git a/TwoFactorAuth/Controller/Adminhtml/U2f/Auth.php b/TwoFactorAuth/Controller/Adminhtml/U2f/Auth.php
new file mode 100644
index 00000000..613dcfa6
--- /dev/null
+++ b/TwoFactorAuth/Controller/Adminhtml/U2f/Auth.php
@@ -0,0 +1,87 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Controller\Adminhtml\U2f;
+
+use Magento\Backend\Model\Auth\Session;
+use Magento\Backend\App\Action;
+use Magento\Framework\App\Action\HttpGetActionInterface;
+use Magento\Framework\View\Result\PageFactory;
+use Magento\TwoFactorAuth\Api\TfaInterface;
+use Magento\TwoFactorAuth\Api\UserConfigManagerInterface;
+use Magento\TwoFactorAuth\Controller\Adminhtml\AbstractAction;
+use Magento\TwoFactorAuth\Model\Provider\Engine\U2fKey;
+
+/**
+ * UbiKey authentication controller
+ * @SuppressWarnings(PHPMD.CamelCaseMethodName)
+ */
+class Auth extends AbstractAction implements HttpGetActionInterface
+{
+    /**
+     * @var TfaInterface
+     */
+    private $tfa;
+
+    /**
+     * @var Session
+     */
+    private $session;
+
+    /**
+     * @var PageFactory
+     */
+    private $pageFactory;
+
+    /**
+     * @var UserConfigManagerInterface
+     */
+    private $userConfigManager;
+
+    /**
+     * @param Action\Context $context
+     * @param Session $session
+     * @param PageFactory $pageFactory
+     * @param UserConfigManagerInterface $userConfigManager
+     * @param TfaInterface $tfa
+     */
+    public function __construct(
+        Action\Context $context,
+        Session $session,
+        PageFactory $pageFactory,
+        UserConfigManagerInterface $userConfigManager,
+        TfaInterface $tfa
+    ) {
+        parent::__construct($context);
+        $this->tfa = $tfa;
+        $this->session = $session;
+        $this->pageFactory = $pageFactory;
+        $this->userConfigManager = $userConfigManager;
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function execute()
+    {
+        $this->userConfigManager->setDefaultProvider((int) $this->session->getUser()->getId(), U2fKey::CODE);
+        return $this->pageFactory->create();
+    }
+
+    /**
+     * @inheritDoc
+     */
+    protected function _isAllowed()
+    {
+        $user = $this->session->getUser();
+
+        return
+            $user &&
+            $this->tfa->getProviderIsAllowed((int) $user->getId(), U2fKey::CODE) &&
+            $this->tfa->getProvider(U2fKey::CODE)->isActive((int) $user->getId());
+    }
+}
diff --git a/TwoFactorAuth/Controller/Adminhtml/U2f/Authpost.php b/TwoFactorAuth/Controller/Adminhtml/U2f/Authpost.php
new file mode 100644
index 00000000..70905c05
--- /dev/null
+++ b/TwoFactorAuth/Controller/Adminhtml/U2f/Authpost.php
@@ -0,0 +1,169 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Controller\Adminhtml\U2f;
+
+use Exception;
+use Magento\Backend\App\Action;
+use Magento\Backend\Model\Auth\Session;
+use Magento\Framework\App\Action\HttpPostActionInterface;
+use Magento\Framework\Controller\Result\JsonFactory;
+use Magento\Framework\DataObjectFactory;
+use Magento\TwoFactorAuth\Model\AlertInterface;
+use Magento\TwoFactorAuth\Api\TfaSessionInterface;
+use Magento\TwoFactorAuth\Controller\Adminhtml\AbstractAction;
+use Magento\TwoFactorAuth\Model\Provider\Engine\U2fKey;
+use Magento\TwoFactorAuth\Model\Provider\Engine\U2fKey\Session as U2fSession;
+use Magento\TwoFactorAuth\Model\Tfa;
+use Magento\User\Model\User;
+
+/**
+ * U2f key Authentication post controller
+ *
+ * @SuppressWarnings(PHPMD.CouplingBetweenObjects)
+ * @SuppressWarnings(PHPMD.CamelCaseMethodName)
+ */
+class Authpost extends AbstractAction implements HttpPostActionInterface
+{
+    /**
+     * @var Tfa
+     */
+    private $tfa;
+
+    /**
+     * @var Session
+     */
+    private $session;
+
+    /**
+     * @var U2fKey
+     */
+    private $u2fKey;
+
+    /**
+     * @var JsonFactory
+     */
+    private $jsonFactory;
+
+    /**
+     * @var TfaSessionInterface
+     */
+    private $tfaSession;
+
+    /**
+     * @var DataObjectFactory
+     */
+    private $dataObjectFactory;
+
+    /**
+     * @var AlertInterface
+     */
+    private $alert;
+
+    /**
+     * @var U2fSession
+     */
+    private $u2fSession;
+
+    /**
+     * @param Tfa $tfa
+     * @param Session $session
+     * @param JsonFactory $jsonFactory
+     * @param TfaSessionInterface $tfaSession
+     * @param U2fKey $u2fKey
+     * @param U2fSession $u2fSession
+     * @param DataObjectFactory $dataObjectFactory
+     * @param AlertInterface $alert
+     * @param Action\Context $context
+     */
+    public function __construct(
+        Tfa $tfa,
+        Session $session,
+        JsonFactory $jsonFactory,
+        TfaSessionInterface $tfaSession,
+        U2fKey $u2fKey,
+        U2fSession $u2fSession,
+        DataObjectFactory $dataObjectFactory,
+        AlertInterface $alert,
+        Action\Context $context
+    ) {
+        parent::__construct($context);
+
+        $this->tfa = $tfa;
+        $this->session = $session;
+        $this->u2fKey = $u2fKey;
+        $this->jsonFactory = $jsonFactory;
+        $this->tfaSession = $tfaSession;
+        $this->dataObjectFactory = $dataObjectFactory;
+        $this->alert = $alert;
+        $this->u2fSession = $u2fSession;
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function execute()
+    {
+        $result = $this->jsonFactory->create();
+
+        try {
+            $challenge = $this->u2fSession->getU2fChallenge();
+            if (!empty($challenge)) {
+                $this->u2fKey->verify($this->getUser(), $this->dataObjectFactory->create([
+                    'data' => [
+                        'publicKeyCredential' => $this->getRequest()->getParams()['publicKeyCredential'],
+                        'originalChallenge' => $challenge
+                    ]
+                ]));
+                $this->tfaSession->grantAccess();
+                $this->u2fSession->setU2fChallenge(null);
+
+                $res = ['success' => true];
+            } else {
+                $res = ['success' => false];
+            }
+        } catch (Exception $e) {
+            $this->alert->event(
+                'Magento_TwoFactorAuth',
+                'U2F error',
+                AlertInterface::LEVEL_ERROR,
+                $this->getUser()->getUserName(),
+                $e->getMessage()
+            );
+
+            $res = ['success' => false, 'message' => $e->getMessage()];
+        }
+
+        $result->setData($res);
+        return $result;
+    }
+
+    /**
+     * Retrieve the current authenticated user
+     *
+     * @return User|null
+     */
+    private function getUser(): ?User
+    {
+        return $this->session->getUser();
+    }
+
+    /**
+     * Check if admin has permissions to visit related pages
+     *
+     * @return bool
+     */
+    protected function _isAllowed()
+    {
+        $user = $this->getUser();
+
+        return
+            $user &&
+            $this->tfa->getProviderIsAllowed((int) $user->getId(), U2fKey::CODE) &&
+            $this->tfa->getProvider(U2fKey::CODE)->isActive((int) $user->getId());
+    }
+}
diff --git a/TwoFactorAuth/Controller/Adminhtml/U2f/Configure.php b/TwoFactorAuth/Controller/Adminhtml/U2f/Configure.php
new file mode 100644
index 00000000..072492f2
--- /dev/null
+++ b/TwoFactorAuth/Controller/Adminhtml/U2f/Configure.php
@@ -0,0 +1,94 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Controller\Adminhtml\U2f;
+
+use Magento\Backend\App\Action\Context;
+use Magento\Backend\Model\Auth\Session;
+use Magento\Framework\App\Action\HttpGetActionInterface;
+use Magento\Framework\View\Result\PageFactory;
+use Magento\TwoFactorAuth\Controller\Adminhtml\AbstractConfigureAction;
+use Magento\TwoFactorAuth\Model\Provider\Engine\U2fKey;
+use Magento\TwoFactorAuth\Model\Tfa;
+use Magento\User\Model\User;
+use Magento\TwoFactorAuth\Model\UserConfig\HtmlAreaTokenVerifier;
+
+/**
+ * CUbiKey configuration page controller
+ * @SuppressWarnings(PHPMD.CamelCaseMethodName)
+ */
+class Configure extends AbstractConfigureAction implements HttpGetActionInterface
+{
+    /**
+     * @var Tfa
+     */
+    private $tfa;
+
+    /**
+     * @var Session
+     */
+    private $session;
+
+    /**
+     * @var PageFactory
+     */
+    private $pageFactory;
+
+    /**
+     * @param Tfa $tfa
+     * @param Session $session
+     * @param PageFactory $pageFactory
+     * @param Context $context
+     * @param HtmlAreaTokenVerifier $tokenVerifier
+     */
+    public function __construct(
+        Tfa $tfa,
+        Session $session,
+        PageFactory $pageFactory,
+        Context $context,
+        HtmlAreaTokenVerifier $tokenVerifier
+    ) {
+
+        $this->tfa = $tfa;
+        $this->session = $session;
+        parent::__construct($context, $tokenVerifier);
+        $this->pageFactory = $pageFactory;
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function execute()
+    {
+        return $this->pageFactory->create();
+    }
+
+    /**
+     * @return User|null
+     */
+    private function getUser(): ?User
+    {
+        return $this->session->getUser();
+    }
+
+    /**
+     * C@inheritDoc
+     */
+    protected function _isAllowed()
+    {
+        if (!parent::_isAllowed()) {
+            return false;
+        }
+
+        $user = $this->getUser();
+
+        return
+            $user &&
+            $this->tfa->getProviderIsAllowed((int) $user->getId(), U2fKey::CODE) &&
+            !$this->tfa->getProvider(U2fKey::CODE)->isActive((int) $user->getId());
+    }
+}
diff --git a/TwoFactorAuth/Controller/Adminhtml/U2f/Configurepost.php b/TwoFactorAuth/Controller/Adminhtml/U2f/Configurepost.php
new file mode 100644
index 00000000..ecc8ef7e
--- /dev/null
+++ b/TwoFactorAuth/Controller/Adminhtml/U2f/Configurepost.php
@@ -0,0 +1,168 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Controller\Adminhtml\U2f;
+
+use Magento\Backend\App\Action\Context;
+use Magento\Backend\Model\Auth\Session;
+use Magento\Framework\App\Action\HttpPostActionInterface;
+use Magento\Framework\Controller\Result\JsonFactory;
+use Magento\TwoFactorAuth\Model\AlertInterface;
+use Magento\TwoFactorAuth\Api\TfaSessionInterface;
+use Magento\TwoFactorAuth\Controller\Adminhtml\AbstractConfigureAction;
+use Magento\TwoFactorAuth\Model\Provider\Engine\U2fKey;
+use Magento\TwoFactorAuth\Model\Provider\Engine\U2fKey\Session as U2fSession;
+use Magento\TwoFactorAuth\Model\Tfa;
+use Magento\User\Model\User;
+use Magento\TwoFactorAuth\Model\UserConfig\HtmlAreaTokenVerifier;
+
+/**
+ * U2f key configuration post controller
+ *
+ * @SuppressWarnings(PHPMD.CamelCaseMethodName)
+ */
+class Configurepost extends AbstractConfigureAction implements HttpPostActionInterface
+{
+    /**
+     * @var Tfa
+     */
+    private $tfa;
+
+    /**
+     * @var Session
+     */
+    private $session;
+
+    /**
+     * @var U2fKey
+     */
+    private $u2fKey;
+
+    /**
+     * @var JsonFactory
+     */
+    private $jsonFactory;
+
+    /**
+     * @var TfaSessionInterface
+     */
+    private $tfaSession;
+
+    /**
+     * @var AlertInterface
+     */
+    private $alert;
+
+    /**
+     * @var U2fSession
+     */
+    private $u2fSession;
+
+    /**
+     * @param Tfa $tfa
+     * @param Session $session
+     * @param JsonFactory $jsonFactory
+     * @param TfaSessionInterface $tfaSession
+     * @param U2fSession $u2fSession
+     * @param U2fKey $u2fKey
+     * @param AlertInterface $alert
+     * @param Context $context
+     * @param HtmlAreaTokenVerifier $tokenVerifier
+     */
+    public function __construct(
+        Tfa $tfa,
+        Session $session,
+        JsonFactory $jsonFactory,
+        TfaSessionInterface $tfaSession,
+        U2fSession $u2fSession,
+        U2fKey $u2fKey,
+        AlertInterface $alert,
+        Context $context,
+        HtmlAreaTokenVerifier $tokenVerifier
+    ) {
+        parent::__construct($context, $tokenVerifier);
+
+        $this->tfa = $tfa;
+        $this->session = $session;
+        $this->u2fKey = $u2fKey;
+        $this->jsonFactory = $jsonFactory;
+        $this->tfaSession = $tfaSession;
+        $this->alert = $alert;
+        $this->u2fSession = $u2fSession;
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function execute()
+    {
+        $result = $this->jsonFactory->create();
+
+        try {
+            $challenge = $this->u2fSession->getU2fChallenge();
+            if (!empty($challenge)) {
+                $data = [
+                   'publicKeyCredential' => $this->getRequest()->getParam('publicKeyCredential'),
+                   'challenge' => $challenge
+                ];
+
+                $this->u2fKey->registerDevice($this->getUser(), $data);
+                $this->tfaSession->grantAccess();
+                $this->u2fSession->setU2fChallenge(null);
+
+                $this->alert->event(
+                    'Magento_TwoFactorAuth',
+                    'U2F New device registered',
+                    AlertInterface::LEVEL_INFO,
+                    $this->getUser()->getUserName()
+                );
+                $res = ['success' => true];
+            } else {
+                $res = ['success' => false];
+            }
+
+        } catch (\Throwable $e) {
+            $this->alert->event(
+                'Magento_TwoFactorAuth',
+                'U2F error while adding device',
+                AlertInterface::LEVEL_ERROR,
+                $this->getUser()->getUserName(),
+                $e->getMessage()
+            );
+
+            $res = ['success' => false, 'message' => $e->getMessage()];
+        }
+
+        $result->setData($res);
+        return $result;
+    }
+
+    /**
+     * @return User|null
+     */
+    private function getUser(): ?User
+    {
+        return $this->session->getUser();
+    }
+
+    /**
+     * @inheritDoc
+     */
+    protected function _isAllowed()
+    {
+        if (!parent::_isAllowed()) {
+            return false;
+        }
+
+        $user = $this->getUser();
+
+        return
+            $user &&
+            $this->tfa->getProviderIsAllowed((int) $user->getId(), U2fKey::CODE) &&
+            !$this->tfa->getProvider(U2fKey::CODE)->isActive((int) $user->getId());
+    }
+}
diff --git a/TwoFactorAuth/Model/Alert.php b/TwoFactorAuth/Model/Alert.php
new file mode 100644
index 00000000..f07efd55
--- /dev/null
+++ b/TwoFactorAuth/Model/Alert.php
@@ -0,0 +1,67 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Model;
+
+use Magento\Framework\Event\ManagerInterface;
+
+/**
+ * @inheritDoc
+ */
+class Alert implements AlertInterface
+{
+    /**
+     * @var ManagerInterface
+     */
+    private $eventManager;
+
+    /**
+     * @param ManagerInterface $eventManager
+     */
+    public function __construct(
+        ManagerInterface $eventManager
+    ) {
+        $this->eventManager = $eventManager;
+    }
+
+    /**
+     * Trigger a security suite event
+     * @param string $module
+     * @param string $message
+     * @param string $level
+     * @param string $username
+     * @param array|string $payload
+     * @return void
+     */
+    public function event(
+        string $module,
+        string $message,
+        ?string $level = null,
+        ?string $username = null,
+        $payload = null
+    ): void {
+        if ($level === null) {
+            $level = self::LEVEL_INFO;
+        }
+
+        $params = [
+            AlertInterface::ALERT_PARAM_LEVEL => $level,
+            AlertInterface::ALERT_PARAM_MODULE => $module,
+            AlertInterface::ALERT_PARAM_MESSAGE => $message,
+            AlertInterface::ALERT_PARAM_USERNAME => $username,
+            AlertInterface::ALERT_PARAM_PAYLOAD => $payload,
+        ];
+
+        $genericEvent = AlertInterface::EVENT_PREFIX . '_event';
+        $moduleEvent = AlertInterface::EVENT_PREFIX . '_event_' . strtolower($module);
+        $severityEvent = AlertInterface::EVENT_PREFIX . '_level_' . strtolower($level);
+
+        $this->eventManager->dispatch($genericEvent, $params);
+        $this->eventManager->dispatch($moduleEvent, $params);
+        $this->eventManager->dispatch($severityEvent, $params);
+    }
+}
diff --git a/TwoFactorAuth/Model/AlertInterface.php b/TwoFactorAuth/Model/AlertInterface.php
new file mode 100644
index 00000000..1d48f900
--- /dev/null
+++ b/TwoFactorAuth/Model/AlertInterface.php
@@ -0,0 +1,76 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Model;
+
+/**
+ * Alert interface triggered when a security event occurs in 2FA module
+ */
+interface AlertInterface
+{
+    /**
+     * Event prefix for alert
+     */
+    public const EVENT_PREFIX = 'twofactor';
+
+    /**
+     * Alert level "info"
+     */
+    public const LEVEL_INFO = 'info';
+
+    /**
+     * Alert level "warning"
+     */
+    public const LEVEL_WARNING = 'warn';
+
+    /**
+     * Alert level "error"
+     */
+    public const LEVEL_ERROR = 'error';
+
+    /**
+     * Parameter name for "level"
+     */
+    public const ALERT_PARAM_LEVEL = 'level';
+
+    /**
+     * Parameter name for "module"
+     */
+    public const ALERT_PARAM_MODULE = 'module';
+
+    /**
+     * Parameter name for "message"
+     */
+    public const ALERT_PARAM_MESSAGE = 'message';
+
+    /**
+     * Parameter name for "username"
+     */
+    public const ALERT_PARAM_USERNAME = 'username';
+
+    /**
+     * Parameter name for "payload"
+     */
+    public const ALERT_PARAM_PAYLOAD = 'payload';
+
+    /**
+     * Trigger a security suite event
+     * @param string $module
+     * @param string $message
+     * @param string $level
+     * @param string $username
+     * @param array|string $payload
+     * @return void
+     */
+    public function event(
+        string $module,
+        string $message,
+        ?string $level = null,
+        ?string $username = null,
+        $payload = null
+    ): void;
+}
diff --git a/TwoFactorAuth/Model/Config/Backend/Duo/ApiHostname.php b/TwoFactorAuth/Model/Config/Backend/Duo/ApiHostname.php
new file mode 100644
index 00000000..fcc9cc6a
--- /dev/null
+++ b/TwoFactorAuth/Model/Config/Backend/Duo/ApiHostname.php
@@ -0,0 +1,38 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Model\Config\Backend\Duo;
+
+use Magento\Framework\App\Cache\TypeListInterface;
+use Magento\Framework\App\Config\ScopeConfigInterface;
+use Magento\Framework\App\Config\Value;
+use Magento\Framework\Data\Collection\AbstractDb;
+use Magento\Framework\Exception\ValidatorException;
+use Magento\Framework\Model\Context;
+use Magento\Framework\Model\ResourceModel\AbstractResource;
+use Magento\Framework\Registry;
+use Magento\TwoFactorAuth\Api\TfaInterface;
+
+/**
+ * Represent api_hostname field
+ */
+class ApiHostname extends Value
+{
+    /**
+     * @inheritDoc
+     */
+    public function beforeSave()
+    {
+        $value = $this->getValue();
+        if ($value && !preg_match('%^[^./:]+\.duosecurity\.com$%', $value)) {
+            throw new ValidatorException(__('Invalid API hostname.'));
+        }
+
+        return parent::beforeSave();
+    }
+}
diff --git a/TwoFactorAuth/Model/Config/Backend/ForceProviders.php b/TwoFactorAuth/Model/Config/Backend/ForceProviders.php
new file mode 100644
index 00000000..2009dae3
--- /dev/null
+++ b/TwoFactorAuth/Model/Config/Backend/ForceProviders.php
@@ -0,0 +1,85 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Model\Config\Backend;
+
+use Magento\Framework\App\Cache\TypeListInterface;
+use Magento\Framework\App\Config\ScopeConfigInterface;
+use Magento\Framework\App\Config\Value;
+use Magento\Framework\Data\Collection\AbstractDb;
+use Magento\Framework\Exception\ValidatorException;
+use Magento\Framework\Model\Context;
+use Magento\Framework\Model\ResourceModel\AbstractResource;
+use Magento\Framework\Registry;
+use Magento\TwoFactorAuth\Api\TfaInterface;
+
+/**
+ * Managing "Force Providers" config value.
+ */
+class ForceProviders extends Value
+{
+    /**
+     * @var TfaInterface
+     */
+    private $tfa;
+
+    /**
+     * @param Context $context
+     * @param Registry $registry
+     * @param ScopeConfigInterface $config
+     * @param TypeListInterface $cacheTypeList
+     * @param TfaInterface $tfa
+     * @param AbstractResource|null $resource
+     * @param AbstractDb|null $resourceCollection
+     * @param array $data
+     */
+    public function __construct(
+        Context $context,
+        Registry $registry,
+        ScopeConfigInterface $config,
+        TypeListInterface $cacheTypeList,
+        TfaInterface $tfa,
+        AbstractResource $resource = null,
+        AbstractDb $resourceCollection = null,
+        array $data = []
+    ) {
+        parent::__construct(
+            $context,
+            $registry,
+            $config,
+            $cacheTypeList,
+            $resource,
+            $resourceCollection,
+            $data
+        );
+        $this->tfa = $tfa;
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function beforeSave()
+    {
+        $codes = [];
+        $providers = $this->tfa->getAllProviders();
+        foreach ($providers as $provider) {
+            $codes[] = $provider->getCode();
+        }
+
+        $value = $this->getValue();
+        $validValues = is_array($value) ? array_intersect($codes, $value) : [];
+        if (empty($value) || !$validValues) {
+            throw new ValidatorException(__('You have to select at least one Two-Factor Authorization provider'));
+        }
+
+        // Removes invalid codes
+        $this->setValue($validValues);
+
+        return parent::beforeSave();
+    }
+}
diff --git a/TwoFactorAuth/Model/Config/Source/EnabledProvider.php b/TwoFactorAuth/Model/Config/Source/EnabledProvider.php
new file mode 100644
index 00000000..3b85fae2
--- /dev/null
+++ b/TwoFactorAuth/Model/Config/Source/EnabledProvider.php
@@ -0,0 +1,50 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Model\Config\Source;
+
+use Magento\Framework\Data\OptionSourceInterface;
+use Magento\TwoFactorAuth\Api\TfaInterface;
+
+/**
+ * List of enabled providers
+ */
+class EnabledProvider implements OptionSourceInterface
+{
+    /**
+     * @var TfaInterface
+     */
+    private $tfa;
+
+    /**
+     * @param TfaInterface $tfa
+     */
+    public function __construct(
+        TfaInterface $tfa
+    ) {
+        $this->tfa = $tfa;
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function toOptionArray()
+    {
+        $providers = $this->tfa->getAllProviders();
+        $res = [];
+        foreach ($providers as $provider) {
+            if ($provider->isEnabled()) {
+                $res[] = [
+                    'value' => $provider->getCode(),
+                    'label' => $provider->getName(),
+                ];
+            }
+        }
+
+        return $res;
+    }
+}
diff --git a/TwoFactorAuth/Model/Config/Source/Provider.php b/TwoFactorAuth/Model/Config/Source/Provider.php
new file mode 100644
index 00000000..3dc1e6eb
--- /dev/null
+++ b/TwoFactorAuth/Model/Config/Source/Provider.php
@@ -0,0 +1,48 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Model\Config\Source;
+
+use Magento\Framework\Data\OptionSourceInterface;
+use Magento\TwoFactorAuth\Api\TfaInterface;
+
+/**
+ * LIst of 2FA providers
+ */
+class Provider implements OptionSourceInterface
+{
+    /**
+     * @var TfaInterface
+     */
+    private $tfa;
+
+    /**
+     * @param TfaInterface $tfa
+     */
+    public function __construct(
+        TfaInterface $tfa
+    ) {
+        $this->tfa = $tfa;
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function toOptionArray()
+    {
+        $providers = $this->tfa->getAllProviders();
+        $res = [];
+        foreach ($providers as $provider) {
+            $res[] = [
+                'value' => $provider->getCode(),
+                'label' => $provider->getName(),
+            ];
+        }
+
+        return $res;
+    }
+}
diff --git a/TwoFactorAuth/Model/Country.php b/TwoFactorAuth/Model/Country.php
new file mode 100644
index 00000000..b7716965
--- /dev/null
+++ b/TwoFactorAuth/Model/Country.php
@@ -0,0 +1,89 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Model;
+
+use Magento\Framework\Model\AbstractModel;
+use Magento\Framework\Api\DataObjectHelper;
+use Magento\Framework\Data\Collection\AbstractDb;
+use Magento\Framework\Model\Context;
+use Magento\Framework\Model\ResourceModel\AbstractResource;
+use Magento\Framework\Registry;
+use Magento\TwoFactorAuth\Api\Data\CountryInterface;
+use Magento\TwoFactorAuth\Api\Data\CountryInterfaceFactory;
+
+/**
+ * Country Data model
+ *
+ * @SuppressWarnings(PHPMD.LongVariable)
+ * @SuppressWarnings(PHPMD.CamelCaseMethodName)
+ */
+class Country extends AbstractModel
+{
+    /**
+     * @var DataObjectHelper
+     */
+    private $dataObjectHelper;
+
+    /**
+     * @var CountryInterfaceFactory
+     */
+    private $countryDataFactory;
+
+    /**
+     * @param Context $context
+     * @param Registry $registry
+     * @param DataObjectHelper $dataObjectHelper
+     * @param CountryInterfaceFactory $countryDataFactory
+     * @param AbstractResource|null $resource
+     * @param AbstractDb|null $resourceCollection
+     * @param array $data
+     */
+    public function __construct(
+        Context $context,
+        Registry $registry,
+        DataObjectHelper $dataObjectHelper,
+        CountryInterfaceFactory $countryDataFactory,
+        AbstractResource $resource = null,
+        AbstractDb $resourceCollection = null,
+        array $data = []
+    ) {
+        parent::__construct($context, $registry, $resource, $resourceCollection, $data);
+        $this->dataObjectHelper = $dataObjectHelper;
+        $this->countryDataFactory = $countryDataFactory;
+    }
+
+    /**
+     * @inheritDoc
+     */
+    protected function _construct()
+    {
+        $this->_init(ResourceModel\Country::class);
+    }
+
+    /**
+     * Retrieve Country model
+     *
+     * @return CountryInterface
+     */
+    public function getDataModel(): CountryInterface
+    {
+        $countryData = $this->getData();
+
+        /** @var CountryInterface $countryDataObject */
+        $countryDataObject = $this->countryDataFactory->create();
+
+        $this->dataObjectHelper->populateWithArray(
+            $countryDataObject,
+            $countryData,
+            CountryInterface::class
+        );
+        $countryDataObject->setId($this->getId());
+
+        return $countryDataObject;
+    }
+}
diff --git a/TwoFactorAuth/Model/CountryRegistry.php b/TwoFactorAuth/Model/CountryRegistry.php
new file mode 100644
index 00000000..da6364ba
--- /dev/null
+++ b/TwoFactorAuth/Model/CountryRegistry.php
@@ -0,0 +1,88 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Model;
+
+use Magento\TwoFactorAuth\Api\Data\CountryInterface;
+
+/**
+ * Country entity registry
+ *
+ * @SuppressWarnings(PHPMD.ShortVariable)
+ */
+class CountryRegistry
+{
+    /**
+     * @var array
+     */
+    private $registry = [];
+
+    /**
+     * @var array
+     */
+    private $registryByKey = [
+        'code' => [],
+    ];
+
+    /**
+     * Remove registry entity by id
+     * @param int $id
+     */
+    public function removeById(int $id): void
+    {
+        if (isset($this->registry[$id])) {
+            unset($this->registry[$id]);
+        }
+
+        foreach (array_keys($this->registryByKey) as $key) {
+            $reverseMap = array_flip($this->registryByKey[$key]);
+            if (isset($reverseMap[$id])) {
+                unset($this->registryByKey[$key][$reverseMap[$id]]);
+            }
+        }
+    }
+
+    /**
+     * Push one object into registry
+     * @param int $id
+     * @return CountryInterface|null
+     */
+    public function retrieveById(int $id): ?CountryInterface
+    {
+        if (isset($this->registry[$id])) {
+            return $this->registry[$id];
+        }
+
+        return null;
+    }
+
+    /**
+     * Retrieve by Code value
+     * @param string $value
+     * @return CountryInterface|null
+     */
+    public function retrieveByCode(string $value): ?CountryInterface
+    {
+        if (isset($this->registryByKey['code'][$value])) {
+            return $this->retrieveById($this->registryByKey['code'][$value]);
+        }
+
+        return null;
+    }
+
+    /**
+     * Push one object into registry
+     * @param Country $country
+     */
+    public function push(Country $country): void
+    {
+        $this->registry[$country->getId()] = $country->getDataModel();
+        foreach (array_keys($this->registryByKey) as $key) {
+            $this->registryByKey[$key][$country->getData($key)] = $country->getId();
+        }
+    }
+}
diff --git a/TwoFactorAuth/Model/Data/Country.php b/TwoFactorAuth/Model/Data/Country.php
new file mode 100644
index 00000000..6a93dc58
--- /dev/null
+++ b/TwoFactorAuth/Model/Data/Country.php
@@ -0,0 +1,98 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Model\Data;
+
+use Magento\Framework\Api\AbstractExtensibleObject;
+use Magento\TwoFactorAuth\Api\Data\CountryExtensionInterface;
+use Magento\TwoFactorAuth\Api\Data\CountryInterface;
+
+/**
+ * @inheritDoc
+ */
+class Country extends AbstractExtensibleObject implements CountryInterface
+{
+    /**
+     * {@inheritdoc}
+     */
+    public function getId(): int
+    {
+        return (int) $this->_get(self::ID);
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function setId(int $value): void
+    {
+        $this->setData(self::ID, $value);
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function getCode(): string
+    {
+        return (string) $this->_get(self::CODE);
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function setCode(string $value): void
+    {
+        $this->setData(self::CODE, $value);
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function getName(): string
+    {
+        return (string) $this->_get(self::NAME);
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function setName(string $value): void
+    {
+        $this->setData(self::NAME, $value);
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function getDialCode(): string
+    {
+        return (string) $this->_get(self::DIAL_CODE);
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function setDialCode(string $value): void
+    {
+        $this->setData(self::DIAL_CODE, $value);
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function getExtensionAttributes(): ?CountryExtensionInterface
+    {
+        return $this->_get(self::EXTENSION_ATTRIBUTES_KEY);
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function setExtensionAttributes(CountryExtensionInterface $extensionAttributes): void
+    {
+        $this->setData(self::EXTENSION_ATTRIBUTES_KEY, $extensionAttributes);
+    }
+}
diff --git a/TwoFactorAuth/Model/Data/UserConfig.php b/TwoFactorAuth/Model/Data/UserConfig.php
new file mode 100644
index 00000000..487e3c2d
--- /dev/null
+++ b/TwoFactorAuth/Model/Data/UserConfig.php
@@ -0,0 +1,98 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Model\Data;
+
+use Magento\Framework\Api\AbstractExtensibleObject;
+use Magento\TwoFactorAuth\Api\Data\UserConfigExtensionInterface;
+use Magento\TwoFactorAuth\Api\Data\UserConfigInterface;
+
+/**
+ * @inheritDoc
+ */
+class UserConfig extends AbstractExtensibleObject implements UserConfigInterface
+{
+    /**
+     * @inheritDoc
+     */
+    public function getId(): int
+    {
+        return (int) $this->_get(self::ID);
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function setId(int $value): void
+    {
+        $this->setData(self::ID, $value);
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function getUserId(): int
+    {
+        return (int) $this->_get(self::USER_ID);
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function setUserId(int $value): void
+    {
+        $this->setData(self::USER_ID, $value);
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function getEncodedProviders(): string
+    {
+        return (string) $this->_get(self::ENCODED_PROVIDERS);
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function setEncodedProviders(string $value): void
+    {
+        $this->setData(self::ENCODED_PROVIDERS, $value);
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function getDefaultProvider(): string
+    {
+        return (string) $this->_get(self::DEFAULT_PROVIDER);
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function setDefaultProvider(string $value): void
+    {
+        $this->setData(self::DEFAULT_PROVIDER, $value);
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function getExtensionAttributes(): ?UserConfigExtensionInterface
+    {
+        return $this->_get(self::EXTENSION_ATTRIBUTES_KEY);
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function setExtensionAttributes(UserConfigExtensionInterface $extensionAttributes): void
+    {
+        $this->setData(self::EXTENSION_ATTRIBUTES_KEY, $extensionAttributes);
+    }
+}
diff --git a/TwoFactorAuth/Model/EmailUserNotifier.php b/TwoFactorAuth/Model/EmailUserNotifier.php
new file mode 100644
index 00000000..f1cc1801
--- /dev/null
+++ b/TwoFactorAuth/Model/EmailUserNotifier.php
@@ -0,0 +1,125 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Model;
+
+use Magento\Framework\App\Config\ScopeConfigInterface;
+use Magento\Framework\UrlInterface;
+use Magento\Store\Model\StoreManagerInterface;
+use Magento\User\Model\User;
+use Magento\TwoFactorAuth\Api\Exception\NotificationExceptionInterface;
+use Magento\TwoFactorAuth\Api\UserNotifierInterface;
+use Magento\Framework\Mail\Template\TransportBuilder;
+use Magento\TwoFactorAuth\Model\Exception\NotificationException;
+use Psr\Log\LoggerInterface;
+
+/**
+ * @inheritDoc
+ */
+class EmailUserNotifier implements UserNotifierInterface
+{
+    /**
+     * @var ScopeConfigInterface
+     */
+    private $scopeConfig;
+
+    /**
+     * @var TransportBuilder
+     */
+    private $transportBuilder;
+
+    /**
+     * @var StoreManagerInterface
+     */
+    private $storeManager;
+
+    /**
+     * @var LoggerInterface
+     */
+    private $logger;
+
+    /**
+     * @var UrlInterface
+     */
+    private $url;
+
+    /**
+     * @param ScopeConfigInterface $scopeConfig
+     * @param TransportBuilder $transportBuilder
+     * @param StoreManagerInterface $storeManager
+     * @param LoggerInterface $logger
+     * @param UrlInterface $url
+     */
+    public function __construct(
+        ScopeConfigInterface $scopeConfig,
+        TransportBuilder $transportBuilder,
+        StoreManagerInterface $storeManager,
+        LoggerInterface $logger,
+        UrlInterface $url
+    ) {
+        $this->scopeConfig = $scopeConfig;
+        $this->transportBuilder = $transportBuilder;
+        $this->storeManager = $storeManager;
+        $this->logger = $logger;
+        $this->url = $url;
+    }
+
+    /**
+     * Send configuration related message to the admin user.
+     *
+     * @param User $user
+     * @param string $token
+     * @param string $emailTemplateId
+     * @return void
+     * @throws NotificationExceptionInterface
+     */
+    private function sendConfigRequired(User $user, string $token, string $emailTemplateId): void
+    {
+        try {
+            $transport = $this->transportBuilder
+                ->setTemplateIdentifier($emailTemplateId)
+                ->setTemplateOptions([
+                    'area' => 'adminhtml',
+                    'store' => 0
+                ])
+                ->setTemplateVars(
+                    [
+                        'username' => $user->getFirstName() . ' ' . $user->getLastName(),
+                        'token' => $token,
+                        'store_name' => $this->storeManager->getStore()->getFrontendName(),
+                        'url' => $this->url->getUrl('tfa/tfa/index', ['tfat' => $token])
+                    ]
+                )
+                ->setFromByScope(
+                    $this->scopeConfig->getValue('admin/emails/forgot_email_identity')
+                )
+                ->addTo($user->getEmail(), $user->getFirstName() . ' ' . $user->getLastName())
+                ->getTransport();
+            $transport->sendMessage();
+        } catch (\Throwable $exception) {
+            $this->logger->critical($exception);
+            throw new NotificationException('Failed to send 2FA E-mail to a user', 0, $exception);
+        }
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function sendUserConfigRequestMessage(User $user, string $token): void
+    {
+        $this->sendConfigRequired($user, $token, 'tfa_admin_user_config_required');
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function sendAppConfigRequestMessage(User $user, string $token): void
+    {
+        $this->sendConfigRequired($user, $token, 'tfa_admin_app_config_required');
+    }
+}
diff --git a/TwoFactorAuth/Model/Exception/NotificationException.php b/TwoFactorAuth/Model/Exception/NotificationException.php
new file mode 100644
index 00000000..679cac51
--- /dev/null
+++ b/TwoFactorAuth/Model/Exception/NotificationException.php
@@ -0,0 +1,19 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Model\Exception;
+
+use Magento\TwoFactorAuth\Api\Exception\NotificationExceptionInterface;
+
+/**
+ * @inheritDoc
+ */
+class NotificationException extends \RuntimeException implements NotificationExceptionInterface
+{
+
+}
diff --git a/TwoFactorAuth/Model/Provider.php b/TwoFactorAuth/Model/Provider.php
new file mode 100644
index 00000000..266da84f
--- /dev/null
+++ b/TwoFactorAuth/Model/Provider.php
@@ -0,0 +1,212 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Model;
+
+use Magento\Framework\Exception\NoSuchEntityException;
+use Magento\TwoFactorAuth\Api\ProviderInterface;
+use Magento\TwoFactorAuth\Api\UserConfigManagerInterface;
+use Magento\TwoFactorAuth\Api\EngineInterface;
+
+/**
+ * @inheritDoc
+ */
+class Provider implements ProviderInterface
+{
+    /**
+     * @var EngineInterface
+     */
+    private $engine;
+
+    /**
+     * @var string
+     */
+    private $code;
+
+    /**
+     * @var string
+     */
+    private $name;
+
+    /**
+     * @var UserConfigManagerInterface
+     */
+    private $userConfigManager;
+
+    /**
+     * @var string
+     */
+    private $configureAction;
+
+    /**
+     * @var string
+     */
+    private $authAction;
+
+    /**
+     * @var string[]
+     */
+    private $extraActions;
+
+    /**
+     * @var bool
+     */
+    private $canReset;
+
+    /**
+     * @var string
+     */
+    private $icon;
+
+    /**
+     * @param EngineInterface $engine
+     * @param UserConfigManagerInterface $userConfigManager
+     * @param string $code
+     * @param string $name
+     * @param string $icon
+     * @param string $configureAction
+     * @param string $authAction
+     * @param array $extraActions
+     * @param bool $canReset
+     */
+    public function __construct(
+        EngineInterface $engine,
+        UserConfigManagerInterface $userConfigManager,
+        string $code,
+        string $name,
+        string $icon,
+        string $configureAction,
+        string $authAction,
+        array $extraActions = [],
+        bool $canReset = true
+    ) {
+        $this->engine = $engine;
+        $this->userConfigManager = $userConfigManager;
+        $this->code = $code;
+        $this->name = $name;
+        $this->configureAction = $configureAction;
+        $this->authAction = $authAction;
+        $this->extraActions = $extraActions;
+        $this->canReset = $canReset;
+        $this->icon = $icon;
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function isEnabled(): bool
+    {
+        return $this->getEngine()->isEnabled();
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function getEngine(): EngineInterface
+    {
+        return $this->engine;
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function getCode(): string
+    {
+        return $this->code;
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function getName(): string
+    {
+        return $this->name;
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function getIcon(): string
+    {
+        return $this->icon;
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function isResetAllowed(): bool
+    {
+        return $this->canReset;
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function resetConfiguration(int $userId): void
+    {
+        $this->userConfigManager->setProviderConfig($userId, $this->getCode(), null);
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function isConfigured(int $userId): bool
+    {
+        return $this->getConfiguration($userId) !== null;
+    }
+
+    /**
+     * Retrieve user's configuration
+     * @param int $userId
+     * @return array|null
+     * @throws NoSuchEntityException
+     */
+    private function getConfiguration(int $userId): ?array
+    {
+        return $this->userConfigManager->getProviderConfig($userId, $this->getCode());
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function isActive(int $userId): bool
+    {
+        return $this->userConfigManager->isProviderConfigurationActive($userId, $this->getCode());
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function activate(int $userId): void
+    {
+        $this->userConfigManager->activateProviderConfiguration($userId, $this->getCode());
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function getConfigureAction(): string
+    {
+        return $this->configureAction;
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function getAuthAction(): string
+    {
+        return $this->authAction;
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function getExtraActions(): array
+    {
+        return $this->extraActions;
+    }
+}
diff --git a/TwoFactorAuth/Model/Provider/Engine/Authy.php b/TwoFactorAuth/Model/Provider/Engine/Authy.php
new file mode 100644
index 00000000..7487d381
--- /dev/null
+++ b/TwoFactorAuth/Model/Provider/Engine/Authy.php
@@ -0,0 +1,136 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Model\Provider\Engine;
+
+use Magento\Framework\App\Config\ScopeConfigInterface;
+use Magento\Framework\DataObject;
+use Magento\Framework\Exception\LocalizedException;
+use Magento\Framework\HTTP\Client\CurlFactory;
+use Magento\User\Api\Data\UserInterface;
+use Magento\TwoFactorAuth\Api\UserConfigManagerInterface;
+use Magento\TwoFactorAuth\Api\EngineInterface;
+use Magento\TwoFactorAuth\Model\Provider\Engine\Authy\Service;
+use Magento\TwoFactorAuth\Model\Provider\Engine\Authy\Token;
+use Zend\Json\Json;
+
+/**
+ * Authy engine
+ */
+class Authy implements EngineInterface
+{
+    /**
+     * Must be the same as defined in di.xml
+     */
+    public const CODE = 'authy';
+
+    /**
+     * @var UserConfigManagerInterface
+     */
+    private $userConfigManager;
+
+    /**
+     * @var CurlFactory
+     */
+    private $curlFactory;
+
+    /**
+     * @var Service
+     */
+    private $service;
+
+    /**
+     * @var ScopeConfigInterface
+     */
+    private $scopeConfig;
+
+    /**
+     * @var Token
+     */
+    private $token;
+
+    /**
+     * @param UserConfigManagerInterface $userConfigManager
+     * @param ScopeConfigInterface $scopeConfig
+     * @param Token $token
+     * @param Service $service
+     * @param CurlFactory $curlFactory
+     */
+    public function __construct(
+        UserConfigManagerInterface $userConfigManager,
+        ScopeConfigInterface $scopeConfig,
+        Token $token,
+        Service $service,
+        CurlFactory $curlFactory
+    ) {
+        $this->userConfigManager = $userConfigManager;
+        $this->curlFactory = $curlFactory;
+        $this->service = $service;
+        $this->scopeConfig = $scopeConfig;
+        $this->token = $token;
+    }
+
+    /**
+     * Enroll in Authy
+     * @param UserInterface $user
+     * @return bool
+     * @throws LocalizedException
+     */
+    public function enroll(UserInterface $user): bool
+    {
+        $providerInfo = $this->userConfigManager->getProviderConfig((int) $user->getId(), Authy::CODE);
+        if (!isset($providerInfo['country_code'])) {
+            throw new LocalizedException(__('Missing phone information'));
+        }
+
+        $url = $this->service->getProtectedApiEndpoint('users/new');
+        $curl = $this->curlFactory->create();
+
+        $curl->addHeader('X-Authy-API-Key', $this->service->getApiKey());
+        $curl->post($url, [
+            'user[email]' => $user->getEmail(),
+            'user[cellphone]' => $providerInfo['phone_number'],
+            'user[country_code]' => $providerInfo['country_code'],
+        ]);
+
+        $response = Json::decode($curl->getBody(), Json::TYPE_ARRAY);
+
+        $errorMessage = $this->service->getErrorFromResponse($response);
+        if ($errorMessage) {
+            throw new LocalizedException(__($errorMessage));
+        }
+
+        $this->userConfigManager->addProviderConfig((int) $user->getId(), Authy::CODE, [
+            'user' => $response['user']['id'],
+        ]);
+
+        $this->userConfigManager->activateProviderConfiguration((int) $user->getId(), Authy::CODE);
+
+        return true;
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function isEnabled(): bool
+    {
+        try {
+            return !!$this->service->getApiKey();
+        } catch (\TypeError $exception) {
+            //API key is empty, returned null instead of a string
+            return false;
+        }
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function verify(UserInterface $user, DataObject $request): bool
+    {
+        return $this->token->verify($user, $request);
+    }
+}
diff --git a/TwoFactorAuth/Model/Provider/Engine/Authy/OneTouch.php b/TwoFactorAuth/Model/Provider/Engine/Authy/OneTouch.php
new file mode 100644
index 00000000..bb9a3ed6
--- /dev/null
+++ b/TwoFactorAuth/Model/Provider/Engine/Authy/OneTouch.php
@@ -0,0 +1,169 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Model\Provider\Engine\Authy;
+
+use Magento\Framework\App\Config\ScopeConfigInterface;
+use Magento\Framework\Exception\LocalizedException;
+use Magento\Framework\HTTP\Client\CurlFactory;
+use Magento\Store\Model\StoreManagerInterface;
+use Magento\User\Api\Data\UserInterface;
+use Magento\TwoFactorAuth\Api\UserConfigManagerInterface;
+use Magento\TwoFactorAuth\Model\Provider\Engine\Authy;
+use Zend\Json\Json;
+
+/**
+ * Authy One Touch manager class
+ */
+class OneTouch
+{
+    /**
+     * Configuration XML path for one touch message
+     */
+    public const XML_PATH_ONETOUCH_MESSAGE = 'twofactorauth/authy/onetouch_message';
+
+    /**
+     * @var CurlFactory
+     */
+    private $curlFactory;
+
+    /**
+     * @var UserConfigManagerInterface
+     */
+    private $userConfigManager;
+
+    /**
+     * @var StoreManagerInterface
+     */
+    private $storeManager;
+
+    /**
+     * @var Service
+     */
+    private $service;
+
+    /**
+     * @var ScopeConfigInterface
+     */
+    private $scopeConfig;
+
+    /**
+     * OneTouch constructor.
+     *
+     * @param CurlFactory $curlFactory
+     * @param UserConfigManagerInterface $userConfigManager
+     * @param Service $service
+     * @param StoreManagerInterface $storeManager
+     * @param ScopeConfigInterface $scopeConfig
+     */
+    public function __construct(
+        CurlFactory $curlFactory,
+        UserConfigManagerInterface $userConfigManager,
+        Service $service,
+        StoreManagerInterface $storeManager,
+        ScopeConfigInterface $scopeConfig
+    ) {
+        $this->curlFactory = $curlFactory;
+        $this->userConfigManager = $userConfigManager;
+        $this->storeManager = $storeManager;
+        $this->service = $service;
+        $this->scopeConfig = $scopeConfig;
+    }
+
+    /**
+     * Request one-touch
+     * @param UserInterface $user
+     * @throws LocalizedException
+     */
+    public function request(UserInterface $user): void
+    {
+        $providerInfo = $this->userConfigManager->getProviderConfig((int) $user->getId(), Authy::CODE);
+        if (!isset($providerInfo['user'])) {
+            throw new LocalizedException(__('Missing user information'));
+        }
+
+        $url = $this->service->getOneTouchApiEndpoint('users/' . $providerInfo['user'] . '/approval_requests');
+
+        $curl = $this->curlFactory->create();
+        $curl->addHeader('X-Authy-API-Key', $this->service->getApiKey());
+        $curl->post($url, [
+            'message' => $this->scopeConfig->getValue(self::XML_PATH_ONETOUCH_MESSAGE),
+            'details[URL]' => $this->storeManager->getStore()->getBaseUrl(),
+            'details[User]' => $user->getUserName(),
+            'details[Email]' => $user->getEmail(),
+            'seconds_to_expire' => 300,
+        ]);
+
+        $response = Json::decode($curl->getBody(), Json::TYPE_ARRAY);
+
+        $errorMessage = $this->service->getErrorFromResponse($response);
+        if ($errorMessage) {
+            throw new LocalizedException(__($errorMessage));
+        }
+
+        $this->userConfigManager->addProviderConfig((int) $user->getId(), Authy::CODE, [
+            'pending_approval' => $response['approval_request']['uuid'],
+        ]);
+    }
+
+    /**
+     * Verify one-touch
+     * @param UserInterface $user
+     * @return string
+     * @throws LocalizedException
+     */
+    public function verify(UserInterface $user): string
+    {
+        $providerInfo = $this->userConfigManager->getProviderConfig((int) $user->getId(), Authy::CODE);
+        if (!isset($providerInfo['user'])) {
+            throw new LocalizedException(__('Missing user information'));
+        }
+
+        if (!isset($providerInfo['pending_approval'])) {
+            throw new LocalizedException(__('No approval requests for this user'));
+        }
+
+        $approvalCode = $providerInfo['pending_approval'];
+
+        if (!preg_match('/^\w[\w\-]+\w$/', $approvalCode)) {
+            throw new LocalizedException(__('Invalid approval code'));
+        }
+
+        $url = $this->service->getOneTouchApiEndpoint('approval_requests/' . $approvalCode);
+
+        $times = 10;
+
+        for ($i=0; $i<$times; $i++) {
+            $curl = $this->curlFactory->create();
+            $curl->addHeader('X-Authy-API-Key', $this->service->getApiKey());
+            $curl->get($url);
+
+            $response = Json::decode($curl->getBody(), Json::TYPE_ARRAY);
+
+            $errorMessage = $this->service->getErrorFromResponse($response);
+            if ($errorMessage) {
+                throw new LocalizedException(__($errorMessage));
+            }
+
+            $status = $response['approval_request']['status'];
+            if ($status === 'pending') {
+                // @codingStandardsIgnoreStart
+                sleep(1); // I know... but it is the only option I have here
+                // @codingStandardsIgnoreEnd
+                continue;
+            }
+
+            if ($status === 'approved') {
+                return $status;
+            }
+
+            return $status;
+        }
+
+        return 'retry';
+    }
+}
diff --git a/TwoFactorAuth/Model/Provider/Engine/Authy/Service.php b/TwoFactorAuth/Model/Provider/Engine/Authy/Service.php
new file mode 100644
index 00000000..38fafa3e
--- /dev/null
+++ b/TwoFactorAuth/Model/Provider/Engine/Authy/Service.php
@@ -0,0 +1,86 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Model\Provider\Engine\Authy;
+
+use Magento\Framework\App\Config\ScopeConfigInterface;
+
+/**
+ * Authy service management
+ */
+class Service
+{
+    /**
+     * Configuration XML path for API key
+     */
+    public const XML_PATH_API_KEY = 'twofactorauth/authy/api_key';
+
+    /**
+     * Authy API endpoint
+     */
+    public const AUTHY_BASE_ENDPOINT = 'https://api.authy.com/';
+
+    /**
+     * @var ScopeConfigInterface
+     */
+    private $scopeConfig;
+
+    /**
+     * @param ScopeConfigInterface $scopeConfig
+     */
+    public function __construct(ScopeConfigInterface $scopeConfig)
+    {
+        $this->scopeConfig = $scopeConfig;
+    }
+
+    /**
+     * Get API key
+     * @return string
+     */
+    public function getApiKey(): string
+    {
+        return (string) $this->scopeConfig->getValue(static::XML_PATH_API_KEY);
+    }
+
+    /**
+     * Get authy API endpoint
+     * @param string $path
+     * @return string
+     */
+    public function getProtectedApiEndpoint(string $path): string
+    {
+        return static::AUTHY_BASE_ENDPOINT . 'protected/json/' . $path;
+    }
+
+    /**
+     * Get authy API endpoint
+     * @param string $path
+     * @return string
+     */
+    public function getOneTouchApiEndpoint(string $path): string
+    {
+        return static::AUTHY_BASE_ENDPOINT . 'onetouch/json/' . $path;
+    }
+
+    /**
+     * Get error from response
+     * @param array|boolean $response
+     * @return string|null
+     */
+    public function getErrorFromResponse($response): ?string
+    {
+        if ($response === false) {
+            return 'Invalid authy webservice response';
+        }
+
+        if (!isset($response['success']) || !$response['success']) {
+            return $response['message'];
+        }
+
+        return null;
+    }
+}
diff --git a/TwoFactorAuth/Model/Provider/Engine/Authy/Token.php b/TwoFactorAuth/Model/Provider/Engine/Authy/Token.php
new file mode 100644
index 00000000..dd7d70ff
--- /dev/null
+++ b/TwoFactorAuth/Model/Provider/Engine/Authy/Token.php
@@ -0,0 +1,118 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Model\Provider\Engine\Authy;
+
+use Magento\Framework\DataObject;
+use Magento\Framework\Exception\LocalizedException;
+use Magento\Framework\HTTP\Client\CurlFactory;
+use Magento\User\Api\Data\UserInterface;
+use Magento\TwoFactorAuth\Api\UserConfigManagerInterface;
+use Magento\TwoFactorAuth\Model\Provider\Engine\Authy;
+use Zend\Json\Json;
+
+/**
+ * Authy token manager
+ */
+class Token
+{
+    /**
+     * @var UserConfigManagerInterface
+     */
+    private $userConfigManager;
+
+    /**
+     * @var CurlFactory
+     */
+    private $curlFactory;
+
+    /**
+     * @var Service
+     */
+    private $service;
+
+    /**
+     * @param UserConfigManagerInterface $userConfigManager
+     * @param Service $service
+     * @param CurlFactory $curlFactory
+     */
+    public function __construct(
+        UserConfigManagerInterface $userConfigManager,
+        Service $service,
+        CurlFactory $curlFactory
+    ) {
+        $this->userConfigManager = $userConfigManager;
+        $this->curlFactory = $curlFactory;
+        $this->service = $service;
+    }
+
+    /**
+     * Request a token
+     * @param UserInterface $user
+     * @param string $via
+     * @throws LocalizedException
+     */
+    public function request(UserInterface $user, string $via): void
+    {
+        if (!in_array($via, ['call', 'sms'])) {
+            throw new LocalizedException(__('Unsupported via method'));
+        }
+
+        $providerInfo = $this->userConfigManager->getProviderConfig((int) $user->getId(), Authy::CODE);
+        if (!isset($providerInfo['user'])) {
+            throw new LocalizedException(__('Missing user information'));
+        }
+
+        $url = $this->service->getProtectedApiEndpoint('' . $via . '/' . $providerInfo['user']) . '?force=true';
+
+        $curl = $this->curlFactory->create();
+        $curl->addHeader('X-Authy-API-Key', $this->service->getApiKey());
+        $curl->get($url);
+
+        $response = Json::decode($curl->getBody(), Json::TYPE_ARRAY);
+
+        $errorMessage = $this->service->getErrorFromResponse($response);
+        if ($errorMessage) {
+            throw new LocalizedException(__($errorMessage));
+        }
+    }
+
+    /**
+     * Return true on token validation
+     * @param UserInterface $user
+     * @param DataObject $request
+     * @return bool
+     * @throws LocalizedException
+     */
+    public function verify(UserInterface $user, DataObject $request): bool
+    {
+        $code = $request->getData('tfa_code');
+        if (!preg_match('/^\w+$/', $code)) {
+            throw new LocalizedException(__('Invalid code format'));
+        }
+
+        $providerInfo = $this->userConfigManager->getProviderConfig((int) $user->getId(), Authy::CODE);
+        if (!isset($providerInfo['user'])) {
+            throw new LocalizedException(__('Missing user information'));
+        }
+
+        $url = $this->service->getProtectedApiEndpoint('verify/' . $code . '/' . $providerInfo['user']);
+
+        $curl = $this->curlFactory->create();
+        $curl->addHeader('X-Authy-API-Key', $this->service->getApiKey());
+        $curl->get($url);
+
+        $response = Json::decode($curl->getBody(), Json::TYPE_ARRAY);
+
+        $errorMessage = $this->service->getErrorFromResponse($response);
+        if ($errorMessage) {
+            throw new LocalizedException(__($errorMessage));
+        }
+
+        return true;
+    }
+}
diff --git a/TwoFactorAuth/Model/Provider/Engine/Authy/Verification.php b/TwoFactorAuth/Model/Provider/Engine/Authy/Verification.php
new file mode 100644
index 00000000..5d46664e
--- /dev/null
+++ b/TwoFactorAuth/Model/Provider/Engine/Authy/Verification.php
@@ -0,0 +1,145 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Model\Provider\Engine\Authy;
+
+use Magento\Framework\Exception\LocalizedException;
+use Magento\Framework\HTTP\Client\CurlFactory;
+use Magento\Framework\Stdlib\DateTime\DateTime;
+use Magento\User\Api\Data\UserInterface;
+use Magento\TwoFactorAuth\Api\UserConfigManagerInterface;
+use Magento\TwoFactorAuth\Model\Provider\Engine\Authy;
+use Zend\Json\Json;
+
+/**
+ * Authy verification management
+ */
+class Verification
+{
+    /**
+     * @var CurlFactory
+     */
+    private $curlFactory;
+
+    /**
+     * @var Service
+     */
+    private $service;
+
+    /**
+     * @var UserConfigManagerInterface
+     */
+    private $userConfigManager;
+
+    /**
+     * @var DateTime
+     */
+    private $dateTime;
+
+    /**
+     * @param CurlFactory $curlFactory
+     * @param DateTime $dateTime
+     * @param UserConfigManagerInterface $userConfigManager
+     * @param Service $service
+     */
+    public function __construct(
+        CurlFactory $curlFactory,
+        DateTime $dateTime,
+        UserConfigManagerInterface $userConfigManager,
+        Service $service
+    ) {
+        $this->curlFactory = $curlFactory;
+        $this->service = $service;
+        $this->userConfigManager = $userConfigManager;
+        $this->dateTime = $dateTime;
+    }
+
+    /**
+     * Verify phone number
+     * @param UserInterface $user
+     * @param string $country
+     * @param string $phoneNumber
+     * @param string $method
+     * @param array &$response
+     * @throws LocalizedException
+     */
+    public function request(
+        UserInterface $user,
+        string $country,
+        string $phoneNumber,
+        string $method,
+        array &$response
+    ): void {
+        $url = $this->service->getProtectedApiEndpoint('phones/verification/start');
+
+        $curl = $this->curlFactory->create();
+        $curl->addHeader('X-Authy-API-Key', $this->service->getApiKey());
+        $curl->post($url, [
+            'via' => $method,
+            'country_code' => $country,
+            'phone_number' => $phoneNumber
+        ]);
+
+        $response = Json::decode($curl->getBody(), Json::TYPE_ARRAY);
+
+        $errorMessage = $this->service->getErrorFromResponse($response);
+        if ($errorMessage) {
+            throw new LocalizedException(__($errorMessage));
+        }
+
+        $this->userConfigManager->addProviderConfig((int) $user->getId(), Authy::CODE, [
+            'country_code' => $country,
+            'phone_number' => $phoneNumber,
+            'carrier' => $response['carrier'],
+            'mobile' => $response['is_cellphone'],
+            'verify' => [
+                'uuid' => $response['uuid'],
+                'via' => $method,
+                'expires' => $this->dateTime->timestamp() + $response['seconds_to_expire'],
+                'seconds_to_expire' => $response['seconds_to_expire'],
+                'message' => $response['message'],
+            ],
+            'phone_confirmed' => false,
+        ]);
+    }
+
+    /**
+     * Verify phone number
+     * @param UserInterface $user
+     * @param string $verificationCode
+     * @throws LocalizedException
+     */
+    public function verify(UserInterface $user, string $verificationCode): void
+    {
+        $providerInfo = $this->userConfigManager->getProviderConfig((int) $user->getId(), Authy::CODE);
+        if (!isset($providerInfo['country_code'])) {
+            throw new LocalizedException(__('Missing verify request information'));
+        }
+
+        $url = $this->service->getProtectedApiEndpoint('phones/verification/check');
+
+        $curl = $this->curlFactory->create();
+        $curl->addHeader('X-Authy-API-Key', $this->service->getApiKey());
+        $curl->get($url . '?' . http_build_query([
+                'country_code' => $providerInfo['country_code'],
+                'phone_number' => $providerInfo['phone_number'],
+                'verification_code' => $verificationCode,
+            ]));
+
+        $response = Json::decode($curl->getBody(), Json::TYPE_ARRAY);
+
+        $errorMessage = $this->service->getErrorFromResponse($response);
+        if ($errorMessage) {
+            throw new LocalizedException(__($errorMessage));
+        }
+
+        $this->userConfigManager->addProviderConfig((int) $user->getId(), Authy::CODE, [
+            'phone_confirmed' => true,
+        ]);
+        $this->userConfigManager->activateProviderConfiguration((int) $user->getId(), Authy::CODE);
+    }
+}
diff --git a/TwoFactorAuth/Model/Provider/Engine/DuoSecurity.php b/TwoFactorAuth/Model/Provider/Engine/DuoSecurity.php
new file mode 100644
index 00000000..1be0abe1
--- /dev/null
+++ b/TwoFactorAuth/Model/Provider/Engine/DuoSecurity.php
@@ -0,0 +1,252 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Model\Provider\Engine;
+
+use Magento\Framework\App\Config\ScopeConfigInterface;
+use Magento\Framework\DataObject;
+use Magento\User\Api\Data\UserInterface;
+use Magento\TwoFactorAuth\Api\EngineInterface;
+
+/**
+ * Duo Security engine
+ */
+class DuoSecurity implements EngineInterface
+{
+    /**
+     * Engine code
+     */
+    public const CODE = 'duo_security'; // Must be the same as defined in di.xml
+
+    /**
+     * Duo request prefix
+     */
+    public const DUO_PREFIX = 'TX';
+
+    /**
+     * Duo app prefix
+     */
+    public const APP_PREFIX = 'APP';
+
+    /**
+     * Duo auth prefix
+     */
+    public const AUTH_PREFIX = 'AUTH';
+
+    /**
+     * Duo expire time
+     */
+    public const DUO_EXPIRE = 300;
+
+    /**
+     * Application expire time
+     */
+    public const APP_EXPIRE = 3600;
+
+    /**
+     * Configuration XML path for enabled flag
+     */
+    public const XML_PATH_ENABLED = 'twofactorauth/duo/enabled';
+
+    /**
+     * Configuration XML path for integration key
+     */
+    public const XML_PATH_INTEGRATION_KEY = 'twofactorauth/duo/integration_key';
+
+    /**
+     * Configuration XML path for secret key
+     */
+    public const XML_PATH_SECRET_KEY = 'twofactorauth/duo/secret_key';
+
+    /**
+     * Configuration XML path for host name
+     */
+    public const XML_PATH_API_HOSTNAME = 'twofactorauth/duo/api_hostname';
+
+    /**
+     * Configuration XML path for application key
+     */
+    public const XML_PATH_APPLICATION_KEY = 'twofactorauth/duo/application_key';
+
+    /**
+     * @var ScopeConfigInterface
+     */
+    private $scopeConfig;
+
+    /**
+     * @param ScopeConfigInterface $scopeConfig
+     */
+    public function __construct(
+        ScopeConfigInterface $scopeConfig
+    ) {
+        $this->scopeConfig = $scopeConfig;
+    }
+
+    /**
+     * Get API hostname
+     * @return string
+     */
+    public function getApiHostname(): string
+    {
+        return $this->scopeConfig->getValue(static::XML_PATH_API_HOSTNAME);
+    }
+
+    /**
+     * Get application key
+     * @return string
+     */
+    private function getApplicationKey(): string
+    {
+        return $this->scopeConfig->getValue(static::XML_PATH_APPLICATION_KEY);
+    }
+
+    /**
+     * Get secret key
+     * @return string
+     */
+    private function getSecretKey(): string
+    {
+        return $this->scopeConfig->getValue(static::XML_PATH_SECRET_KEY);
+    }
+
+    /**
+     * Get integration key
+     * @return string
+     */
+    private function getIntegrationKey(): string
+    {
+        return $this->scopeConfig->getValue(static::XML_PATH_INTEGRATION_KEY);
+    }
+
+    /**
+     * Sign values
+     * @param string $key
+     * @param string $values
+     * @param string $prefix
+     * @param int $expire
+     * @param int $time
+     * @return string
+     */
+    private function signValues(string $key, string $values, string $prefix, int $expire, int $time): string
+    {
+        $exp = $time + $expire;
+        $cookie = $prefix . '|' . base64_encode($values . '|' . $exp);
+
+        $sig = hash_hmac('sha1', $cookie, $key);
+        return $cookie . '|' . $sig;
+    }
+
+    /**
+     * Parse signed values and return username
+     * @param string $key
+     * @param string $val
+     * @param string $prefix
+     * @param int $time
+     * @return string|null
+     */
+    private function parseValues(string $key, string $val, string $prefix, int $time): ?string
+    {
+        $integrationKey = $this->getIntegrationKey();
+
+        $timestamp = ($time ? $time : time());
+
+        $parts = explode('|', $val);
+        if (count($parts) !== 3) {
+            return null;
+        }
+        [$uPrefix, $uB64, $uSig] = $parts;
+
+        $sig = hash_hmac('sha1', $uPrefix . '|' . $uB64, $key);
+        if (hash_hmac('sha1', $sig, $key) !== hash_hmac('sha1', $uSig, $key)) {
+            return null;
+        }
+
+        if ($uPrefix !== $prefix) {
+            return null;
+        }
+
+        // @codingStandardsIgnoreStart
+        $cookieParts = explode('|', base64_decode($uB64));
+        // @codingStandardsIgnoreEnd
+
+        if (count($cookieParts) !== 3) {
+            return null;
+        }
+        [$user, $uIkey, $exp] = $cookieParts;
+
+        if ($uIkey !== $integrationKey) {
+            return null;
+        }
+        if ($timestamp >= (int) $exp) {
+            return null;
+        }
+
+        return $user;
+    }
+
+    /**
+     * Get request signature
+     * @param UserInterface $user
+     * @return string
+     */
+    public function getRequestSignature(UserInterface $user): string
+    {
+        $time = time();
+
+        $values = $user->getUserName() . '|' . $this->getIntegrationKey();
+        $duoSignature = $this->signValues(
+            $this->getSecretKey(),
+            $values,
+            static::DUO_PREFIX,
+            static::DUO_EXPIRE,
+            $time
+        );
+        $appSignature = $this->signValues(
+            $this->getApplicationKey(),
+            $values,
+            static::APP_PREFIX,
+            static::APP_EXPIRE,
+            $time
+        );
+
+        return $duoSignature . ':' . $appSignature;
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function verify(UserInterface $user, DataObject $request): bool
+    {
+        $time = time();
+
+        $signatures = explode(':', (string)$request->getData('sig_response'));
+        if (count($signatures) !== 2) {
+            return false;
+        }
+        [$authSig, $appSig] = $signatures;
+
+        $authUser = $this->parseValues($this->getSecretKey(), $authSig, static::AUTH_PREFIX, $time);
+        $appUser = $this->parseValues($this->getApplicationKey(), $appSig, static::APP_PREFIX, $time);
+
+        return (($authUser === $appUser) && ($appUser === $user->getUserName()));
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function isEnabled(): bool
+    {
+        try {
+            return !!$this->getApiHostname() &&
+                !!$this->getIntegrationKey() &&
+                !!$this->getSecretKey();
+        } catch (\TypeError $exception) {
+            //At least one of the methods returned null instead of a string
+            return false;
+        }
+    }
+}
diff --git a/TwoFactorAuth/Model/Provider/Engine/Google.php b/TwoFactorAuth/Model/Provider/Engine/Google.php
new file mode 100644
index 00000000..cfa85474
--- /dev/null
+++ b/TwoFactorAuth/Model/Provider/Engine/Google.php
@@ -0,0 +1,182 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Model\Provider\Engine;
+
+use Endroid\QrCode\Exception\ValidationException;
+use Endroid\QrCode\QrCode;
+use Endroid\QrCode\Writer\PngWriter;
+use Exception;
+use Magento\Framework\DataObject;
+use Magento\Framework\Exception\NoSuchEntityException;
+use Magento\Store\Model\StoreManagerInterface;
+use Magento\User\Api\Data\UserInterface;
+use Magento\TwoFactorAuth\Api\UserConfigManagerInterface;
+use Magento\TwoFactorAuth\Api\EngineInterface;
+use Base32\Base32;
+use OTPHP\TOTP;
+
+/**
+ * Google authenticator engine
+ */
+class Google implements EngineInterface
+{
+    /**
+     * Engine code
+     *
+     * Must be the same as defined in di.xml
+     */
+    public const CODE = 'google';
+
+    /**
+     * @var null
+     */
+    private $totp = null;
+
+    /**
+     * @var UserConfigManagerInterface
+     */
+    private $configManager;
+
+    /**
+     * @var StoreManagerInterface
+     */
+    private $storeManager;
+
+    /**
+     * @param StoreManagerInterface $storeManager
+     * @param \Magento\Framework\App\Config\ScopeConfigInterface $scopeConfig
+     * @param UserConfigManagerInterface $configManager
+     */
+    public function __construct(
+        StoreManagerInterface $storeManager,
+        \Magento\Framework\App\Config\ScopeConfigInterface $scopeConfig,
+        UserConfigManagerInterface $configManager
+    ) {
+        $this->configManager = $configManager;
+        $this->storeManager = $storeManager;
+    }
+
+    /**
+     * Generate random secret
+     * @return string
+     * @throws Exception
+     */
+    private function generateSecret(): string
+    {
+        $secret = random_bytes(128);
+        return preg_replace('/[^A-Za-z0-9]/', '', Base32::encode($secret));
+    }
+
+    /**
+     * Get TOTP object
+     * @param UserInterface $user
+     * @return TOTP
+     * @throws NoSuchEntityException
+     */
+    private function getTotp(UserInterface $user): TOTP
+    {
+        $config = $this->configManager->getProviderConfig((int)$user->getId(), static::CODE);
+        if (!isset($config['secret'])) {
+            $config['secret'] = $this->getSecretCode($user);
+        }
+        if (!$config['secret']) {
+            throw new NoSuchEntityException(__('Secret for user with ID#%1 was not found', $user->getId()));
+        }
+        $totp = new TOTP($user->getEmail(), $config['secret']);
+
+        return $totp;
+    }
+
+    /**
+     * Get the secret code used for Google Authentication
+     * @param UserInterface $user
+     * @return string|null
+     * @throws NoSuchEntityException
+     * @author Konrad Skrzynski <konrad.skrzynski@accenture.com>
+     */
+    public function getSecretCode(UserInterface $user): ?string
+    {
+        $config = $this->configManager->getProviderConfig((int)$user->getId(), static::CODE);
+
+        if (!isset($config['secret'])) {
+            $config['secret'] = $this->generateSecret();
+            $this->configManager->setProviderConfig((int)$user->getId(), static::CODE, $config);
+        }
+
+        return $config['secret'] ?? null;
+    }
+
+    /**
+     * Get TFA provisioning URL
+     * @param UserInterface $user
+     * @return string
+     * @throws NoSuchEntityException
+     */
+    private function getProvisioningUrl(UserInterface $user): string
+    {
+        $baseUrl = $this->storeManager->getStore()->getBaseUrl();
+
+        // @codingStandardsIgnoreStart
+        $issuer = parse_url($baseUrl, PHP_URL_HOST);
+        // @codingStandardsIgnoreEnd
+
+        $totp = $this->getTotp($user);
+        $totp->setIssuer($issuer);
+
+        return $totp->getProvisioningUri();
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function verify(UserInterface $user, DataObject $request): bool
+    {
+        $token = $request->getData('tfa_code');
+        if (!$token) {
+            return false;
+        }
+
+        $totp = $this->getTotp($user);
+        $totp->now();
+
+        return $totp->verify($token);
+    }
+
+    /**
+     * Render TFA QrCode
+     * @param UserInterface $user
+     * @return string
+     * @throws NoSuchEntityException
+     * @throws ValidationException
+     */
+    public function getQrCodeAsPng(UserInterface $user): string
+    {
+        // @codingStandardsIgnoreStart
+        $qrCode = new QrCode($this->getProvisioningUrl($user));
+        $qrCode->setSize(400);
+        $qrCode->setErrorCorrectionLevel('high');
+        $qrCode->setForegroundColor(['r' => 0, 'g' => 0, 'b' => 0, 'a' => 0]);
+        $qrCode->setBackgroundColor(['r' => 255, 'g' => 255, 'b' => 255, 'a' => 0]);
+        $qrCode->setLabelFontSize(16);
+        $qrCode->setEncoding('UTF-8');
+
+        $writer = new PngWriter();
+        $pngData = $writer->writeString($qrCode);
+        // @codingStandardsIgnoreEnd
+
+        return $pngData;
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function isEnabled(): bool
+    {
+        return true;
+    }
+}
diff --git a/TwoFactorAuth/Model/Provider/Engine/U2fKey.php b/TwoFactorAuth/Model/Provider/Engine/U2fKey.php
new file mode 100644
index 00000000..a6725caf
--- /dev/null
+++ b/TwoFactorAuth/Model/Provider/Engine/U2fKey.php
@@ -0,0 +1,149 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Model\Provider\Engine;
+
+use Magento\Framework\DataObject;
+use Magento\Framework\Exception\LocalizedException;
+use Magento\Framework\Exception\NoSuchEntityException;
+use Magento\Store\Model\StoreManagerInterface;
+use Magento\TwoFactorAuth\Model\Provider\Engine\U2fKey\WebAuthn;
+use Magento\User\Api\Data\UserInterface;
+use Magento\TwoFactorAuth\Api\UserConfigManagerInterface;
+use Magento\TwoFactorAuth\Api\EngineInterface;
+
+/**
+ * UbiKey engine
+ */
+class U2fKey implements EngineInterface
+{
+    /**
+     * Engine code
+     *
+     * Must be the same as defined in di.xml
+     */
+    public const CODE = 'u2fkey';
+
+    /**
+     * @var UserConfigManagerInterface
+     */
+    private $userConfigManager;
+
+    /**
+     * @var StoreManagerInterface
+     */
+    private $storeManager;
+
+    /**
+     * @var WebAuthn
+     */
+    private $webAuthn;
+
+    /**
+     * @param StoreManagerInterface $storeManager
+     * @param UserConfigManagerInterface $userConfigManager
+     * @param WebAuthn $webAuthn
+     */
+    public function __construct(
+        StoreManagerInterface $storeManager,
+        UserConfigManagerInterface $userConfigManager,
+        WebAuthn $webAuthn
+    ) {
+        $this->userConfigManager = $userConfigManager;
+        $this->storeManager = $storeManager;
+        $this->webAuthn = $webAuthn;
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function verify(UserInterface $user, DataObject $request): bool
+    {
+        $registration = $this->getRegistration($user);
+        if ($registration === null) {
+            throw new LocalizedException(__('Missing registration data'));
+        }
+
+        $this->webAuthn->assertCredentialDataIsValid(
+            $request->getData('publicKeyCredential'),
+            $registration['public_keys'],
+            $request->getData('originalChallenge')
+        );
+
+        return true;
+    }
+
+    /**
+     * Create the registration challenge
+     *
+     * @param UserInterface $user
+     * @return array
+     * @throws LocalizedException
+     */
+    public function getRegisterData(UserInterface $user): array
+    {
+        return $this->webAuthn->getRegisterData($user);
+    }
+
+    /**
+     * Get authenticate data
+     *
+     * @param UserInterface $user
+     * @return array
+     * @throws LocalizedException
+     */
+    public function getAuthenticateData(UserInterface $user): array
+    {
+        return $this->webAuthn->getAuthenticateData($this->getRegistration($user)['public_keys']);
+    }
+
+    /**
+     * Get registration information
+     *
+     * @param UserInterface $user
+     * @return array
+     * @throws NoSuchEntityException
+     */
+    private function getRegistration(UserInterface $user): array
+    {
+        $providerConfig = $this->userConfigManager->getProviderConfig((int) $user->getId(), static::CODE);
+
+        if (!isset($providerConfig['registration'])) {
+            return null;
+        }
+
+        return $providerConfig['registration'];
+    }
+
+    /**
+     * Register a new key
+     *
+     * @param UserInterface $user
+     * @param array $data
+     * @throws NoSuchEntityException
+     * @throws \Magento\Framework\Validation\ValidationException
+     */
+    public function registerDevice(UserInterface $user, array $data): void
+    {
+        $publicKey = $this->webAuthn->getPublicKeyFromRegistrationData($data);
+
+        $this->userConfigManager->addProviderConfig((int) $user->getId(), static::CODE, [
+            'registration' => [
+                'public_keys' => [$publicKey]
+            ]
+        ]);
+        $this->userConfigManager->activateProviderConfiguration((int) $user->getId(), static::CODE);
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function isEnabled(): bool
+    {
+        return true;
+    }
+}
diff --git a/TwoFactorAuth/Model/Provider/Engine/U2fKey/Session.php b/TwoFactorAuth/Model/Provider/Engine/U2fKey/Session.php
new file mode 100644
index 00000000..8ec49a84
--- /dev/null
+++ b/TwoFactorAuth/Model/Provider/Engine/U2fKey/Session.php
@@ -0,0 +1,39 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Model\Provider\Engine\U2fKey;
+
+use Magento\Framework\Session\SessionManager;
+
+/**
+ * Represents u2f key session data
+ */
+class Session extends SessionManager
+{
+    const CHALLENGE_KEY = 'tfa_u2f_challenge';
+
+    /**
+     * Get the current challenge given to the user
+     *
+     * @return array|null
+     */
+    public function getU2fChallenge(): ?array
+    {
+        return $this->storage->getData(static::CHALLENGE_KEY);
+    }
+
+    /**
+     * Set the current challenge data
+     *
+     * @param array|null $challenge
+     */
+    public function setU2fChallenge(?array $challenge): void
+    {
+        $this->storage->setData(static::CHALLENGE_KEY, $challenge);
+    }
+}
diff --git a/TwoFactorAuth/Model/Provider/Engine/U2fKey/WebAuthn.php b/TwoFactorAuth/Model/Provider/Engine/U2fKey/WebAuthn.php
new file mode 100644
index 00000000..53d0c7a7
--- /dev/null
+++ b/TwoFactorAuth/Model/Provider/Engine/U2fKey/WebAuthn.php
@@ -0,0 +1,400 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Model\Provider\Engine\U2fKey;
+
+use CBOR\CBOREncoder;
+use Magento\Framework\Exception\LocalizedException;
+use Magento\Framework\Validation\ValidationException;
+use Magento\Store\Model\Store;
+use Magento\Store\Model\StoreManagerInterface;
+use Magento\User\Api\Data\UserInterface;
+
+/**
+ * Basic behavior for WebAuthn operations
+ */
+class WebAuthn
+{
+    /**
+     * @see https://tools.ietf.org/html/rfc8152
+     */
+    private const ES256 = -7;
+
+    private const PUBKEY_LEN = 65;
+
+    /**
+     * @var StoreManagerInterface
+     */
+    private $storeManager;
+
+    /**
+     * @param StoreManagerInterface $storeManager
+     */
+    public function __construct(
+        StoreManagerInterface $storeManager
+    ) {
+        $this->storeManager = $storeManager;
+    }
+
+    /**
+     * Analyze a PublicKeyCredential object and verify it is valid
+     *
+     * @param array $credentialData
+     * @param array $publicKeys
+     * @param array $originalChallenge
+     * @throws LocalizedException
+     */
+    public function assertCredentialDataIsValid(
+        array $credentialData,
+        array $publicKeys,
+        array $originalChallenge
+    ): void {
+        // Verification process as defined by w3 https://www.w3.org/TR/webauthn/#verifying-assertion
+
+        // Step 1-3
+        $key = false;
+        foreach ($publicKeys as $registeredKey) {
+            if ($registeredKey['id'] === $credentialData['id']) {
+                $key = $registeredKey;
+                break;
+            }
+        }
+
+        if (empty($key)) {
+            throw new LocalizedException(__('Invalid U2F key.'));
+        }
+
+        $domain = $this->getDomainName();
+
+        // Steps 7-9
+        if (rtrim(strtr(base64_encode($this->convertArrayToBytes($originalChallenge)), '+/', '-_'), '=')
+            !== $credentialData['response']['clientData']['challenge']
+            || 'https://' . $domain !== $credentialData['response']['clientData']['origin']
+            || $credentialData['response']['clientData']['type'] !== 'webauthn.get'
+        ) {
+            throw new LocalizedException(__('Invalid U2F key.'));
+        }
+
+        // Step 10 not applicable
+
+        // @see https://www.w3.org/TR/webauthn/#sec-authenticator-data
+        $authenticatorDataBytes = base64_decode($credentialData['response']['authenticatorData']);
+        $attestationObject = [
+            'rpIdHash' => substr($authenticatorDataBytes, 0, 32),
+            'flags' => ord(substr($authenticatorDataBytes, 32, 1)),
+            'counter' => substr($authenticatorDataBytes, 33, 4),
+        ];
+
+        // Steps 11-12 (skipping 13 due to some devices failing to set the flags correctly)
+        $hashId = hash('sha256', $domain, true);
+        if ($hashId !== $attestationObject['rpIdHash']
+            || !($attestationObject['flags'] & 0b1)
+        ) {
+            throw new LocalizedException(__('Invalid U2F key.'));
+        }
+
+        // Steps 15-16
+        $clientDataSha256 = hash('sha256', $credentialData['response']['clientDataJSON'], true);
+        $isValidSignature = openssl_verify(
+            $authenticatorDataBytes . $clientDataSha256,
+            base64_decode($credentialData['response']['signature']),
+            $key['key'],
+            OPENSSL_ALGO_SHA256
+        );
+        if (!$isValidSignature) {
+            throw new LocalizedException(__('Invalid U2F key.'));
+        }
+
+        // Skipping step 17 per the spec. This is sufficient proof for us at this point.
+    }
+
+    /**
+     * Get all data needed for an authentication prompt
+     *
+     * @param array $publicKeys
+     * @return array
+     * @throws LocalizedException
+     */
+    public function getAuthenticateData(array $publicKeys): array
+    {
+        try {
+            $challenge = random_bytes(16);
+        } catch (\Exception $e) {
+            throw new LocalizedException(__('There was an error during the U2F key process.'));
+        }
+
+        $store = $this->storeManager->getStore(Store::ADMIN_CODE);
+        $allowedCredentials = [];
+        foreach ($publicKeys as $key) {
+            $allowedCredentials[] = [
+                'type' => 'public-key',
+                'id' => $this->convertBytesToArray(base64_decode($key['id']))
+            ];
+        }
+
+        $data = [
+            'credentialRequestOptions' => [
+                'challenge' => $this->convertBytesToArray($challenge),
+                'timeout' => 60000,
+                'allowCredentials' => $allowedCredentials,
+                'userVerification' => 'discouraged',
+                'extensions' => [
+                    'txAuthSimple' => 'Authenticate with ' . $store->getName(),
+                ],
+                'rpId' => $this->getDomainName(),
+            ]
+        ];
+
+        return $data;
+    }
+
+    /**
+     * Generate the challenge for registration
+     *
+     * @param UserInterface $user
+     * @return array
+     * @throws LocalizedException
+     */
+    public function getRegisterData(UserInterface $user): array
+    {
+        $domain = $this->getDomainName();
+
+        try {
+            $challenge = random_bytes(16);
+        } catch (\Exception $e) {
+            throw new LocalizedException(__('There was an error during the U2F key process.'));
+        }
+        $data = [
+            'publicKey' => [
+                'challenge' => $this->convertBytesToArray($challenge),
+                'user' => [
+                    'id' => $this->convertBytesToArray(sha1($user->getId())),
+                    'name' => $user->getUserName(),
+                    'displayName' => $user->getUserName()
+                ],
+                'rp' => [
+                    'name' => $domain,
+                    'id' => $domain,
+                ],
+                'pubKeyCredParams' => [
+                    [
+                        'alg' => self::ES256,
+                        'type' => 'public-key'
+                    ],
+                ],
+                'attestation' => 'indirect',
+                'authenticatorSelection' => [
+                    'authenticatorAttachment' => 'cross-platform',
+                    'requireResidentKey' => false,
+                    'userVerification' => 'discouraged'
+                ],
+                'timeout' => 60000,
+                // Currently only one device may be registered at a time
+                'excludeCredentials' => [],
+                'extensions' => [
+                    'exts' => true
+                ]
+            ]
+        ];
+
+        return $data;
+    }
+
+    /**
+     * Convert registration data response into public key
+     *
+     * @param array $data
+     * @return array
+     * @throws ValidationException
+     */
+    public function getPublicKeyFromRegistrationData(array $data): array
+    {
+        // Verification process as defined by w3 @see https://www.w3.org/TR/webauthn/#registering-a-new-credential
+
+        $credentialData = $data['publicKeyCredential'];
+        $domain = $this->getDomainName();
+
+        if (rtrim(strtr(base64_encode($this->convertArrayToBytes($data['challenge'])), '+/', '-_'), '=')
+            !== $credentialData['response']['clientData']['challenge']
+            || 'https://' . $domain !== $credentialData['response']['clientData']['origin']
+            || $credentialData['response']['clientData']['type'] !== 'webauthn.create'
+        ) {
+            throw new LocalizedException(__('Invalid U2F key.'));
+        }
+
+        if (empty($credentialData['response']['attestationObject']) || empty($credentialData['id'])) {
+            throw new ValidationException(__('Invalid U2F key data'));
+        }
+        $byteString = base64_decode($credentialData['response']['attestationObject']);
+        $attestationObject = CBOREncoder::decode($byteString);
+        if (empty($attestationObject['fmt'])
+            || empty($attestationObject['authData'])
+        ) {
+            throw new ValidationException(__('Invalid U2F key data'));
+        }
+
+        $byteString = $attestationObject['authData']->get_byte_string();
+
+        // @see https://www.w3.org/TR/webauthn/#sec-authenticator-data
+        $attestationObject['rpIdHash'] = substr($byteString, 0, 32);
+        $attestationObject['flags'] = ord(substr($byteString, 32, 1));
+        $attestationObject['counter'] = substr($byteString, 33, 4);
+
+        $hashId = hash('sha256', $this->getDomainName(), true);
+        if ($hashId !== $attestationObject['rpIdHash']) {
+            throw new ValidationException(__('Invalid U2F key data'));
+        }
+
+        // User presence, attestation data
+        if (!($attestationObject['flags'] & 0b1000001)) {
+            throw new ValidationException(__('Invalid U2F key data'));
+        }
+
+        $attestationObject['attestationData'] = [
+            'aaguid' => substr($byteString, 37, 16),
+            'credentialIdLength' => (ord($byteString[53]) << 8) + ord($byteString[54]),
+        ];
+        $attestationObject['attestationData']['credId'] = substr(
+            $byteString,
+            55,
+            $attestationObject['attestationData']['credentialIdLength']
+        );
+        $cborPublicKey  = substr($byteString, 55 + $attestationObject['attestationData']['credentialIdLength']);
+
+        $attestationObject['attestationData']['keyBytes'] = $this->COSEECDHAtoPKCS($cborPublicKey);
+
+        if (empty($attestationObject['attestationData']['keyBytes'])
+            || $attestationObject['attestationData']['credId'] !== base64_decode($credentialData['id'])
+        ) {
+            throw new ValidationException(__('Invalid U2F key data'));
+        }
+
+        return [
+            'key' => $attestationObject['attestationData']['keyBytes'],
+            'id' => $credentialData['id'],
+            'aaguid' => $attestationObject['attestationData']['aaguid'] ?? null
+        ];
+    }
+
+    /**
+     * Convert a binary string to an array of unsigned 8 bit integers
+     *
+     * @param string $byteString
+     * @return array
+     */
+    private function convertBytesToArray(string $byteString): array
+    {
+        $result = [];
+        $numberOfBytes = strlen($byteString);
+        for ($i = 0; $i < $numberOfBytes; $i++) {
+            $result[] = ord($byteString[$i]);
+        }
+        return $result;
+    }
+
+    /**
+     * Convert an array of unsigned 8 bit integers into a byte string
+     *
+     * @param array $bytes
+     * @return string
+     */
+    private function convertArrayToBytes(array $bytes): string
+    {
+        $byteString = '';
+
+        foreach ($bytes as $byte) {
+            $byteString .= chr((int)$byte);
+        }
+
+        return $byteString;
+    }
+
+    /**
+     * Get the store domain but only if it's secure
+     *
+     * @return string
+     * @throws LocalizedException
+     */
+    private function getDomainName(): string
+    {
+        $store = $this->storeManager->getStore(Store::ADMIN_CODE);
+        $baseUrl = $store->getBaseUrl();
+        if (!preg_match('/^(https?:\/\/(?P<domain>.+?))\//', $baseUrl, $matches)) {
+            throw new LocalizedException(__('Could not determine secure domain name.'));
+        }
+        return $matches['domain'];
+    }
+
+    /**
+     * Convert a CBOR encoded public key to PKCS format
+     *
+     * @param string $binary
+     * @return string|null
+     * @throws \Exception
+     */
+    private function COSEECDHAtoPKCS(string $binary): ?string
+    {
+        $cosePubKey = CBOREncoder::decode($binary);
+
+        // Sections 7.1 and 13.1.1 of @see https://tools.ietf.org/html/rfc8152
+        if (!isset($cosePubKey[3])
+            || $cosePubKey[3] !== self::ES256
+            || !isset($cosePubKey[-1])
+            || $cosePubKey[-1] != 1
+            || !isset($cosePubKey[1])
+            || $cosePubKey[1] != 2
+            || !isset($cosePubKey[-2])
+            || !isset($cosePubKey[-3])
+        ) {
+            return null;
+        }
+
+        $x = $cosePubKey[-2]->get_byte_string();
+        $y = $cosePubKey[-3]->get_byte_string();
+        if (strlen($x) != 32 || strlen($y) != 32) {
+            return null;
+        }
+
+        $tag = "\x04";
+        return $this->convertToPem($tag . $x . $y);
+    }
+
+    /**
+     * Transform a WebAuthn public key to PEM format
+     *
+     * @param string $key
+     * @return string|null
+     * @see https://github.com/Yubico/php-u2flib-server/blob/master/src/u2flib_server/U2F.php
+     */
+    private function convertToPem(string $key): ?string
+    {
+        if (strlen($key) !== self::PUBKEY_LEN || $key[0] !== "\x04") {
+            return null;
+        }
+
+        /*
+         * Convert the public key to binary DER format first
+         * Using the ECC SubjectPublicKeyInfo OIDs from RFC 5480
+         *
+         *  SEQUENCE(2 elem)                        30 59
+         *   SEQUENCE(2 elem)                       30 13
+         *    OID1.2.840.10045.2.1 (id-ecPublicKey) 06 07 2a 86 48 ce 3d 02 01
+         *    OID1.2.840.10045.3.1.7 (secp256r1)    06 08 2a 86 48 ce 3d 03 01 07
+         *   BIT STRING(520 bit)                    03 42 ..key..
+         */
+        $der  = "\x30\x59\x30\x13\x06\x07\x2a\x86\x48\xce\x3d\x02\x01";
+        $der .= "\x06\x08\x2a\x86\x48\xce\x3d\x03\x01\x07\x03\x42";
+        $der .= "\0".$key;
+
+        $pem  = "-----BEGIN PUBLIC KEY-----\r\n";
+        $pem .= chunk_split(base64_encode($der), 64);
+        $pem .= "-----END PUBLIC KEY-----";
+
+        return $pem;
+    }
+}
diff --git a/TwoFactorAuth/Model/ProviderPool.php b/TwoFactorAuth/Model/ProviderPool.php
new file mode 100644
index 00000000..b8502344
--- /dev/null
+++ b/TwoFactorAuth/Model/ProviderPool.php
@@ -0,0 +1,55 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Model;
+
+use Magento\Framework\Exception\NoSuchEntityException;
+use Magento\TwoFactorAuth\Api\ProviderInterface;
+use Magento\TwoFactorAuth\Api\ProviderPoolInterface;
+
+/**
+ * @inheritDoc
+ */
+class ProviderPool implements ProviderPoolInterface
+{
+    /**
+     * @var ProviderInterface[]
+     */
+    private $providers;
+
+    /**
+     * @param array $providers
+     */
+    public function __construct(
+        array $providers = []
+    ) {
+        $this->providers = $providers;
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function getProviders(): array
+    {
+        return $this->providers;
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function getProviderByCode(string $code): ProviderInterface
+    {
+        if ($code) {
+            $providers = $this->getProviders();
+            if (isset($providers[$code])) {
+                return $providers[$code];
+            }
+        }
+
+        throw new NoSuchEntityException(__('Unknown provider %1', $code));
+    }
+}
diff --git a/TwoFactorAuth/Model/ResourceModel/Country.php b/TwoFactorAuth/Model/ResourceModel/Country.php
new file mode 100644
index 00000000..d2c7d0c6
--- /dev/null
+++ b/TwoFactorAuth/Model/ResourceModel/Country.php
@@ -0,0 +1,22 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Model\ResourceModel;
+
+use Magento\Framework\Model\ResourceModel\Db\AbstractDb;
+
+/**
+ * Country model
+ * @SuppressWarnings(PHPMD.CamelCaseMethodName)
+ */
+class Country extends AbstractDb
+{
+    protected function _construct()
+    {
+        $this->_init('tfa_country_codes', 'country_id');
+    }
+}
diff --git a/TwoFactorAuth/Model/ResourceModel/Country/Collection.php b/TwoFactorAuth/Model/ResourceModel/Country/Collection.php
new file mode 100644
index 00000000..e0576182
--- /dev/null
+++ b/TwoFactorAuth/Model/ResourceModel/Country/Collection.php
@@ -0,0 +1,33 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Model\ResourceModel\Country;
+
+use Magento\Framework\Model\ResourceModel\Db\Collection\AbstractCollection;
+use Magento\TwoFactorAuth\Model\ResourceModel\Country;
+
+/**
+ * Country codes collection
+ *
+ * @SuppressWarnings(PHPMD.CamelCaseMethodName)
+ * @SuppressWarnings(PHPMD.CamelCasePropertyName)
+ */
+class Collection extends AbstractCollection
+{
+    protected $_idFieldName = 'country_id';
+
+    /**
+     * @inheritDoc
+     */
+    protected function _construct()
+    {
+        $this->_init(
+            \Magento\TwoFactorAuth\Model\Country::class,
+            Country::class
+        );
+    }
+}
diff --git a/TwoFactorAuth/Model/ResourceModel/CountryRepository.php b/TwoFactorAuth/Model/ResourceModel/CountryRepository.php
new file mode 100644
index 00000000..cc5b3b49
--- /dev/null
+++ b/TwoFactorAuth/Model/ResourceModel/CountryRepository.php
@@ -0,0 +1,209 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Model\ResourceModel;
+
+use Magento\Framework\Api\ExtensibleDataObjectConverter;
+use Magento\Framework\Api\SearchCriteria\CollectionProcessorInterface;
+use Magento\Framework\Api\SearchCriteriaBuilder;
+use Magento\Framework\Api\SearchCriteriaInterface;
+use Magento\Framework\Api\SearchResultsInterface;
+use Magento\Framework\Exception\NoSuchEntityException;
+use Magento\TwoFactorAuth\Api\CountryRepositoryInterface;
+use Magento\TwoFactorAuth\Api\Data\CountryInterface;
+use Magento\TwoFactorAuth\Api\Data\CountryInterfaceFactory;
+use Magento\TwoFactorAuth\Api\Data\CountrySearchResultsInterface;
+use Magento\TwoFactorAuth\Api\Data\CountrySearchResultsInterfaceFactory;
+use Magento\TwoFactorAuth\Model\CountryFactory;
+use Magento\TwoFactorAuth\Model\CountryRegistry;
+use Magento\TwoFactorAuth\Model\ResourceModel\Country\Collection;
+use Magento\TwoFactorAuth\Model\ResourceModel\Country\CollectionFactory;
+
+/**
+ * @inheritDoc
+ * @SuppressWarnings(PHPMD.ShortVariable)
+ * @SuppressWarnings(PHPMD.LongVariable)
+ * @SuppressWarnings(PHPMD.CouplingBetweenObjects)
+ */
+class CountryRepository implements CountryRepositoryInterface
+{
+    /**
+     * @var  CountryInterfaceFactory
+     */
+    private $countryFactory;
+
+    /**
+     * @var Country
+     */
+    private $resource;
+
+    /**
+     * @var CountrySearchResultsInterfaceFactory
+     */
+    private $searchResultsFactory;
+
+    /**
+     * @var CountryRegistry
+     */
+    private $registry;
+
+    /**
+     * @var ExtensibleDataObjectConverter
+     */
+    private $extensibleDataObjectConverter;
+
+    /**
+     * @var CollectionProcessorInterface
+     */
+    private $collectionProcessor;
+
+    /**
+     * @var SearchCriteriaBuilder
+     */
+    private $searchCriteriaBuilder;
+
+    /**
+     * @var CollectionFactory
+     */
+    private $collectionFactory;
+
+    /**
+     * @param CountryFactory $countryFactory
+     * @param CollectionFactory $collectionFactory
+     * @param Country $resource
+     * @param CountrySearchResultsInterfaceFactory $searchResultsFactory
+     * @param CollectionProcessorInterface $collectionProcessor
+     * @param SearchCriteriaBuilder $searchCriteriaBuilder
+     * @param CountryRegistry $registry
+     * @param ExtensibleDataObjectConverter $extensibleDataObjectConverter
+     */
+    public function __construct(
+        CountryFactory $countryFactory,
+        CollectionFactory $collectionFactory,
+        Country $resource,
+        CountrySearchResultsInterfaceFactory $searchResultsFactory,
+        CollectionProcessorInterface $collectionProcessor,
+        SearchCriteriaBuilder $searchCriteriaBuilder,
+        CountryRegistry $registry,
+        ExtensibleDataObjectConverter $extensibleDataObjectConverter
+    ) {
+        $this->searchResultsFactory = $searchResultsFactory;
+        $this->countryFactory = $countryFactory;
+        $this->resource = $resource;
+        $this->registry = $registry;
+        $this->extensibleDataObjectConverter = $extensibleDataObjectConverter;
+        $this->collectionProcessor = $collectionProcessor;
+        $this->searchCriteriaBuilder = $searchCriteriaBuilder;
+        $this->collectionFactory = $collectionFactory;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function save(CountryInterface $country): CountryInterface
+    {
+        $countryData = $this->extensibleDataObjectConverter->toNestedArray(
+            $country,
+            [],
+            CountryInterface::class
+        );
+
+        /** @var \Magento\TwoFactorAuth\Model\Country $countryModel */
+        $countryModel = $this->countryFactory->create(['data' => $countryData]);
+        $countryModel->setDataChanges(true);
+        $this->resource->save($countryModel);
+        $country->setId($countryModel->getId());
+
+        $this->registry->push($countryModel);
+
+        return $this->getById($countryModel->getId());
+    }
+
+    /**
+     * {@inheritdoc}
+     * @throws NoSuchEntityException
+     */
+    public function getById(int $id): CountryInterface
+    {
+        $fromRegistry = $this->registry->retrieveById($id);
+        if ($fromRegistry === null) {
+            $country = $this->countryFactory->create();
+            $this->resource->load($country, $id);
+
+            if (!$country->getId()) {
+                throw new NoSuchEntityException(__('No such Country'));
+            }
+
+            $this->registry->push($country);
+        }
+
+        return $this->registry->retrieveById($id);
+    }
+
+    /**
+     * {@inheritdoc}
+     * @throws NoSuchEntityException
+     */
+    public function getByCode(string $value): CountryInterface
+    {
+        $fromRegistry = $this->registry->retrieveByCode($value);
+        if ($fromRegistry === null) {
+            $country = $this->countryFactory->create();
+            $this->resource->load($country, $value, 'code');
+
+            if (!$country->getId()) {
+                throw new NoSuchEntityException(__('No such Country'));
+            }
+
+            $this->registry->push($country);
+        }
+
+        return $this->registry->retrieveByCode($value);
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function delete(CountryInterface $country): void
+    {
+        $countryData = $this->extensibleDataObjectConverter->toNestedArray(
+            $country,
+            [],
+            CountryInterface::class
+        );
+
+        /** @var \Magento\TwoFactorAuth\Model\Country $countryModel */
+        $countryModel = $this->countryFactory->create(['data' => $countryData]);
+        $countryModel->setData($this->resource->getIdFieldName(), $country->getId());
+
+        $this->resource->delete($countryModel);
+        $this->registry->removeById($countryModel->getId());
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function getList(SearchCriteriaInterface $searchCriteria): SearchResultsInterface
+    {
+        /** @var Collection $collection */
+        $collection = $this->collectionFactory->create();
+
+        if (null === $searchCriteria) {
+            $searchCriteria = $this->searchCriteriaBuilder->create();
+        } else {
+            $this->collectionProcessor->process($searchCriteria, $collection);
+        }
+
+        /** @var CountrySearchResultsInterface $searchResult */
+        $searchResult = $this->searchResultsFactory->create();
+        $searchResult->setItems($collection->getItems());
+        $searchResult->setTotalCount($collection->getSize());
+        $searchResult->setSearchCriteria($searchCriteria);
+
+        return $searchResult;
+    }
+}
diff --git a/TwoFactorAuth/Model/ResourceModel/UserConfig.php b/TwoFactorAuth/Model/ResourceModel/UserConfig.php
new file mode 100644
index 00000000..08eb44a6
--- /dev/null
+++ b/TwoFactorAuth/Model/ResourceModel/UserConfig.php
@@ -0,0 +1,110 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Model\ResourceModel;
+
+use Exception;
+use Magento\Framework\App\ObjectManager;
+use Magento\Framework\Encryption\EncryptorInterface;
+use Magento\Framework\Model\AbstractModel;
+use Magento\Framework\Model\ResourceModel\Db\AbstractDb;
+use Magento\Framework\Model\ResourceModel\Db\Context;
+use Magento\Framework\Serialize\SerializerInterface;
+
+/**
+ * @SuppressWarnings(PHPMD.CamelCaseMethodName)
+ */
+class UserConfig extends AbstractDb
+{
+    /**
+     * @var EncryptorInterface
+     */
+    private $encryptor;
+
+    /**
+     * @param Context $context
+     * @param null $decoder
+     * @param null $encoder
+     * @param null $connectionName
+     * @param EncryptorInterface $encryptor
+     * @param SerializerInterface $serializer
+     */
+    public function __construct(
+        Context $context,
+        $decoder = null,
+        $encoder = null,
+        $connectionName = null,
+        EncryptorInterface $encryptor = null,
+        SerializerInterface $serializer = null
+    ) {
+        parent::__construct($context, $connectionName);
+        $this->encryptor = $encryptor ?:
+            ObjectManager::getInstance()->get(EncryptorInterface::class);
+        $this->serializer = $serializer ?:
+            ObjectManager::getInstance()->get(SerializerInterface::class);
+    }
+
+    /**
+     * @inheritDoc
+     */
+    protected function _construct()
+    {
+        $this->_init('tfa_user_config', 'config_id');
+    }
+
+    /**
+     * @param array $config
+     * @return string
+     */
+    private function encodeConfig(array $config): string
+    {
+        return $this->encryptor->encrypt($this->serializer->serialize($config));
+    }
+
+    /**
+     * @param string $config
+     * @return array
+     */
+    private function decodeConfig(string $config): array
+    {
+        // Support for legacy unencrypted configuration
+        try {
+            $config = $this->encryptor->decrypt($config);
+        } catch (Exception $e) {
+            unset($e);
+        }
+
+        return $this->serializer->unserialize($config);
+    }
+
+    public function _afterLoad(AbstractModel $object)
+    {
+        parent::_afterLoad($object);
+
+        try {
+            $object->setData('config', $this->decodeConfig($object->getData('encoded_config') ?? ''));
+        } catch (Exception $e) {
+            $object->setData('config', []);
+        }
+
+        try {
+            $object->setData('providers', $this->serializer->unserialize($object->getData('encoded_providers') ?? ''));
+        } catch (Exception $e) {
+            $object->setData('providers', []);
+        }
+
+        return $this;
+    }
+
+    public function _beforeSave(AbstractModel $object)
+    {
+        $object->setData('encoded_config', $this->encodeConfig($object->getData('config') ?? []));
+        $object->setData('encoded_providers', $this->serializer->serialize($object->getData('providers') ?? []));
+
+        parent::_beforeSave($object);
+    }
+}
diff --git a/TwoFactorAuth/Model/ResourceModel/UserConfig/Collection.php b/TwoFactorAuth/Model/ResourceModel/UserConfig/Collection.php
new file mode 100644
index 00000000..53f6e0e9
--- /dev/null
+++ b/TwoFactorAuth/Model/ResourceModel/UserConfig/Collection.php
@@ -0,0 +1,32 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Model\ResourceModel\UserConfig;
+
+use Magento\Framework\Model\ResourceModel\Db\Collection\AbstractCollection;
+use Magento\TwoFactorAuth\Model\ResourceModel\UserConfig;
+
+/**
+ * User's configuration collection
+ * @SuppressWarnings(PHPMD.CamelCaseMethodName)
+ * @SuppressWarnings(PHPMD.CamelCasePropertyName)
+ */
+class Collection extends AbstractCollection
+{
+    protected $_idFieldName = 'config_id';
+
+    /**
+     * @inheritDoc
+     */
+    protected function _construct()
+    {
+        $this->_init(
+            \Magento\TwoFactorAuth\Model\UserConfig::class,
+            UserConfig::class
+        );
+    }
+}
diff --git a/TwoFactorAuth/Model/ResourceModel/UserConfigRepository.php b/TwoFactorAuth/Model/ResourceModel/UserConfigRepository.php
new file mode 100644
index 00000000..d47d3263
--- /dev/null
+++ b/TwoFactorAuth/Model/ResourceModel/UserConfigRepository.php
@@ -0,0 +1,209 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Model\ResourceModel;
+
+use Magento\Framework\Api\ExtensibleDataObjectConverter;
+use Magento\Framework\Api\SearchCriteria\CollectionProcessorInterface;
+use Magento\Framework\Api\SearchCriteriaBuilder;
+use Magento\Framework\Api\SearchCriteriaInterface;
+use Magento\Framework\Api\SearchResultsInterface;
+use Magento\Framework\Exception\NoSuchEntityException;
+use Magento\TwoFactorAuth\Api\Data\UserConfigInterface;
+use Magento\TwoFactorAuth\Api\Data\UserConfigInterfaceFactory;
+use Magento\TwoFactorAuth\Api\Data\UserConfigSearchResultsInterface;
+use Magento\TwoFactorAuth\Api\Data\UserConfigSearchResultsInterfaceFactory;
+use Magento\TwoFactorAuth\Api\UserConfigRepositoryInterface;
+use Magento\TwoFactorAuth\Model\ResourceModel\UserConfig\Collection;
+use Magento\TwoFactorAuth\Model\ResourceModel\UserConfig\CollectionFactory;
+use Magento\TwoFactorAuth\Model\UserConfigFactory;
+use Magento\TwoFactorAuth\Model\UserConfigRegistry;
+
+/**
+ * @inheritDoc
+ * @SuppressWarnings(PHPMD.ShortVariable)
+ * @SuppressWarnings(PHPMD.LongVariable)
+ * @SuppressWarnings(PHPMD.CouplingBetweenObjects)
+ */
+class UserConfigRepository implements UserConfigRepositoryInterface
+{
+    /**
+     * @var  UserConfigInterfaceFactory
+     */
+    private $userConfigFactory;
+
+    /**
+     * @var UserConfig
+     */
+    private $resource;
+
+    /**
+     * @var UserConfigSearchResultsInterfaceFactory
+     */
+    private $searchResultsFactory;
+
+    /**
+     * @var UserConfigRegistry
+     */
+    private $registry;
+
+    /**
+     * @var ExtensibleDataObjectConverter
+     */
+    private $extensibleDataObjectConverter;
+
+    /**
+     * @var CollectionFactory
+     */
+    private $collectionFactory;
+
+    /**
+     * @var CollectionProcessorInterface
+     */
+    private $collectionProcessor;
+
+    /**
+     * @var SearchCriteriaBuilder
+     */
+    private $searchCriteriaBuilder;
+
+    /**
+     * @param UserConfigFactory $userConfigFactory
+     * @param CollectionFactory $collectionFactory
+     * @param UserConfig $resource
+     * @param UserConfigSearchResultsInterfaceFactory $searchResultsFactory
+     * @param CollectionProcessorInterface $collectionProcessor
+     * @param SearchCriteriaBuilder $searchCriteriaBuilder
+     * @param UserConfigRegistry $registry
+     * @param ExtensibleDataObjectConverter $extensibleDataObjectConverter
+     */
+    public function __construct(
+        UserConfigFactory $userConfigFactory,
+        CollectionFactory $collectionFactory,
+        UserConfig $resource,
+        UserConfigSearchResultsInterfaceFactory $searchResultsFactory,
+        CollectionProcessorInterface $collectionProcessor,
+        SearchCriteriaBuilder $searchCriteriaBuilder,
+        UserConfigRegistry $registry,
+        ExtensibleDataObjectConverter $extensibleDataObjectConverter
+    ) {
+        $this->searchResultsFactory = $searchResultsFactory;
+        $this->userConfigFactory = $userConfigFactory;
+        $this->resource = $resource;
+        $this->registry = $registry;
+        $this->extensibleDataObjectConverter = $extensibleDataObjectConverter;
+        $this->collectionFactory = $collectionFactory;
+        $this->collectionProcessor = $collectionProcessor;
+        $this->searchCriteriaBuilder = $searchCriteriaBuilder;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function save(UserConfigInterface $userConfig): UserConfigInterface
+    {
+        $userConfigData = $this->extensibleDataObjectConverter->toNestedArray(
+            $userConfig,
+            [],
+            UserConfigInterface::class
+        );
+
+        /** @var \Magento\TwoFactorAuth\Model\UserConfig $userConfigModel */
+        $userConfigModel = $this->userConfigFactory->create(['data' => $userConfigData]);
+        $userConfigModel->setDataChanges(true);
+        $this->resource->save($userConfigModel);
+        $userConfig->setId($userConfigModel->getId());
+
+        $this->registry->push($userConfigModel);
+
+        return $this->getById($userConfigModel->getId());
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function getById(int $id): UserConfigInterface
+    {
+        $fromRegistry = $this->registry->retrieveById($id);
+        if ($fromRegistry === null) {
+            $userConfig = $this->userConfigFactory->create();
+            $this->resource->load($userConfig, $id);
+
+            if (!$userConfig->getId()) {
+                throw new NoSuchEntityException(__('No such UserConfig'));
+            }
+
+            $this->registry->push($userConfig);
+        }
+
+        return $this->registry->retrieveById($id);
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function getByUserId(int $value): UserConfigInterface
+    {
+        $fromRegistry = $this->registry->retrieveByUserId($value);
+        if ($fromRegistry === null) {
+            $userConfig = $this->userConfigFactory->create();
+            $this->resource->load($userConfig, $value, 'user_id');
+
+            if (!$userConfig->getId()) {
+                throw new NoSuchEntityException(__('No such UserConfig'));
+            }
+
+            $this->registry->push($userConfig);
+        }
+
+        return $this->registry->retrieveByUserId($value);
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function delete(UserConfigInterface $userConfig): bool
+    {
+        $userConfigData = $this->extensibleDataObjectConverter->toNestedArray(
+            $userConfig,
+            [],
+            UserConfigInterface::class
+        );
+
+        /** @var \Magento\TwoFactorAuth\Model\UserConfig $userConfigModel */
+        $userConfigModel = $this->userConfigFactory->create(['data' => $userConfigData]);
+        $userConfigModel->setData($this->resource->getIdFieldName(), $userConfig->getId());
+
+        $this->resource->delete($userConfigModel);
+        $this->registry->removeById($userConfigModel->getId());
+
+        return true;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function getList(SearchCriteriaInterface $searchCriteria): SearchResultsInterface
+    {
+        /** @var Collection $collection */
+        $collection = $this->collectionFactory->create();
+
+        if (null === $searchCriteria) {
+            $searchCriteria = $this->searchCriteriaBuilder->create();
+        } else {
+            $this->collectionProcessor->process($searchCriteria, $collection);
+        }
+
+        /** @var UserConfigSearchResultsInterface $searchResult */
+        $searchResult = $this->searchResultsFactory->create();
+        $searchResult->setItems($collection->getItems());
+        $searchResult->setTotalCount($collection->getSize());
+        $searchResult->setSearchCriteria($searchCriteria);
+
+        return $searchResult;
+    }
+}
diff --git a/TwoFactorAuth/Model/Tfa.php b/TwoFactorAuth/Model/Tfa.php
new file mode 100644
index 00000000..4bb945e1
--- /dev/null
+++ b/TwoFactorAuth/Model/Tfa.php
@@ -0,0 +1,290 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Model;
+
+use Magento\Framework\Api\SearchCriteriaBuilder;
+use Magento\Framework\App\Config\ScopeConfigInterface;
+use Magento\Framework\Exception\NoSuchEntityException;
+use Magento\TwoFactorAuth\Api\ProviderInterface;
+use Magento\TwoFactorAuth\Api\ProviderPoolInterface;
+use Magento\TwoFactorAuth\Api\TfaInterface;
+use Magento\TwoFactorAuth\Api\UserConfigManagerInterface;
+
+/**
+ * @inheritDoc
+ *
+ * @SuppressWarnings(PHPMD.LongVariable)
+ */
+class Tfa implements TfaInterface
+{
+    /**
+     * @var null|string[]
+     */
+    private $allowedUrls = null;
+
+    /**
+     * @var ScopeConfigInterface
+     */
+    private $scopeConfig;
+
+    /**
+     * @var UserConfigManagerInterface
+     */
+    private $userConfigManager;
+
+    /**
+     * @var SearchCriteriaBuilder
+     */
+    private $searchCriteriaBuilder;
+
+    /**
+     * @var ProviderPoolInterface
+     */
+    private $providerPool;
+
+    /**
+     * @param ScopeConfigInterface $scopeConfig
+     * @param SearchCriteriaBuilder $searchCriteriaBuilder
+     * @param UserConfigManagerInterface $userConfigManager
+     * @param ProviderPoolInterface $providerPool
+     */
+    public function __construct(
+        ScopeConfigInterface $scopeConfig,
+        SearchCriteriaBuilder $searchCriteriaBuilder,
+        UserConfigManagerInterface $userConfigManager,
+        ProviderPoolInterface $providerPool
+    ) {
+        $this->scopeConfig = $scopeConfig;
+        $this->userConfigManager = $userConfigManager;
+        $this->searchCriteriaBuilder = $searchCriteriaBuilder;
+        $this->providerPool = $providerPool;
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function getAllProviders(): array
+    {
+        return array_values($this->providerPool->getProviders());
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function getProviderByCode(string $code): ?ProviderInterface
+    {
+        if ($code) {
+            try {
+                return $this->providerPool->getProviderByCode($code);
+            } catch (NoSuchEntityException $e) {
+                return null;
+            }
+        }
+
+        return null;
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function getAllEnabledProviders(): array
+    {
+        $enabledProviders = [];
+        $providers = $this->getAllProviders();
+        foreach ($providers as $provider) {
+            if ($provider->isEnabled()) {
+                $enabledProviders[] = $provider;
+            }
+        }
+
+        return $enabledProviders;
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function getProvider(string $providerCode, bool $onlyEnabled = true): ?ProviderInterface
+    {
+        $provider = $this->getProviderByCode($providerCode);
+
+        if (!$provider) {
+            return null;
+        }
+
+        if ($onlyEnabled && !$provider->isEnabled()) {
+            return null;
+        }
+
+        return $provider;
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function getForcedProviders(): array
+    {
+        $forcedProviders = [];
+
+        $configValue = $this->scopeConfig->getValue(TfaInterface::XML_PATH_FORCED_PROVIDERS);
+        if (!is_array($configValue) && $configValue) {
+            $forcedProvidersCodes = preg_split('/\s*,\s*/', $configValue);
+        } else {
+            $forcedProvidersCodes = $configValue;
+        }
+
+        if ($forcedProvidersCodes) {
+            foreach ($forcedProvidersCodes as $forcedProviderCode) {
+                $provider = $this->getProvider($forcedProviderCode);
+                if ($provider) {
+                    $forcedProviders[] = $provider;
+                }
+            }
+        }
+
+        return $forcedProviders;
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function getUserProviders(int $userId): array
+    {
+        return $this->getForcedProviders();
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function getAllowedUrls(): array
+    {
+        if ($this->allowedUrls === null) {
+            $this->allowedUrls = [
+                'adminhtml_auth_login',
+                'adminhtml_auth_logout',
+                'adminhtml_auth_forgotpassword',
+                'tfa_tfa_accessdenied',
+                'tfa_tfa_requestconfig',
+                'tfa_tfa_configurelater',
+                'tfa_tfa_configure',
+                'tfa_tfa_configurepost',
+                'tfa_tfa_index'
+            ];
+
+            $providers = $this->getAllProviders();
+            foreach ($providers as $provider) {
+                $this->allowedUrls[] = str_replace('/', '_', $provider->getConfigureAction());
+                $this->allowedUrls[] = str_replace('/', '_', $provider->getAuthAction());
+
+                foreach (array_values($provider->getExtraActions()) as $extraAction) {
+                    $this->allowedUrls[] = str_replace('/', '_', $extraAction);
+                }
+            }
+        }
+
+        return $this->allowedUrls;
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function getProvidersToActivate(int $userId): array
+    {
+        $providers = $this->getUserProviders($userId);
+
+        $res = [];
+        foreach ($providers as $provider) {
+            if (!$provider->isActive($userId)) {
+                $res[] = $provider;
+            }
+        }
+
+        return $res;
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function getProviderIsAllowed(int $userId, string $providerCode): bool
+    {
+        $providers = $this->getUserProviders($userId);
+        foreach ($providers as $provider) {
+            if ($provider->getCode() === $providerCode) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function isEnabled(): bool
+    {
+        return true;
+    }
+
+    /**
+     * Return true if a provider code is allowed
+     * @param int $userId
+     * @param string $providerCode
+     * @throws NoSuchEntityException
+     */
+    private function assertAllowedProvider(int $userId, string $providerCode): void
+    {
+        if (!$this->getProviderIsAllowed($userId, $providerCode)) {
+            throw new NoSuchEntityException(__('Unknown or not enabled provider %1 for this user', $providerCode));
+        }
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function getDefaultProviderCode(int $userId): string
+    {
+        return $this->userConfigManager->getDefaultProvider($userId);
+    }
+
+    /**
+     * Set default provider code
+     * @param int $userId
+     * @param string $providerCode
+     * @return boolean
+     * @throws NoSuchEntityException
+     */
+    public function setDefaultProviderCode(int $userId, string $providerCode): bool
+    {
+        $this->assertAllowedProvider($userId, $providerCode);
+        return $this->userConfigManager->setDefaultProvider($userId, $providerCode);
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function resetProviderConfig(int $userId, string $providerCode): bool
+    {
+        $this->assertAllowedProvider($userId, $providerCode);
+        return $this->userConfigManager->resetProviderConfig($userId, $providerCode);
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function setProvidersCodes(int $userId, string $providersCodes): bool
+    {
+        if (is_string($providersCodes)) {
+            $providersCodes = preg_split('/\s*,\s*/', $providersCodes);
+        }
+
+        foreach ($providersCodes as $providerCode) {
+            $this->assertAllowedProvider($userId, $providerCode);
+        }
+
+        return $this->userConfigManager->setProvidersCodes($userId, $providersCodes);
+    }
+}
diff --git a/TwoFactorAuth/Model/TfaSession.php b/TwoFactorAuth/Model/TfaSession.php
new file mode 100644
index 00000000..2c6a7266
--- /dev/null
+++ b/TwoFactorAuth/Model/TfaSession.php
@@ -0,0 +1,53 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Model;
+
+use Magento\Framework\Session\SessionManager;
+use Magento\TwoFactorAuth\Api\TfaSessionInterface;
+
+/**
+ * @inheritDoc
+ */
+class TfaSession extends SessionManager implements TfaSessionInterface
+{
+    const SKIPPED_PROVIDERS_KEY = 'tfa_skipped_config';
+
+    /**
+     * @inheritDoc
+     */
+    public function grantAccess(): void
+    {
+        $this->storage->setData(TfaSessionInterface::KEY_PASSED, true);
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function isGranted(): bool
+    {
+        return (bool) $this->storage->getData(TfaSessionInterface::KEY_PASSED);
+    }
+
+    /**
+     * @inheritDoc
+     *
+     * @return array
+     */
+    public function getSkippedProviderConfig(): array
+    {
+        return $this->getData(static::SKIPPED_PROVIDERS_KEY) ?? [];
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function setSkippedProviderConfig(array $config): void
+    {
+        $this->storage->setData(static::SKIPPED_PROVIDERS_KEY, $config);
+    }
+}
diff --git a/TwoFactorAuth/Model/UserConfig.php b/TwoFactorAuth/Model/UserConfig.php
new file mode 100644
index 00000000..47a9aef3
--- /dev/null
+++ b/TwoFactorAuth/Model/UserConfig.php
@@ -0,0 +1,89 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Model;
+
+use Magento\Framework\Model\AbstractModel;
+use Magento\Framework\Api\DataObjectHelper;
+use Magento\Framework\Data\Collection\AbstractDb;
+use Magento\Framework\Model\Context;
+use Magento\Framework\Model\ResourceModel\AbstractResource;
+use Magento\Framework\Registry;
+use Magento\TwoFactorAuth\Api\Data\UserConfigInterface;
+use Magento\TwoFactorAuth\Api\Data\UserConfigInterfaceFactory;
+
+/**
+ * User configuration data model
+ *
+ * @SuppressWarnings(PHPMD.LongVariable)
+ * @SuppressWarnings(PHPMD.CamelCaseMethodName)
+ */
+class UserConfig extends AbstractModel
+{
+    /**
+     * @var DataObjectHelper
+     */
+    private $dataObjectHelper;
+
+    /**
+     * @var UserConfigInterfaceFactory
+     */
+    private $userConfigDataFactory;
+
+    /**
+     * @param Context $context
+     * @param Registry $registry
+     * @param DataObjectHelper $dataObjectHelper
+     * @param UserConfigInterfaceFactory $userConfigDataFactory
+     * @param AbstractResource|null $resource
+     * @param AbstractDb|null $resourceCollection
+     * @param array $data
+     */
+    public function __construct(
+        Context $context,
+        Registry $registry,
+        DataObjectHelper $dataObjectHelper,
+        UserConfigInterfaceFactory $userConfigDataFactory,
+        AbstractResource $resource = null,
+        AbstractDb $resourceCollection = null,
+        array $data = []
+    ) {
+        parent::__construct($context, $registry, $resource, $resourceCollection, $data);
+        $this->dataObjectHelper = $dataObjectHelper;
+        $this->userConfigDataFactory = $userConfigDataFactory;
+    }
+
+    /**
+     * @inheritDoc
+     */
+    protected function _construct()
+    {
+        $this->_init(ResourceModel\UserConfig::class);
+    }
+
+    /**
+     * Retrieve UserConfig model
+     *
+     * @return UserConfigInterface
+     */
+    public function getDataModel(): UserConfigInterface
+    {
+        $userConfigData = $this->getData();
+
+        /** @var UserConfigInterface $userConfigDataObject */
+        $userConfigDataObject = $this->userConfigDataFactory->create();
+
+        $this->dataObjectHelper->populateWithArray(
+            $userConfigDataObject,
+            $userConfigData,
+            UserConfigInterface::class
+        );
+        $userConfigDataObject->setId($this->getId());
+
+        return $userConfigDataObject;
+    }
+}
diff --git a/TwoFactorAuth/Model/UserConfig/HtmlAreaTokenVerifier.php b/TwoFactorAuth/Model/UserConfig/HtmlAreaTokenVerifier.php
new file mode 100644
index 00000000..e461adb4
--- /dev/null
+++ b/TwoFactorAuth/Model/UserConfig/HtmlAreaTokenVerifier.php
@@ -0,0 +1,118 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Model\UserConfig;
+
+use Magento\Backend\Model\Auth\Session;
+use Magento\Framework\App\RequestInterface;
+use Magento\Framework\Stdlib\CookieManagerInterface;
+use Magento\TwoFactorAuth\Api\UserConfigTokenManagerInterface;
+use Magento\Framework\Stdlib\Cookie\CookieMetadataFactory;
+use Magento\Backend\Model\Session as SessionManager;
+
+/**
+ * Finds and verifies token allowing users to configure 2FA.
+ *
+ * Works for adminhtml area.
+ */
+class HtmlAreaTokenVerifier
+{
+    /**
+     * @var RequestInterface
+     */
+    private $request;
+
+    /**
+     * @var UserConfigTokenManagerInterface
+     */
+    private $tokenManager;
+
+    /**
+     * @var CookieManagerInterface
+     */
+    private $cookies;
+
+    /**
+     * @var CookieMetadataFactory
+     */
+    private $cookieMetadataFactory;
+
+    /**
+     * @var Session
+     */
+    private $session;
+
+    /**
+     * @var SessionManager
+     */
+    private $sessionManager;
+
+    /**
+     * @param RequestInterface $request
+     * @param UserConfigTokenManagerInterface $tokenManager
+     * @param CookieManagerInterface $cookies
+     * @param CookieMetadataFactory $cookieMetadataFactory
+     * @param Session $session
+     * @param SessionManager $sessionManager
+     */
+    public function __construct(
+        RequestInterface $request,
+        UserConfigTokenManagerInterface $tokenManager,
+        CookieManagerInterface $cookies,
+        CookieMetadataFactory $cookieMetadataFactory,
+        Session $session,
+        SessionManager $sessionManager
+    ) {
+        $this->request = $request;
+        $this->tokenManager = $tokenManager;
+        $this->cookies = $cookies;
+        $this->cookieMetadataFactory = $cookieMetadataFactory;
+        $this->session = $session;
+        $this->sessionManager = $sessionManager;
+    }
+
+    /**
+     * Was config token provided by current user?.
+     *
+     * @return bool
+     */
+    public function isConfigTokenProvided(): bool
+    {
+        return (bool)$this->readConfigToken();
+    }
+
+    /**
+     * Read configuration token provided by user.
+     *
+     * @return string|null
+     */
+    public function readConfigToken(): ?string
+    {
+        $user = $this->session->getUser();
+        if (!$user) {
+            return null;
+        }
+        $cookieToken = $this->cookies->getCookie('tfa-ct');
+        $paramToken = $this->request->getParam('tfat');
+        $cookieTokenValid = $cookieToken && $this->tokenManager->isValidFor((int)$user->getId(), $cookieToken);
+        $paramTokenValid = $paramToken && $this->tokenManager->isValidFor((int)$user->getId(), $paramToken);
+
+        if (!$cookieTokenValid && !$paramTokenValid) {
+            return null;
+        } elseif ($paramTokenValid && !$cookieTokenValid) {
+            $metadata = $this->cookieMetadataFactory->createSensitiveCookieMetadata()
+                ->setPath($this->sessionManager->getCookiePath());
+            $this->cookies->setSensitiveCookie('tfa-ct', $paramToken, $metadata);
+            return $paramToken;
+        } elseif (!$paramTokenValid && $cookieTokenValid) {
+            return $cookieToken;
+        } else {
+            return $cookieToken;
+        }
+    }
+}
diff --git a/TwoFactorAuth/Model/UserConfig/SignedTokenManager.php b/TwoFactorAuth/Model/UserConfig/SignedTokenManager.php
new file mode 100644
index 00000000..d0d3e93c
--- /dev/null
+++ b/TwoFactorAuth/Model/UserConfig/SignedTokenManager.php
@@ -0,0 +1,86 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Model\UserConfig;
+
+use Magento\Framework\Encryption\EncryptorInterface;
+use Magento\Framework\Encryption\Helper\Security;
+use Magento\Framework\Serialize\Serializer\Json;
+use Magento\Framework\Stdlib\DateTime\DateTime;
+use Magento\TwoFactorAuth\Api\UserConfigTokenManagerInterface;
+
+/**
+ * @inheritDoc
+ */
+class SignedTokenManager implements UserConfigTokenManagerInterface
+{
+    /**
+     * @var EncryptorInterface
+     */
+    private $encryptor;
+
+    /**
+     * @var Json
+     */
+    private $json;
+
+    /**
+     * @var DateTime
+     */
+    private $dateTime;
+
+    /**
+     * @param EncryptorInterface $encryptor
+     * @param Json $json
+     * @param DateTime $dateTime
+     */
+    public function __construct(EncryptorInterface $encryptor, Json $json, DateTime $dateTime)
+    {
+        $this->encryptor = $encryptor;
+        $this->json = $json;
+        $this->dateTime = $dateTime;
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function issueFor(int $userId): string
+    {
+        $data = ['user_id' => $userId, 'tfa_configuration' => true, 'iss' => $this->dateTime->timestamp()];
+        $encodedData = $this->json->serialize($data);
+        $signature = base64_encode($this->encryptor->hash($encodedData));
+
+        return base64_encode($encodedData .'.' .$signature);
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function isValidFor(int $userId, string $token): bool
+    {
+        $isValid = false;
+        [$encodedData, $signatureProvided] = explode('.', base64_decode($token));
+        try {
+            $data = $this->json->unserialize($encodedData);
+            if (array_key_exists('user_id', $data)
+                && array_key_exists('tfa_configuration', $data)
+                && array_key_exists('iss', $data)
+                && $data['user_id'] === $userId
+                && $data['tfa_configuration']
+                && ($this->dateTime->timestamp() - (int)$data['iss']) < 3600
+                && Security::compareStrings(base64_encode($this->encryptor->hash($encodedData)), $signatureProvided)
+            ) {
+                $isValid = true;
+            }
+        } catch (\Throwable $exception) {
+            $isValid = false;
+        }
+
+        return $isValid;
+    }
+}
diff --git a/TwoFactorAuth/Model/UserConfig/UserConfigRequestManager.php b/TwoFactorAuth/Model/UserConfig/UserConfigRequestManager.php
new file mode 100644
index 00000000..07f0460b
--- /dev/null
+++ b/TwoFactorAuth/Model/UserConfig/UserConfigRequestManager.php
@@ -0,0 +1,88 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Model\UserConfig;
+
+use Magento\Framework\Exception\AuthorizationException;
+use Magento\User\Model\User;
+use Magento\TwoFactorAuth\Api\TfaInterface;
+use Magento\TwoFactorAuth\Api\UserConfigRequestManagerInterface;
+use Magento\TwoFactorAuth\Api\UserConfigTokenManagerInterface;
+use Magento\TwoFactorAuth\Api\UserNotifierInterface;
+use Magento\Framework\Authorization\PolicyInterface as Authorization;
+
+/**
+ * @inheritDoc
+ */
+class UserConfigRequestManager implements UserConfigRequestManagerInterface
+{
+    /**
+     * @var TfaInterface
+     */
+    private $tfa;
+
+    /**
+     * @var UserNotifierInterface
+     */
+    private $notifier;
+
+    /**
+     * @var UserConfigTokenManagerInterface
+     */
+    private $tokenManager;
+
+    /**
+     * @var Authorization
+     */
+    private $auth;
+
+    /**
+     * @param TfaInterface $tfa
+     * @param UserNotifierInterface $notifier
+     * @param UserConfigTokenManagerInterface $tokenManager
+     * @param Authorization $auth
+     */
+    public function __construct(
+        TfaInterface $tfa,
+        UserNotifierInterface $notifier,
+        UserConfigTokenManagerInterface $tokenManager,
+        Authorization $auth
+    ) {
+        $this->tfa = $tfa;
+        $this->notifier = $notifier;
+        $this->tokenManager = $tokenManager;
+        $this->auth = $auth;
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function isConfigurationRequiredFor(int $userId): bool
+    {
+        return empty($this->tfa->getUserProviders($userId))
+            || !empty($this->tfa->getProvidersToActivate($userId));
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function sendConfigRequestTo(User $user): void
+    {
+        $userId = (int)$user->getId();
+        if (empty($this->tfa->getUserProviders($userId))) {
+            //Application level configuration is required.
+            if (!$this->auth->isAllowed($user->getAclRole(), 'Magento_TwoFactorAuth::config')) {
+                throw new AuthorizationException(__('User is not authorized to edit 2FA configuration'));
+            }
+            $this->notifier->sendAppConfigRequestMessage($user, $this->tokenManager->issueFor($userId));
+        } else {
+            //Personal provider config required.
+            $this->notifier->sendUserConfigRequestMessage($user, $this->tokenManager->issueFor($userId));
+        }
+    }
+}
diff --git a/TwoFactorAuth/Model/UserConfigManager.php b/TwoFactorAuth/Model/UserConfigManager.php
new file mode 100644
index 00000000..c3875747
--- /dev/null
+++ b/TwoFactorAuth/Model/UserConfigManager.php
@@ -0,0 +1,191 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Model;
+
+use Magento\TwoFactorAuth\Api\UserConfigManagerInterface;
+use Magento\TwoFactorAuth\Model\ResourceModel\UserConfig as UserConfigResource;
+
+/**
+ * @inheritDoc
+ */
+class UserConfigManager implements UserConfigManagerInterface
+{
+    /**
+     * @var array
+     */
+    private $configurationRegistry = [];
+
+    /**
+     * @var UserConfigFactory
+     */
+    private $userConfigFactory;
+
+    /**
+     * @var UserConfigResource
+     */
+    private $userConfigResource;
+
+    /**
+     * @param UserConfigFactory $userConfigFactory
+     * @param UserConfigResource|null $userConfigResource
+     * @SuppressWarnings(PHPMD.UnusedFormalParameter)
+     */
+    public function __construct(
+        UserConfigFactory $userConfigFactory,
+        UserConfigResource $userConfigResource
+    ) {
+        $this->userConfigFactory = $userConfigFactory;
+        $this->userConfigResource = $userConfigResource;
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function getProviderConfig(int $userId, string $providerCode): ?array
+    {
+        $userConfig = $this->getUserConfiguration($userId);
+        $providersConfig = $userConfig->getData('config');
+
+        if (!isset($providersConfig[$providerCode])) {
+            return null;
+        }
+
+        return $providersConfig[$providerCode];
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function setProviderConfig(int $userId, string $providerCode, ?array $config=null): bool
+    {
+        $userConfig = $this->getUserConfiguration($userId);
+        $providersConfig = $userConfig->getData('config');
+
+        if ($config === null) {
+            if (isset($providersConfig[$providerCode])) {
+                unset($providersConfig[$providerCode]);
+            }
+        } else {
+            $providersConfig[$providerCode] = $config;
+        }
+
+        $userConfig->setData('config', $providersConfig);
+        $this->userConfigResource->save($userConfig);
+
+        return true;
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function addProviderConfig(int $userId, string $providerCode, ?array $config=null): bool
+    {
+        $userConfig = $this->getProviderConfig($userId, $providerCode);
+        if ($userConfig === null) {
+            $newConfig = $config;
+        } else {
+            $newConfig = array_merge($userConfig, $config);
+        }
+
+        return $this->setProviderConfig($userId, $providerCode, $newConfig);
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function resetProviderConfig(int $userId, string $providerCode): bool
+    {
+        $this->setProviderConfig($userId, $providerCode, null);
+        return true;
+    }
+
+    /**
+     * Get user TFA config
+     * @param int $userId
+     * @return UserConfig
+     */
+    private function getUserConfiguration(int $userId): UserConfig
+    {
+        if (!isset($this->configurationRegistry[$userId])) {
+            /** @var $userConfig UserConfig */
+            $userConfig = $this->userConfigFactory->create();
+            $this->userConfigResource->load($userConfig, $userId, 'user_id');
+            $userConfig->setData('user_id', $userId);
+
+            $this->configurationRegistry[$userId] = $userConfig;
+        }
+
+        return $this->configurationRegistry[$userId];
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function setProvidersCodes(int $userId, $providersCodes): bool
+    {
+        if (is_string($providersCodes)) {
+            $providersCodes = preg_split('/\s*,\s*/', $providersCodes);
+        }
+
+        $userConfig = $this->getUserConfiguration($userId);
+        $userConfig->setData('providers', $providersCodes);
+        $this->userConfigResource->save($userConfig);
+
+        return true;
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function getProvidersCodes(int $userId): array
+    {
+        $userConfig = $this->getUserConfiguration($userId);
+        return $userConfig->getData('providers');
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function activateProviderConfiguration(int $userId, string $providerCode): bool
+    {
+        return $this->addProviderConfig($userId, $providerCode, [
+            UserConfigManagerInterface::ACTIVE_CONFIG_KEY => true
+        ]);
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function isProviderConfigurationActive(int $userId, string $providerCode): bool
+    {
+        $config = $this->getProviderConfig($userId, $providerCode);
+        return $config &&
+            isset($config[UserConfigManagerInterface::ACTIVE_CONFIG_KEY]) &&
+            $config[UserConfigManagerInterface::ACTIVE_CONFIG_KEY];
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function setDefaultProvider(int $userId, string $providerCode): bool
+    {
+        $userConfig = $this->getUserConfiguration($userId);
+        $userConfig->setData('default_provider', $providerCode);
+        $this->userConfigResource->save($userConfig);
+        return true;
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function getDefaultProvider(int $userId): string
+    {
+        $userConfig = $this->getUserConfiguration($userId);
+        return $userConfig->getData('default_provider') ?: '';
+    }
+}
diff --git a/TwoFactorAuth/Model/UserConfigRegistry.php b/TwoFactorAuth/Model/UserConfigRegistry.php
new file mode 100644
index 00000000..f283ba48
--- /dev/null
+++ b/TwoFactorAuth/Model/UserConfigRegistry.php
@@ -0,0 +1,84 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Model;
+
+use Magento\TwoFactorAuth\Api\Data\UserConfigInterface;
+
+/**
+ * User configuration registry
+ *
+ * @SuppressWarnings(PHPMD.ShortVariable)
+ */
+class UserConfigRegistry
+{
+    /**
+     * @var array
+     */
+    private $registry = [];
+
+    /**
+     * @var array
+     */
+    private $registryByKey = [
+        'user_id' => [],
+    ];
+
+    /**
+     * Remove registry entity by id
+     * @param int $id
+     */
+    public function removeById(int $id): void
+    {
+        if (isset($this->registry[$id])) {
+            unset($this->registry[$id]);
+        }
+
+        foreach (array_keys($this->registryByKey) as $key) {
+            $reverseMap = array_flip($this->registryByKey[$key]);
+            if (isset($reverseMap[$id])) {
+                unset($this->registryByKey[$key][$reverseMap[$id]]);
+            }
+        }
+    }
+
+    /**
+     * Push one object into registry
+     * @param int $id
+     * @return UserConfigInterface|null
+     */
+    public function retrieveById(int $id): ?UserConfigInterface
+    {
+        return $this->registry[$id] ?? null;
+    }
+
+    /**
+     * Retrieve by UserId value
+     * @param int $value
+     * @return UserConfigInterface|null
+     */
+    public function retrieveByUserId(int $value): ?UserConfigInterface
+    {
+        if (isset($this->registryByKey['user_id'][$value])) {
+            return $this->retrieveById($this->registryByKey['user_id'][$value]);
+        }
+
+        return null;
+    }
+
+    /**
+     * Push one object into registry
+     * @param UserConfig $userConfig
+     */
+    public function push(UserConfig $userConfig): void
+    {
+        $this->registry[$userConfig->getId()] = $userConfig->getDataModel();
+        foreach (array_keys($this->registryByKey) as $key) {
+            $this->registryByKey[$key][$userConfig->getData($key)] = $userConfig->getId();
+        }
+    }
+}
diff --git a/TwoFactorAuth/Observer/AdminUserLoadAfter.php b/TwoFactorAuth/Observer/AdminUserLoadAfter.php
new file mode 100644
index 00000000..151d53b3
--- /dev/null
+++ b/TwoFactorAuth/Observer/AdminUserLoadAfter.php
@@ -0,0 +1,39 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Observer;
+
+use Magento\Framework\Event\Observer;
+use Magento\Framework\Event\ObserverInterface;
+use Magento\TwoFactorAuth\Api\UserConfigManagerInterface;
+
+/**
+ * Add tfa providers information to user entity
+ */
+class AdminUserLoadAfter implements ObserverInterface
+{
+    /**
+     * @var UserConfigManagerInterface
+     */
+    private $userConfigManager;
+
+    public function __construct(
+        UserConfigManagerInterface $userConfigManager
+    ) {
+        $this->userConfigManager = $userConfigManager;
+    }
+
+    /**
+     * @param Observer $observer
+     * @return void
+     */
+    public function execute(Observer $observer)
+    {
+        $user = $observer->getEvent()->getObject();
+        $user->setData('tfa_providers', $this->userConfigManager->getProvidersCodes((int) $user->getId()));
+    }
+}
diff --git a/TwoFactorAuth/Observer/AdminUserSaveAfter.php b/TwoFactorAuth/Observer/AdminUserSaveAfter.php
new file mode 100644
index 00000000..f5777997
--- /dev/null
+++ b/TwoFactorAuth/Observer/AdminUserSaveAfter.php
@@ -0,0 +1,59 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Observer;
+
+use Magento\Framework\AuthorizationInterface;
+use Magento\Framework\Event\Observer;
+use Magento\Framework\Event\ObserverInterface;
+use Magento\TwoFactorAuth\Api\UserConfigManagerInterface;
+
+/**
+ * Save tfa providers information in user entity
+ */
+class AdminUserSaveAfter implements ObserverInterface
+{
+    /**
+     * @var UserConfigManagerInterface
+     */
+    private $userConfigManager;
+
+    /**
+     * @var AuthorizationInterface
+     */
+    private $authorization;
+
+    /**
+     * @param UserConfigManagerInterface $userConfigManager
+     * @param AuthorizationInterface $authorization
+     */
+    public function __construct(
+        UserConfigManagerInterface $userConfigManager,
+        AuthorizationInterface $authorization
+    ) {
+        $this->userConfigManager = $userConfigManager;
+        $this->authorization = $authorization;
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function execute(Observer $observer)
+    {
+        if ($this->authorization->isAllowed('Magento_TwoFactorAuth::tfa')) {
+            $user = $observer->getEvent()->getObject();
+            $data = $user->getData();
+
+            if (isset($data['tfa_providers'])) {
+                if (!is_array($data['tfa_providers'])) {
+                    $data['tfa_providers'] = [];
+                }
+                $this->userConfigManager->setProvidersCodes((int) $user->getId(), $data['tfa_providers']);
+            }
+        }
+    }
+}
diff --git a/TwoFactorAuth/Observer/ControllerActionPredispatch.php b/TwoFactorAuth/Observer/ControllerActionPredispatch.php
new file mode 100644
index 00000000..784a6fd4
--- /dev/null
+++ b/TwoFactorAuth/Observer/ControllerActionPredispatch.php
@@ -0,0 +1,162 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Observer;
+
+use Magento\Authorization\Model\UserContextInterface;
+use Magento\Backend\App\AbstractAction;
+use Magento\Framework\App\Action\Action;
+use Magento\Framework\App\ActionFlag;
+use Magento\Framework\AuthorizationInterface;
+use Magento\Framework\Event\Observer;
+use Magento\Framework\Event\ObserverInterface;
+use Magento\Framework\UrlInterface;
+use Magento\TwoFactorAuth\Controller\Adminhtml\Tfa\Configure;
+use Magento\TwoFactorAuth\Controller\Adminhtml\Tfa\Index;
+use Magento\TwoFactorAuth\Api\TfaInterface;
+use Magento\TwoFactorAuth\Api\TfaSessionInterface;
+use Magento\TwoFactorAuth\Api\UserConfigRequestManagerInterface;
+use Magento\TwoFactorAuth\Model\UserConfig\HtmlAreaTokenVerifier;
+
+/**
+ * Handle redirection to 2FA page if required
+ */
+class ControllerActionPredispatch implements ObserverInterface
+{
+    /**
+     * @var TfaInterface
+     */
+    private $tfa;
+
+    /**
+     * @var TfaSessionInterface
+     */
+    private $tfaSession;
+
+    /**
+     * @var UserConfigRequestManagerInterface
+     */
+    private $configRequestManager;
+
+    /**
+     * @var AbstractAction|null
+     */
+    private $action;
+
+    /**
+     * @var HtmlAreaTokenVerifier
+     */
+    private $tokenManager;
+
+    /**
+     * @var ActionFlag
+     */
+    private $actionFlag;
+
+    /**
+     * @var UrlInterface
+     */
+    private $url;
+
+    /**
+     * @var AuthorizationInterface
+     */
+    private $authorization;
+
+    /**
+     * @var UserContextInterface
+     */
+    private $userContext;
+
+    /**
+     * @param TfaInterface $tfa
+     * @param TfaSessionInterface $tfaSession
+     * @param UserConfigRequestManagerInterface $configRequestManager
+     * @param HtmlAreaTokenVerifier $tokenManager
+     * @param ActionFlag $actionFlag
+     * @param UrlInterface $url
+     * @param AuthorizationInterface $authorization
+     * @param UserContextInterface $userContext
+     */
+    public function __construct(
+        TfaInterface $tfa,
+        TfaSessionInterface $tfaSession,
+        UserConfigRequestManagerInterface $configRequestManager,
+        HtmlAreaTokenVerifier $tokenManager,
+        ActionFlag $actionFlag,
+        UrlInterface $url,
+        AuthorizationInterface $authorization,
+        UserContextInterface $userContext
+    ) {
+        $this->tfa = $tfa;
+        $this->tfaSession = $tfaSession;
+        $this->configRequestManager = $configRequestManager;
+        $this->tokenManager = $tokenManager;
+        $this->actionFlag = $actionFlag;
+        $this->url = $url;
+        $this->authorization = $authorization;
+        $this->userContext = $userContext;
+    }
+
+    /**
+     * Redirect user to given URL.
+     *
+     * @param string $url
+     * @return void
+     */
+    private function redirect(string $url): void
+    {
+        $this->actionFlag->set('', Action::FLAG_NO_DISPATCH, true);
+        $this->action->getResponse()->setRedirect($this->url->getUrl($url));
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function execute(Observer $observer)
+    {
+        /** @var $controllerAction AbstractAction */
+        $controllerAction = $observer->getEvent()->getData('controller_action');
+        $this->action = $controllerAction;
+        $fullActionName = $controllerAction->getRequest()->getFullActionName();
+        $userId = $this->userContext->getUserId();
+
+        $this->tokenManager->readConfigToken();
+
+        if (in_array($fullActionName, $this->tfa->getAllowedUrls(), true)) {
+            //Actions that are used for 2FA must remain accessible.
+            return;
+        }
+
+        if ($userId) {
+            $configurationStillRequired = $this->configRequestManager->isConfigurationRequiredFor($userId);
+            $toActivate = $this->tfa->getProvidersToActivate($userId);
+            $toActivateCodes = [];
+            foreach ($toActivate as $toActivateProvider) {
+                $toActivateCodes[] = $toActivateProvider->getCode();
+            }
+            $accessGranted = $this->tfaSession->isGranted();
+
+            if (!$accessGranted && $configurationStillRequired) {
+                //User needs special link with a token to be allowed to configure 2FA
+                if ($this->authorization->isAllowed(Configure::ADMIN_RESOURCE)) {
+                    $this->redirect('tfa/tfa/requestconfig');
+                } else {
+                    $this->redirect('tfa/tfa/accessdenied');
+                }
+            } else {
+                if (!$accessGranted) {
+                    if ($this->authorization->isAllowed(Index::ADMIN_RESOURCE)) {
+                        $this->redirect('tfa/tfa/index');
+                    } else {
+                        $this->redirect('tfa/tfa/accessdenied');
+                    }
+                }
+            }
+        }
+    }
+}
diff --git a/TwoFactorAuth/Plugin/AddTabToAdminUserEdit.php b/TwoFactorAuth/Plugin/AddTabToAdminUserEdit.php
new file mode 100644
index 00000000..f788c95a
--- /dev/null
+++ b/TwoFactorAuth/Plugin/AddTabToAdminUserEdit.php
@@ -0,0 +1,67 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Plugin;
+
+use Magento\Framework\AuthorizationInterface;
+use Magento\Framework\Exception\LocalizedException;
+use Magento\TwoFactorAuth\Api\TfaInterface;
+use Magento\User\Block\User\Edit\Tabs;
+
+/**
+ * Add 2FA tab to admin user edit in backend
+ */
+class AddTabToAdminUserEdit
+{
+    /**
+     * @var TfaInterface
+     */
+    private $tfa;
+
+    /**
+     * @var AuthorizationInterface
+     */
+    private $authorization;
+
+    /**
+     * @param TfaInterface $tfa
+     * @param AuthorizationInterface $authorization
+     */
+    public function __construct(
+        TfaInterface $tfa,
+        AuthorizationInterface $authorization
+    ) {
+        $this->tfa = $tfa;
+        $this->authorization = $authorization;
+    }
+
+    /**
+     * @param Tabs $subject
+     * @throws LocalizedException
+     */
+    public function beforeToHtml(Tabs $subject)
+    {
+        if (empty($this->tfa->getAllEnabledProviders()) ||
+            !$this->authorization->isAllowed('Magento_TwoFactorAuth::tfa')
+        ) {
+            return;
+        }
+
+        $tfaForm = $subject->getLayout()->renderElement('tfa_edit_user_form');
+
+        $subject->addTabAfter(
+            'twofactorauth',
+            [
+                'label' => __('2FA'),
+                'title' => __('2FA'),
+                'content' => $tfaForm,
+                'active' => true
+            ],
+            'roles_section'
+        );
+    }
+}
diff --git a/TwoFactorAuth/Plugin/AvoidRecursionOnPasswordChange.php b/TwoFactorAuth/Plugin/AvoidRecursionOnPasswordChange.php
new file mode 100644
index 00000000..597d9688
--- /dev/null
+++ b/TwoFactorAuth/Plugin/AvoidRecursionOnPasswordChange.php
@@ -0,0 +1,64 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Plugin;
+
+use Closure;
+use Magento\Framework\App\RequestInterface;
+use Magento\Framework\Event\Observer as EventObserver;
+use Magento\TwoFactorAuth\Api\TfaInterface;
+use Magento\User\Observer\Backend\ForceAdminPasswordChangeObserver;
+
+/**
+ * Avoid a recursion when force password change is activated in backend
+ */
+class AvoidRecursionOnPasswordChange
+{
+    /**
+     * @var RequestInterface
+     */
+    private $request;
+
+    /**
+     * @var TfaInterface
+     */
+    private $tfa;
+
+    /**
+     * @param RequestInterface $request
+     * @param TfaInterface $tfa
+     */
+    public function __construct(
+        RequestInterface $request,
+        TfaInterface $tfa
+    ) {
+        $this->request = $request;
+        $this->tfa = $tfa;
+    }
+
+    /**
+     * @SuppressWarnings(PHPMD.UnusedFormalParameter)
+     * @param ForceAdminPasswordChangeObserver $subject
+     * @param Closure $proceed
+     * @param EventObserver $observer
+     * @return void
+     */
+    public function aroundExecute(
+        ForceAdminPasswordChangeObserver $subject,
+        Closure $proceed,
+        EventObserver $observer
+    ) {
+        /*
+         * We need to bypass ForceAdminPasswordChangeObserver::execute while authenticating 2FA
+         * to avoid a recursion loop caused by two different redirects
+         */
+        $fullActionName = $this->request->getFullActionName();
+        if (!in_array($fullActionName, $this->tfa->getAllowedUrls(), true)) {
+            $proceed($observer);
+        }
+    }
+}
diff --git a/TwoFactorAuth/README.md b/TwoFactorAuth/README.md
new file mode 100644
index 00000000..05fa32be
--- /dev/null
+++ b/TwoFactorAuth/README.md
@@ -0,0 +1,99 @@
+MSP TwoFactorAuth
+
+Two Factor Authentication module for maximum **backend access protection** in Magento 2.
+
+> Member of **MSP Security Suite**
+>
+> See: https://github.com/magespecialist/m2-MSP_Security_Suite
+
+Did you lock yourself out from Magento backend? <a href="https://github.com/magespecialist/m2-Magento_TwoFactorAuth#emergency-commandline-disable">click here.</a>
+
+## Main features:
+
+* Providers:
+    * Google authenticator
+        * QR code enroll
+    * Authy
+        * SMS
+        * Call
+        * Token
+        * One touch
+    * U2F keys (Yubico and others)
+    * Duo Security
+        * SMS
+        * Push notification
+* Central security suite events logging
+* Per user configuration
+* Forced global 2FA configuration
+
+## Installing on Magento2:
+
+**1. Install using composer**
+
+From command line: 
+
+`composer require msp/twofactorauth`
+
+**2. Enable and configure from your Magento backend config**
+
+Enable from **Store > Config > SecuritySuite > Two Factor Authentication**.
+
+<img src="https://raw.githubusercontent.com/magespecialist/m2-Magento_TwoFactorAuth/master/screenshots/config.png" />
+
+**3. Enable two factor authentication for your user**
+
+You can select among a set of different 2FA providers. **Multiple concurrent providers** are supported.
+
+<img src="https://raw.githubusercontent.com/magespecialist/m2-Magento_TwoFactorAuth/master/screenshots/user_tfa.png" />
+
+**4. Subscribe / Configure your 2FA provider(s):**
+
+**4.1 Google Authenticator example**
+
+<img src="https://raw.githubusercontent.com/magespecialist/m2-Magento_TwoFactorAuth/master/screenshots/google_qr.png" />
+
+**4.2. Duo Security example**
+
+<img src="https://raw.githubusercontent.com/magespecialist/m2-Magento_TwoFactorAuth/master/screenshots/duo_auth.png" />
+
+**4.3. U2F key (Yubico and others) example**
+
+<img src="https://raw.githubusercontent.com/magespecialist/m2-Magento_TwoFactorAuth/master/screenshots/u2f_auth.png" />
+
+**4.4. Authy example**
+
+<img src="https://raw.githubusercontent.com/magespecialist/m2-Magento_TwoFactorAuth/master/screenshots/authy_auth.png" />
+
+## Emergency commandline disable:
+
+If you messed up with two factor authentication you can disable it from command-line:
+
+`php bin/magento msp:security:tfa:disable`
+
+This will disable two factor auth globally.
+
+## Emergency commandline reset:
+
+If you need to manually reset one single user configuration (so you can restart configuration / subscription), type:
+ 
+`php bin/magento msp:security:tfa:reset <username> <provider>`
+
+e.g.:
+
+`php bin/magento msp:security:tfa:reset admin google`
+
+`php bin/magento msp:security:tfa:reset admin u2fkey`
+
+`php bin/magento msp:security:tfa:reset admin authy`
+
+## Emergency of emergency and your house is on fire, your dog is lost and your wife doesn't love you anymore:
+
+**DO NOT ATTEMPT TO MODIFY ANY DB INFORMATION UNLESS YOU UNDERSTAND WHAT YOU ARE DOING**
+
+Table `core_config_data`:
+* `msp/twofactorauth/enabled`: Set to zero to disable 2fa globally
+* `msp/twofactorauth/force_providers`: Delete this entry to remove forced providers option
+
+Table `msp_tfa_user_config`:
+* Delete one user row to reset user's 2FA preference and configuration
+
diff --git a/TwoFactorAuth/Setup/Patch/Data/CopyConfigFromOldModule.php b/TwoFactorAuth/Setup/Patch/Data/CopyConfigFromOldModule.php
new file mode 100644
index 00000000..caeab859
--- /dev/null
+++ b/TwoFactorAuth/Setup/Patch/Data/CopyConfigFromOldModule.php
@@ -0,0 +1,106 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Setup\Patch\Data;
+
+use Magento\Framework\App\Config\ScopeConfigInterface;
+use Magento\Framework\Setup\ModuleDataSetupInterface;
+use Magento\Framework\Setup\Patch\DataPatchInterface;
+
+/**
+ * Copy configuration after migrating from MageSpecialist to Magento
+ */
+class CopyConfigFromOldModule implements DataPatchInterface
+{
+    /**
+     * @var ModuleDataSetupInterface
+     */
+    private $moduleDataSetup;
+
+    /**
+     * @var ScopeConfigInterface
+     */
+    private $scopeConfig;
+
+    /**
+     * @param ModuleDataSetupInterface $moduleDataSetup
+     * @param ScopeConfigInterface $scopeConfig
+     */
+    public function __construct(
+        ModuleDataSetupInterface $moduleDataSetup,
+        ScopeConfigInterface $scopeConfig
+    ) {
+        $this->moduleDataSetup = $moduleDataSetup;
+        $this->scopeConfig = $scopeConfig;
+    }
+
+    /**
+     * Move config from srcPath to dstPath
+     *
+     * @param array $paths
+     */
+    private function copyConfig(array $paths): void
+    {
+        $connection = $this->moduleDataSetup->getConnection();
+        $configDataTable = $this->moduleDataSetup->getTable('core_config_data');
+
+        foreach ($paths as $srcPath => $dstPath) {
+            $value = $this->scopeConfig->getValue($srcPath);
+            if (is_array($value)) {
+                foreach (array_keys($value) as $v) {
+                    $this->copyConfig([$srcPath . '/' . $v => $dstPath . '/' . $v]);
+                }
+            } else {
+                $sel = $connection->select()
+                    ->from($configDataTable)
+                    ->where('path = ?', $srcPath);
+
+                $rows = $connection->fetchAll($sel);
+                foreach ($rows as $row) {
+                    unset($row['config_id']);
+                    $row['path'] = $dstPath;
+
+                    $connection->insert($configDataTable, $row);
+                }
+            }
+        }
+    }
+
+    /**
+     * {@inheritdoc}
+     * @SuppressWarnings(PHPMD.ExcessiveMethodLength)
+     * @SuppressWarnings(PHPMD.CyclomaticComplexity)
+     * @SuppressWarnings(PHPMD.NPathComplexity)
+     */
+    public function apply()
+    {
+        $this->moduleDataSetup->startSetup();
+
+        // Previous versions configuration
+        $this->copyConfig([
+            'msp_securitysuite_twofactorauth' => 'twofactorauth'
+        ]);
+
+        $this->moduleDataSetup->endSetup();
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public static function getDependencies()
+    {
+        return [];
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function getAliases()
+    {
+        return [];
+    }
+}
diff --git a/TwoFactorAuth/Setup/Patch/Data/EncryptConfiguration.php b/TwoFactorAuth/Setup/Patch/Data/EncryptConfiguration.php
new file mode 100644
index 00000000..f2a16736
--- /dev/null
+++ b/TwoFactorAuth/Setup/Patch/Data/EncryptConfiguration.php
@@ -0,0 +1,85 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Setup\Patch\Data;
+
+use Magento\Framework\Encryption\EncryptorInterface;
+use Magento\Framework\Setup\ModuleDataSetupInterface;
+use Magento\Framework\Setup\Patch\DataPatchInterface;
+
+/**
+ * Encrypt configuration
+ */
+class EncryptConfiguration implements DataPatchInterface
+{
+    /**
+     * @var ModuleDataSetupInterface
+     */
+    private $moduleDataSetup;
+
+    /**
+     * @var EncryptorInterface
+     */
+    private $encryptor;
+
+    /**
+     * @param ModuleDataSetupInterface $moduleDataSetup
+     * @param EncryptorInterface $encryptor
+     */
+    public function __construct(
+        ModuleDataSetupInterface $moduleDataSetup,
+        EncryptorInterface $encryptor
+    ) {
+        $this->moduleDataSetup = $moduleDataSetup;
+        $this->encryptor = $encryptor;
+    }
+
+    /**
+     * {@inheritdoc}
+     * @SuppressWarnings(PHPMD.ExcessiveMethodLength)
+     * @SuppressWarnings(PHPMD.CyclomaticComplexity)
+     * @SuppressWarnings(PHPMD.NPathComplexity)
+     */
+    public function apply()
+    {
+        $this->moduleDataSetup->startSetup();
+
+        $tfaConfigTableName = $this->moduleDataSetup->getTable('tfa_user_config');
+        $connection = $this->moduleDataSetup->getConnection();
+
+        $qry = $connection->select()->from($tfaConfigTableName);
+        $configurations = $connection->fetchAll($qry);
+
+        foreach ($configurations as $configuration) {
+            if (!$this->encryptor->decrypt($configuration['encoded_config'])) {
+                $connection->update(
+                    $tfaConfigTableName,
+                    ['encoded_config' => $this->encryptor->encrypt($configuration['encoded_config'])],
+                    $connection->quoteInto('config_id = ?', $configuration['config_id'])
+                );
+            }
+        }
+
+        $this->moduleDataSetup->endSetup();
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public static function getDependencies()
+    {
+        return [];
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function getAliases()
+    {
+        return [];
+    }
+}
diff --git a/TwoFactorAuth/Setup/Patch/Data/EncryptSecrets.php b/TwoFactorAuth/Setup/Patch/Data/EncryptSecrets.php
new file mode 100644
index 00000000..15ae99f9
--- /dev/null
+++ b/TwoFactorAuth/Setup/Patch/Data/EncryptSecrets.php
@@ -0,0 +1,93 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Setup\Patch\Data;
+
+use Magento\Framework\Encryption\EncryptorInterface;
+use Magento\Framework\Setup\ModuleDataSetupInterface;
+use Magento\Framework\Setup\Patch\DataPatchInterface;
+use Magento\TwoFactorAuth\Model\Provider\Engine\Authy\Service;
+use Magento\TwoFactorAuth\Model\Provider\Engine\DuoSecurity;
+
+/**
+ * Encrypt secrets in configuration
+ */
+class EncryptSecrets implements DataPatchInterface
+{
+    /**
+     * @var ModuleDataSetupInterface
+     */
+    private $moduleDataSetup;
+
+    /**
+     * @var EncryptorInterface
+     */
+    private $encryptor;
+
+    /**
+     * @param ModuleDataSetupInterface $moduleDataSetup
+     * @param EncryptorInterface $encryptor
+     */
+    public function __construct(
+        ModuleDataSetupInterface $moduleDataSetup,
+        EncryptorInterface $encryptor
+    ) {
+        $this->moduleDataSetup = $moduleDataSetup;
+        $this->encryptor = $encryptor;
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function apply()
+    {
+        $this->moduleDataSetup->startSetup();
+
+        $configTable = $this->moduleDataSetup->getTable('core_config_data');
+        $connection = $this->moduleDataSetup->getConnection();
+
+        $query = $connection->select()
+            ->from($configTable)
+            ->where(
+                'path in (?)',
+                [
+                    DuoSecurity::XML_PATH_APPLICATION_KEY,
+                    DuoSecurity::XML_PATH_SECRET_KEY,
+                    Service::XML_PATH_API_KEY,
+                ]
+            );
+        $configurations = $connection->fetchAll($query);
+
+        foreach ($configurations as $configuration) {
+            if (preg_match('/[^\x00-\x7F]/', $this->encryptor->decrypt($configuration['value']))) {
+                $connection->update(
+                    $configTable,
+                    ['value' => $this->encryptor->encrypt($configuration['value'])],
+                    $connection->quoteInto('config_id = ?', $configuration['config_id'])
+                );
+            }
+        }
+
+        $this->moduleDataSetup->endSetup();
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public static function getDependencies()
+    {
+        return [];
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function getAliases()
+    {
+        return [];
+    }
+}
diff --git a/TwoFactorAuth/Setup/Patch/Data/GenerateDuoSecurityKey.php b/TwoFactorAuth/Setup/Patch/Data/GenerateDuoSecurityKey.php
new file mode 100644
index 00000000..e92e2a7e
--- /dev/null
+++ b/TwoFactorAuth/Setup/Patch/Data/GenerateDuoSecurityKey.php
@@ -0,0 +1,93 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Setup\Patch\Data;
+
+use Magento\Framework\App\Config\ConfigResource\ConfigInterface;
+use Magento\Framework\App\Config\ScopeConfigInterface;
+use Magento\Framework\Setup\ModuleDataSetupInterface;
+use Magento\Framework\Setup\Patch\DataPatchInterface;
+use Magento\TwoFactorAuth\Model\Provider\Engine\DuoSecurity;
+
+/**
+ * Generate duo security key
+ */
+class GenerateDuoSecurityKey implements DataPatchInterface
+{
+    /**
+     * @var ModuleDataSetupInterface
+     */
+    private $moduleDataSetup;
+
+    /**
+     * @var ConfigInterface
+     */
+    private $config;
+
+    /**
+     * @var ScopeConfigInterface
+     */
+    private $scopeConfig;
+
+    /**
+     * @param ModuleDataSetupInterface $moduleDataSetup
+     * @param ConfigInterface $config
+     * @param ScopeConfigInterface $scopeConfig
+     */
+    public function __construct(
+        ModuleDataSetupInterface $moduleDataSetup,
+        ConfigInterface $config,
+        ScopeConfigInterface $scopeConfig
+    ) {
+        $this->moduleDataSetup = $moduleDataSetup;
+        $this->config = $config;
+        $this->scopeConfig = $scopeConfig;
+    }
+
+    /**
+     * {@inheritdoc}
+     * @SuppressWarnings(PHPMD.ExcessiveMethodLength)
+     * @SuppressWarnings(PHPMD.CyclomaticComplexity)
+     * @SuppressWarnings(PHPMD.NPathComplexity)
+     */
+    public function apply()
+    {
+        $this->moduleDataSetup->startSetup();
+
+        if (!$this->scopeConfig->getValue(DuoSecurity::XML_PATH_APPLICATION_KEY)) {
+            // Generate random duo security key
+            $characters = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';
+            $charactersLength = strlen($characters);
+            $randomString = '';
+            for ($i = 0; $i < 64; $i++) {
+                $randomString .= $characters[random_int(0, $charactersLength - 1)];
+            }
+
+            $this->config->saveConfig(DuoSecurity::XML_PATH_APPLICATION_KEY, $randomString, 'default', 0);
+        }
+
+        $this->moduleDataSetup->endSetup();
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public static function getDependencies()
+    {
+        return [
+            CopyConfigFromOldModule::class
+        ];
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function getAliases()
+    {
+        return [];
+    }
+}
diff --git a/TwoFactorAuth/Setup/Patch/Data/PopulateCountryTable.php b/TwoFactorAuth/Setup/Patch/Data/PopulateCountryTable.php
new file mode 100644
index 00000000..fa5c6474
--- /dev/null
+++ b/TwoFactorAuth/Setup/Patch/Data/PopulateCountryTable.php
@@ -0,0 +1,104 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Setup\Patch\Data;
+
+use Magento\Framework\Filesystem\Io\File;
+use Magento\Framework\Module\Dir\Reader;
+use Magento\Framework\Serialize\SerializerInterface;
+use Magento\Framework\Setup\ModuleDataSetupInterface;
+use Magento\Framework\Setup\Patch\DataPatchInterface;
+
+/**
+ * Populate country codes table
+ */
+class PopulateCountryTable implements DataPatchInterface
+{
+    /**
+     * @var ModuleDataSetupInterface
+     */
+    private $moduleDataSetup;
+
+    /**
+     * @var File
+     */
+    private $file;
+
+    /**
+     * @var Reader
+     */
+    private $moduleReader;
+
+    /**
+     * @var SerializerInterface
+     */
+    private $serializer;
+
+    /**
+     * @param ModuleDataSetupInterface $moduleDataSetup
+     * @param SerializerInterface $serializer
+     * @param File $file
+     * @param Reader $moduleReader
+     */
+    public function __construct(
+        ModuleDataSetupInterface $moduleDataSetup,
+        SerializerInterface $serializer,
+        File $file,
+        Reader $moduleReader
+    ) {
+        $this->moduleDataSetup = $moduleDataSetup;
+        $this->file = $file;
+        $this->moduleReader = $moduleReader;
+        $this->serializer = $serializer;
+    }
+
+    /**
+     * {@inheritdoc}
+     * @SuppressWarnings(PHPMD.ExcessiveMethodLength)
+     * @SuppressWarnings(PHPMD.CyclomaticComplexity)
+     * @SuppressWarnings(PHPMD.NPathComplexity)
+     */
+    public function apply()
+    {
+        $this->moduleDataSetup->startSetup();
+        $connection = $this->moduleDataSetup->getConnection();
+
+        $tableName = $this->moduleDataSetup->getTable('tfa_country_codes');
+
+        $countryCodesJsonFile =
+            $this->moduleReader->getModuleDir(false, 'Magento_TwoFactorAuth') . DIRECTORY_SEPARATOR . 'Setup' .
+            DIRECTORY_SEPARATOR . 'data' . DIRECTORY_SEPARATOR . 'country_codes.json';
+
+        $countryCodesJson = $this->file->read($countryCodesJsonFile);
+
+        $countryCodes = $this->serializer->unserialize(trim($countryCodesJson));
+
+        // @codingStandardsIgnoreStart
+        foreach ($countryCodes as $countryCode) {
+            $connection->insertOnDuplicate($tableName, $countryCode, ['dial_code']);
+        }
+        // @codingStandardsIgnoreEnd
+
+        $this->moduleDataSetup->endSetup();
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public static function getDependencies()
+    {
+        return [];
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function getAliases()
+    {
+        return [];
+    }
+}
diff --git a/TwoFactorAuth/Setup/Patch/Data/ResetU2fConfig.php b/TwoFactorAuth/Setup/Patch/Data/ResetU2fConfig.php
new file mode 100644
index 00000000..9b0f041a
--- /dev/null
+++ b/TwoFactorAuth/Setup/Patch/Data/ResetU2fConfig.php
@@ -0,0 +1,91 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Setup\Patch\Data;
+
+use Magento\Framework\Exception\NoSuchEntityException;
+use Magento\Framework\Setup\ModuleDataSetupInterface;
+use Magento\Framework\Setup\Patch\DataPatchInterface;
+use Magento\TwoFactorAuth\Api\UserConfigManagerInterface;
+use Magento\TwoFactorAuth\Model\Provider\Engine\U2fKey;
+use Magento\User\Model\ResourceModel\User\CollectionFactory;
+use Magento\User\Model\User;
+
+/**
+ * Reset the U2f data due to rewrite
+ */
+class ResetU2FConfig implements DataPatchInterface
+{
+    /**
+     * @var ModuleDataSetupInterface
+     */
+    private $moduleDataSetup;
+
+    /**
+     * @var CollectionFactory
+     */
+    private $userCollectionFactory;
+
+    /**
+     * @var UserConfigManagerInterface
+     */
+    private $userConfigManager;
+
+    /**
+     * @param ModuleDataSetupInterface $moduleDataSetup
+     * @param CollectionFactory $userCollectionFactory
+     * @param UserConfigManagerInterface $userConfigManager
+     */
+    public function __construct(
+        ModuleDataSetupInterface $moduleDataSetup,
+        CollectionFactory $userCollectionFactory,
+        UserConfigManagerInterface $userConfigManager
+    ) {
+        $this->moduleDataSetup = $moduleDataSetup;
+        $this->userCollectionFactory = $userCollectionFactory;
+        $this->userConfigManager = $userConfigManager;
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function apply()
+    {
+        $this->moduleDataSetup->startSetup();
+
+        /** @var \Magento\User\Model\ResourceModel\User\Collection $collection */
+        $collection = $this->userCollectionFactory->create();
+
+        foreach ($collection as $user) {
+            /** @var $user User */
+
+            try {
+                $this->userConfigManager->setProviderConfig((int)$user->getId(), U2fKey::CODE, []);
+            } catch (NoSuchEntityException $e) {
+                continue;
+            }
+        }
+
+        $this->moduleDataSetup->endSetup();
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public static function getDependencies()
+    {
+        return [];
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function getAliases()
+    {
+        return [];
+    }
+}
diff --git a/TwoFactorAuth/Setup/Patch/Schema/CopyTablesFromOldModule.php b/TwoFactorAuth/Setup/Patch/Schema/CopyTablesFromOldModule.php
new file mode 100644
index 00000000..81ad6b10
--- /dev/null
+++ b/TwoFactorAuth/Setup/Patch/Schema/CopyTablesFromOldModule.php
@@ -0,0 +1,84 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Setup\Patch\Schema;
+
+use Magento\Framework\Setup\Patch\SchemaPatchInterface;
+use Magento\Framework\Setup\SchemaSetupInterface;
+
+/**
+ * Copy table contents after migrating from MageSpecialist to Magento
+ * @SuppressWarnings(PHPMD.CouplingBetweenObjects)
+ */
+class CopyTablesFromOldModule implements SchemaPatchInterface
+{
+    /**
+     * @var SchemaSetupInterface
+     */
+    private $schemaSetup;
+
+    /**
+     * @param SchemaSetupInterface $schemaSetup
+     */
+    public function __construct(
+        SchemaSetupInterface $schemaSetup
+    ) {
+        $this->schemaSetup = $schemaSetup;
+    }
+
+    /**
+     * {@inheritdoc}
+     * @SuppressWarnings(PHPMD.ExcessiveMethodLength)
+     * @SuppressWarnings(PHPMD.CyclomaticComplexity)
+     * @SuppressWarnings(PHPMD.NPathComplexity)
+     */
+    public function apply()
+    {
+        $this->schemaSetup->startSetup();
+
+        $connection = $this->schemaSetup->getConnection();
+        $sourceUserConfigTable = $this->schemaSetup->getTable('msp_tfa_user_config');
+        $sourceTrustedDevicesTable = $this->schemaSetup->getTable('msp_tfa_trusted');
+
+        $userConfigTable = $this->schemaSetup->getTable('tfa_user_config');
+        $trustedDevicesTable = $this->schemaSetup->getTable('tfa_trusted');
+
+        if ($connection->isTableExists($sourceUserConfigTable)) {
+            $cols = ['user_id', 'encoded_providers', 'encoded_config', 'default_provider'];
+            $connection->query($connection->insertFromSelect(
+                $connection->select()->from($sourceUserConfigTable, $cols),
+                $userConfigTable,
+                $cols
+            ));
+        }
+
+        if ($connection->isTableExists($sourceTrustedDevicesTable)) {
+            $connection->dropTable($sourceTrustedDevicesTable);
+        }
+        if ($connection->isTableExists($trustedDevicesTable)) {
+            $connection->dropTable($trustedDevicesTable);
+        }
+
+        $this->schemaSetup->endSetup();
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public static function getDependencies()
+    {
+        return [];
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function getAliases()
+    {
+        return [];
+    }
+}
diff --git a/TwoFactorAuth/Setup/data/country_codes.json b/TwoFactorAuth/Setup/data/country_codes.json
new file mode 100644
index 00000000..541a1745
--- /dev/null
+++ b/TwoFactorAuth/Setup/data/country_codes.json
@@ -0,0 +1,1207 @@
+[
+  {
+    "name": "Israel",
+    "dial_code": "+972",
+    "code": "IL"
+  },
+  {
+    "name": "Afghanistan",
+    "dial_code": "+93",
+    "code": "AF"
+  },
+  {
+    "name": "Albania",
+    "dial_code": "+355",
+    "code": "AL"
+  },
+  {
+    "name": "Algeria",
+    "dial_code": "+213",
+    "code": "DZ"
+  },
+  {
+    "name": "AmericanSamoa",
+    "dial_code": "+1 684",
+    "code": "AS"
+  },
+  {
+    "name": "Andorra",
+    "dial_code": "+376",
+    "code": "AD"
+  },
+  {
+    "name": "Angola",
+    "dial_code": "+244",
+    "code": "AO"
+  },
+  {
+    "name": "Anguilla",
+    "dial_code": "+1 264",
+    "code": "AI"
+  },
+  {
+    "name": "Antigua and Barbuda",
+    "dial_code": "+1268",
+    "code": "AG"
+  },
+  {
+    "name": "Argentina",
+    "dial_code": "+54",
+    "code": "AR"
+  },
+  {
+    "name": "Armenia",
+    "dial_code": "+374",
+    "code": "AM"
+  },
+  {
+    "name": "Aruba",
+    "dial_code": "+297",
+    "code": "AW"
+  },
+  {
+    "name": "Australia",
+    "dial_code": "+61",
+    "code": "AU"
+  },
+  {
+    "name": "Austria",
+    "dial_code": "+43",
+    "code": "AT"
+  },
+  {
+    "name": "Azerbaijan",
+    "dial_code": "+994",
+    "code": "AZ"
+  },
+  {
+    "name": "Bahamas",
+    "dial_code": "+1 242",
+    "code": "BS"
+  },
+  {
+    "name": "Bahrain",
+    "dial_code": "+973",
+    "code": "BH"
+  },
+  {
+    "name": "Bangladesh",
+    "dial_code": "+880",
+    "code": "BD"
+  },
+  {
+    "name": "Barbados",
+    "dial_code": "+1 246",
+    "code": "BB"
+  },
+  {
+    "name": "Belarus",
+    "dial_code": "+375",
+    "code": "BY"
+  },
+  {
+    "name": "Belgium",
+    "dial_code": "+32",
+    "code": "BE"
+  },
+  {
+    "name": "Belize",
+    "dial_code": "+501",
+    "code": "BZ"
+  },
+  {
+    "name": "Benin",
+    "dial_code": "+229",
+    "code": "BJ"
+  },
+  {
+    "name": "Bermuda",
+    "dial_code": "+1 441",
+    "code": "BM"
+  },
+  {
+    "name": "Bhutan",
+    "dial_code": "+975",
+    "code": "BT"
+  },
+  {
+    "name": "Bosnia and Herzegovina",
+    "dial_code": "+387",
+    "code": "BA"
+  },
+  {
+    "name": "Botswana",
+    "dial_code": "+267",
+    "code": "BW"
+  },
+  {
+    "name": "Brazil",
+    "dial_code": "+55",
+    "code": "BR"
+  },
+  {
+    "name": "British Indian Ocean Territory",
+    "dial_code": "+246",
+    "code": "IO"
+  },
+  {
+    "name": "Bulgaria",
+    "dial_code": "+359",
+    "code": "BG"
+  },
+  {
+    "name": "Burkina Faso",
+    "dial_code": "+226",
+    "code": "BF"
+  },
+  {
+    "name": "Burundi",
+    "dial_code": "+257",
+    "code": "BI"
+  },
+  {
+    "name": "Cambodia",
+    "dial_code": "+855",
+    "code": "KH"
+  },
+  {
+    "name": "Cameroon",
+    "dial_code": "+237",
+    "code": "CM"
+  },
+  {
+    "name": "Canada",
+    "dial_code": "+1",
+    "code": "CA"
+  },
+  {
+    "name": "Cape Verde",
+    "dial_code": "+238",
+    "code": "CV"
+  },
+  {
+    "name": "Cayman Islands",
+    "dial_code": "+ 345",
+    "code": "KY"
+  },
+  {
+    "name": "Central African Republic",
+    "dial_code": "+236",
+    "code": "CF"
+  },
+  {
+    "name": "Chad",
+    "dial_code": "+235",
+    "code": "TD"
+  },
+  {
+    "name": "Chile",
+    "dial_code": "+56",
+    "code": "CL"
+  },
+  {
+    "name": "China",
+    "dial_code": "+86",
+    "code": "CN"
+  },
+  {
+    "name": "Christmas Island",
+    "dial_code": "+61",
+    "code": "CX"
+  },
+  {
+    "name": "Colombia",
+    "dial_code": "+57",
+    "code": "CO"
+  },
+  {
+    "name": "Comoros",
+    "dial_code": "+269",
+    "code": "KM"
+  },
+  {
+    "name": "Congo",
+    "dial_code": "+242",
+    "code": "CG"
+  },
+  {
+    "name": "Cook Islands",
+    "dial_code": "+682",
+    "code": "CK"
+  },
+  {
+    "name": "Costa Rica",
+    "dial_code": "+506",
+    "code": "CR"
+  },
+  {
+    "name": "Croatia",
+    "dial_code": "+385",
+    "code": "HR"
+  },
+  {
+    "name": "Cuba",
+    "dial_code": "+53",
+    "code": "CU"
+  },
+  {
+    "name": "Cyprus",
+    "dial_code": "+537",
+    "code": "CY"
+  },
+  {
+    "name": "Czech Republic",
+    "dial_code": "+420",
+    "code": "CZ"
+  },
+  {
+    "name": "Denmark",
+    "dial_code": "+45",
+    "code": "DK"
+  },
+  {
+    "name": "Djibouti",
+    "dial_code": "+253",
+    "code": "DJ"
+  },
+  {
+    "name": "Dominica",
+    "dial_code": "+1 767",
+    "code": "DM"
+  },
+  {
+    "name": "Dominican Republic",
+    "dial_code": "+1 849",
+    "code": "DO"
+  },
+  {
+    "name": "Ecuador",
+    "dial_code": "+593",
+    "code": "EC"
+  },
+  {
+    "name": "Egypt",
+    "dial_code": "+20",
+    "code": "EG"
+  },
+  {
+    "name": "El Salvador",
+    "dial_code": "+503",
+    "code": "SV"
+  },
+  {
+    "name": "Equatorial Guinea",
+    "dial_code": "+240",
+    "code": "GQ"
+  },
+  {
+    "name": "Eritrea",
+    "dial_code": "+291",
+    "code": "ER"
+  },
+  {
+    "name": "Estonia",
+    "dial_code": "+372",
+    "code": "EE"
+  },
+  {
+    "name": "Ethiopia",
+    "dial_code": "+251",
+    "code": "ET"
+  },
+  {
+    "name": "Faroe Islands",
+    "dial_code": "+298",
+    "code": "FO"
+  },
+  {
+    "name": "Fiji",
+    "dial_code": "+679",
+    "code": "FJ"
+  },
+  {
+    "name": "Finland",
+    "dial_code": "+358",
+    "code": "FI"
+  },
+  {
+    "name": "France",
+    "dial_code": "+33",
+    "code": "FR"
+  },
+  {
+    "name": "French Guiana",
+    "dial_code": "+594",
+    "code": "GF"
+  },
+  {
+    "name": "French Polynesia",
+    "dial_code": "+689",
+    "code": "PF"
+  },
+  {
+    "name": "Gabon",
+    "dial_code": "+241",
+    "code": "GA"
+  },
+  {
+    "name": "Gambia",
+    "dial_code": "+220",
+    "code": "GM"
+  },
+  {
+    "name": "Georgia",
+    "dial_code": "+995",
+    "code": "GE"
+  },
+  {
+    "name": "Germany",
+    "dial_code": "+49",
+    "code": "DE"
+  },
+  {
+    "name": "Ghana",
+    "dial_code": "+233",
+    "code": "GH"
+  },
+  {
+    "name": "Gibraltar",
+    "dial_code": "+350",
+    "code": "GI"
+  },
+  {
+    "name": "Greece",
+    "dial_code": "+30",
+    "code": "GR"
+  },
+  {
+    "name": "Greenland",
+    "dial_code": "+299",
+    "code": "GL"
+  },
+  {
+    "name": "Grenada",
+    "dial_code": "+1 473",
+    "code": "GD"
+  },
+  {
+    "name": "Guadeloupe",
+    "dial_code": "+590",
+    "code": "GP"
+  },
+  {
+    "name": "Guam",
+    "dial_code": "+1 671",
+    "code": "GU"
+  },
+  {
+    "name": "Guatemala",
+    "dial_code": "+502",
+    "code": "GT"
+  },
+  {
+    "name": "Guinea",
+    "dial_code": "+224",
+    "code": "GN"
+  },
+  {
+    "name": "Guinea-Bissau",
+    "dial_code": "+245",
+    "code": "GW"
+  },
+  {
+    "name": "Guyana",
+    "dial_code": "+595",
+    "code": "GY"
+  },
+  {
+    "name": "Haiti",
+    "dial_code": "+509",
+    "code": "HT"
+  },
+  {
+    "name": "Honduras",
+    "dial_code": "+504",
+    "code": "HN"
+  },
+  {
+    "name": "Hungary",
+    "dial_code": "+36",
+    "code": "HU"
+  },
+  {
+    "name": "Iceland",
+    "dial_code": "+354",
+    "code": "IS"
+  },
+  {
+    "name": "India",
+    "dial_code": "+91",
+    "code": "IN"
+  },
+  {
+    "name": "Indonesia",
+    "dial_code": "+62",
+    "code": "ID"
+  },
+  {
+    "name": "Iraq",
+    "dial_code": "+964",
+    "code": "IQ"
+  },
+  {
+    "name": "Ireland",
+    "dial_code": "+353",
+    "code": "IE"
+  },
+  {
+    "name": "Israel",
+    "dial_code": "+972",
+    "code": "IL"
+  },
+  {
+    "name": "Italy",
+    "dial_code": "+39",
+    "code": "IT"
+  },
+  {
+    "name": "Jamaica",
+    "dial_code": "+1 876",
+    "code": "JM"
+  },
+  {
+    "name": "Japan",
+    "dial_code": "+81",
+    "code": "JP"
+  },
+  {
+    "name": "Jordan",
+    "dial_code": "+962",
+    "code": "JO"
+  },
+  {
+    "name": "Kazakhstan",
+    "dial_code": "+7 7",
+    "code": "KZ"
+  },
+  {
+    "name": "Kenya",
+    "dial_code": "+254",
+    "code": "KE"
+  },
+  {
+    "name": "Kiribati",
+    "dial_code": "+686",
+    "code": "KI"
+  },
+  {
+    "name": "Kuwait",
+    "dial_code": "+965",
+    "code": "KW"
+  },
+  {
+    "name": "Kyrgyzstan",
+    "dial_code": "+996",
+    "code": "KG"
+  },
+  {
+    "name": "Latvia",
+    "dial_code": "+371",
+    "code": "LV"
+  },
+  {
+    "name": "Lebanon",
+    "dial_code": "+961",
+    "code": "LB"
+  },
+  {
+    "name": "Lesotho",
+    "dial_code": "+266",
+    "code": "LS"
+  },
+  {
+    "name": "Liberia",
+    "dial_code": "+231",
+    "code": "LR"
+  },
+  {
+    "name": "Liechtenstein",
+    "dial_code": "+423",
+    "code": "LI"
+  },
+  {
+    "name": "Lithuania",
+    "dial_code": "+370",
+    "code": "LT"
+  },
+  {
+    "name": "Luxembourg",
+    "dial_code": "+352",
+    "code": "LU"
+  },
+  {
+    "name": "Madagascar",
+    "dial_code": "+261",
+    "code": "MG"
+  },
+  {
+    "name": "Malawi",
+    "dial_code": "+265",
+    "code": "MW"
+  },
+  {
+    "name": "Malaysia",
+    "dial_code": "+60",
+    "code": "MY"
+  },
+  {
+    "name": "Maldives",
+    "dial_code": "+960",
+    "code": "MV"
+  },
+  {
+    "name": "Mali",
+    "dial_code": "+223",
+    "code": "ML"
+  },
+  {
+    "name": "Malta",
+    "dial_code": "+356",
+    "code": "MT"
+  },
+  {
+    "name": "Marshall Islands",
+    "dial_code": "+692",
+    "code": "MH"
+  },
+  {
+    "name": "Martinique",
+    "dial_code": "+596",
+    "code": "MQ"
+  },
+  {
+    "name": "Mauritania",
+    "dial_code": "+222",
+    "code": "MR"
+  },
+  {
+    "name": "Mauritius",
+    "dial_code": "+230",
+    "code": "MU"
+  },
+  {
+    "name": "Mayotte",
+    "dial_code": "+262",
+    "code": "YT"
+  },
+  {
+    "name": "Mexico",
+    "dial_code": "+52",
+    "code": "MX"
+  },
+  {
+    "name": "Monaco",
+    "dial_code": "+377",
+    "code": "MC"
+  },
+  {
+    "name": "Mongolia",
+    "dial_code": "+976",
+    "code": "MN"
+  },
+  {
+    "name": "Montenegro",
+    "dial_code": "+382",
+    "code": "ME"
+  },
+  {
+    "name": "Montserrat",
+    "dial_code": "+1664",
+    "code": "MS"
+  },
+  {
+    "name": "Morocco",
+    "dial_code": "+212",
+    "code": "MA"
+  },
+  {
+    "name": "Myanmar",
+    "dial_code": "+95",
+    "code": "MM"
+  },
+  {
+    "name": "Namibia",
+    "dial_code": "+264",
+    "code": "NA"
+  },
+  {
+    "name": "Nauru",
+    "dial_code": "+674",
+    "code": "NR"
+  },
+  {
+    "name": "Nepal",
+    "dial_code": "+977",
+    "code": "NP"
+  },
+  {
+    "name": "Netherlands",
+    "dial_code": "+31",
+    "code": "NL"
+  },
+  {
+    "name": "Netherlands Antilles",
+    "dial_code": "+599",
+    "code": "AN"
+  },
+  {
+    "name": "New Caledonia",
+    "dial_code": "+687",
+    "code": "NC"
+  },
+  {
+    "name": "New Zealand",
+    "dial_code": "+64",
+    "code": "NZ"
+  },
+  {
+    "name": "Nicaragua",
+    "dial_code": "+505",
+    "code": "NI"
+  },
+  {
+    "name": "Niger",
+    "dial_code": "+227",
+    "code": "NE"
+  },
+  {
+    "name": "Nigeria",
+    "dial_code": "+234",
+    "code": "NG"
+  },
+  {
+    "name": "Niue",
+    "dial_code": "+683",
+    "code": "NU"
+  },
+  {
+    "name": "Norfolk Island",
+    "dial_code": "+672",
+    "code": "NF"
+  },
+  {
+    "name": "Northern Mariana Islands",
+    "dial_code": "+1 670",
+    "code": "MP"
+  },
+  {
+    "name": "Norway",
+    "dial_code": "+47",
+    "code": "NO"
+  },
+  {
+    "name": "Oman",
+    "dial_code": "+968",
+    "code": "OM"
+  },
+  {
+    "name": "Pakistan",
+    "dial_code": "+92",
+    "code": "PK"
+  },
+  {
+    "name": "Palau",
+    "dial_code": "+680",
+    "code": "PW"
+  },
+  {
+    "name": "Panama",
+    "dial_code": "+507",
+    "code": "PA"
+  },
+  {
+    "name": "Papua New Guinea",
+    "dial_code": "+675",
+    "code": "PG"
+  },
+  {
+    "name": "Paraguay",
+    "dial_code": "+595",
+    "code": "PY"
+  },
+  {
+    "name": "Peru",
+    "dial_code": "+51",
+    "code": "PE"
+  },
+  {
+    "name": "Philippines",
+    "dial_code": "+63",
+    "code": "PH"
+  },
+  {
+    "name": "Poland",
+    "dial_code": "+48",
+    "code": "PL"
+  },
+  {
+    "name": "Portugal",
+    "dial_code": "+351",
+    "code": "PT"
+  },
+  {
+    "name": "Puerto Rico",
+    "dial_code": "+1 939",
+    "code": "PR"
+  },
+  {
+    "name": "Qatar",
+    "dial_code": "+974",
+    "code": "QA"
+  },
+  {
+    "name": "Romania",
+    "dial_code": "+40",
+    "code": "RO"
+  },
+  {
+    "name": "Rwanda",
+    "dial_code": "+250",
+    "code": "RW"
+  },
+  {
+    "name": "Samoa",
+    "dial_code": "+685",
+    "code": "WS"
+  },
+  {
+    "name": "San Marino",
+    "dial_code": "+378",
+    "code": "SM"
+  },
+  {
+    "name": "Saudi Arabia",
+    "dial_code": "+966",
+    "code": "SA"
+  },
+  {
+    "name": "Senegal",
+    "dial_code": "+221",
+    "code": "SN"
+  },
+  {
+    "name": "Serbia",
+    "dial_code": "+381",
+    "code": "RS"
+  },
+  {
+    "name": "Seychelles",
+    "dial_code": "+248",
+    "code": "SC"
+  },
+  {
+    "name": "Sierra Leone",
+    "dial_code": "+232",
+    "code": "SL"
+  },
+  {
+    "name": "Singapore",
+    "dial_code": "+65",
+    "code": "SG"
+  },
+  {
+    "name": "Slovakia",
+    "dial_code": "+421",
+    "code": "SK"
+  },
+  {
+    "name": "Slovenia",
+    "dial_code": "+386",
+    "code": "SI"
+  },
+  {
+    "name": "Solomon Islands",
+    "dial_code": "+677",
+    "code": "SB"
+  },
+  {
+    "name": "South Africa",
+    "dial_code": "+27",
+    "code": "ZA"
+  },
+  {
+    "name": "South Georgia and the South Sandwich Islands",
+    "dial_code": "+500",
+    "code": "GS"
+  },
+  {
+    "name": "Spain",
+    "dial_code": "+34",
+    "code": "ES"
+  },
+  {
+    "name": "Sri Lanka",
+    "dial_code": "+94",
+    "code": "LK"
+  },
+  {
+    "name": "Sudan",
+    "dial_code": "+249",
+    "code": "SD"
+  },
+  {
+    "name": "Suriname",
+    "dial_code": "+597",
+    "code": "SR"
+  },
+  {
+    "name": "Swaziland",
+    "dial_code": "+268",
+    "code": "SZ"
+  },
+  {
+    "name": "Sweden",
+    "dial_code": "+46",
+    "code": "SE"
+  },
+  {
+    "name": "Switzerland",
+    "dial_code": "+41",
+    "code": "CH"
+  },
+  {
+    "name": "Tajikistan",
+    "dial_code": "+992",
+    "code": "TJ"
+  },
+  {
+    "name": "Thailand",
+    "dial_code": "+66",
+    "code": "TH"
+  },
+  {
+    "name": "Togo",
+    "dial_code": "+228",
+    "code": "TG"
+  },
+  {
+    "name": "Tokelau",
+    "dial_code": "+690",
+    "code": "TK"
+  },
+  {
+    "name": "Tonga",
+    "dial_code": "+676",
+    "code": "TO"
+  },
+  {
+    "name": "Trinidad and Tobago",
+    "dial_code": "+1 868",
+    "code": "TT"
+  },
+  {
+    "name": "Tunisia",
+    "dial_code": "+216",
+    "code": "TN"
+  },
+  {
+    "name": "Turkey",
+    "dial_code": "+90",
+    "code": "TR"
+  },
+  {
+    "name": "Turkmenistan",
+    "dial_code": "+993",
+    "code": "TM"
+  },
+  {
+    "name": "Turks and Caicos Islands",
+    "dial_code": "+1 649",
+    "code": "TC"
+  },
+  {
+    "name": "Tuvalu",
+    "dial_code": "+688",
+    "code": "TV"
+  },
+  {
+    "name": "Uganda",
+    "dial_code": "+256",
+    "code": "UG"
+  },
+  {
+    "name": "Ukraine",
+    "dial_code": "+380",
+    "code": "UA"
+  },
+  {
+    "name": "United Arab Emirates",
+    "dial_code": "+971",
+    "code": "AE"
+  },
+  {
+    "name": "United Kingdom",
+    "dial_code": "+44",
+    "code": "GB"
+  },
+  {
+    "name": "United States",
+    "dial_code": "+1",
+    "code": "US"
+  },
+  {
+    "name": "Uruguay",
+    "dial_code": "+598",
+    "code": "UY"
+  },
+  {
+    "name": "Uzbekistan",
+    "dial_code": "+998",
+    "code": "UZ"
+  },
+  {
+    "name": "Vanuatu",
+    "dial_code": "+678",
+    "code": "VU"
+  },
+  {
+    "name": "Wallis and Futuna",
+    "dial_code": "+681",
+    "code": "WF"
+  },
+  {
+    "name": "Yemen",
+    "dial_code": "+967",
+    "code": "YE"
+  },
+  {
+    "name": "Zambia",
+    "dial_code": "+260",
+    "code": "ZM"
+  },
+  {
+    "name": "Zimbabwe",
+    "dial_code": "+263",
+    "code": "ZW"
+  },
+  {
+    "name": "land Islands",
+    "dial_code": "",
+    "code": "AX"
+  },
+  {
+    "name": "Bolivia, Plurinational State of",
+    "dial_code": "+591",
+    "code": "BO"
+  },
+  {
+    "name": "Brunei Darussalam",
+    "dial_code": "+673",
+    "code": "BN"
+  },
+  {
+    "name": "Cocos (Keeling) Islands",
+    "dial_code": "+61",
+    "code": "CC"
+  },
+  {
+    "name": "Congo, The Democratic Republic of the",
+    "dial_code": "+243",
+    "code": "CD"
+  },
+  {
+    "name": "Cote d'Ivoire",
+    "dial_code": "+225",
+    "code": "CI"
+  },
+  {
+    "name": "Falkland Islands (Malvinas)",
+    "dial_code": "+500",
+    "code": "FK"
+  },
+  {
+    "name": "Guernsey",
+    "dial_code": "+44",
+    "code": "GG"
+  },
+  {
+    "name": "Holy See (Vatican City State)",
+    "dial_code": "+379",
+    "code": "VA"
+  },
+  {
+    "name": "Hong Kong",
+    "dial_code": "+852",
+    "code": "HK"
+  },
+  {
+    "name": "Iran, Islamic Republic of",
+    "dial_code": "+98",
+    "code": "IR"
+  },
+  {
+    "name": "Isle of Man",
+    "dial_code": "+44",
+    "code": "IM"
+  },
+  {
+    "name": "Jersey",
+    "dial_code": "+44",
+    "code": "JE"
+  },
+  {
+    "name": "Korea, Democratic People's Republic of",
+    "dial_code": "+850",
+    "code": "KP"
+  },
+  {
+    "name": "Korea, Republic of",
+    "dial_code": "+82",
+    "code": "KR"
+  },
+  {
+    "name": "Lao People's Democratic Republic",
+    "dial_code": "+856",
+    "code": "LA"
+  },
+  {
+    "name": "Libyan Arab Jamahiriya",
+    "dial_code": "+218",
+    "code": "LY"
+  },
+  {
+    "name": "Macao",
+    "dial_code": "+853",
+    "code": "MO"
+  },
+  {
+    "name": "Macedonia, The Former Yugoslav Republic of",
+    "dial_code": "+389",
+    "code": "MK"
+  },
+  {
+    "name": "Micronesia, Federated States of",
+    "dial_code": "+691",
+    "code": "FM"
+  },
+  {
+    "name": "Moldova, Republic of",
+    "dial_code": "+373",
+    "code": "MD"
+  },
+  {
+    "name": "Mozambique",
+    "dial_code": "+258",
+    "code": "MZ"
+  },
+  {
+    "name": "Palestinian Territory, Occupied",
+    "dial_code": "+970",
+    "code": "PS"
+  },
+  {
+    "name": "Pitcairn",
+    "dial_code": "+872",
+    "code": "PN"
+  },
+  {
+    "name": "Réunion",
+    "dial_code": "+262",
+    "code": "RE"
+  },
+  {
+    "name": "Russia",
+    "dial_code": "+7",
+    "code": "RU"
+  },
+  {
+    "name": "Saint Barthélemy",
+    "dial_code": "+590",
+    "code": "BL"
+  },
+  {
+    "name": "Saint Helena, Ascension and Tristan Da Cunha",
+    "dial_code": "+290",
+    "code": "SH"
+  },
+  {
+    "name": "Saint Kitts and Nevis",
+    "dial_code": "+1 869",
+    "code": "KN"
+  },
+  {
+    "name": "Saint Lucia",
+    "dial_code": "+1 758",
+    "code": "LC"
+  },
+  {
+    "name": "Saint Martin",
+    "dial_code": "+590",
+    "code": "MF"
+  },
+  {
+    "name": "Saint Pierre and Miquelon",
+    "dial_code": "+508",
+    "code": "PM"
+  },
+  {
+    "name": "Saint Vincent and the Grenadines",
+    "dial_code": "+1 784",
+    "code": "VC"
+  },
+  {
+    "name": "Sao Tome and Principe",
+    "dial_code": "+239",
+    "code": "ST"
+  },
+  {
+    "name": "Somalia",
+    "dial_code": "+252",
+    "code": "SO"
+  },
+  {
+    "name": "Svalbard and Jan Mayen",
+    "dial_code": "+47",
+    "code": "SJ"
+  },
+  {
+    "name": "Syrian Arab Republic",
+    "dial_code": "+963",
+    "code": "SY"
+  },
+  {
+    "name": "Taiwan, Province of China",
+    "dial_code": "+886",
+    "code": "TW"
+  },
+  {
+    "name": "Tanzania, United Republic of",
+    "dial_code": "+255",
+    "code": "TZ"
+  },
+  {
+    "name": "Timor-Leste",
+    "dial_code": "+670",
+    "code": "TL"
+  },
+  {
+    "name": "Venezuela, Bolivarian Republic of",
+    "dial_code": "+58",
+    "code": "VE"
+  },
+  {
+    "name": "Viet Nam",
+    "dial_code": "+84",
+    "code": "VN"
+  },
+  {
+    "name": "Virgin Islands, British",
+    "dial_code": "+1 284",
+    "code": "VG"
+  },
+  {
+    "name": "Virgin Islands, U.S.",
+    "dial_code": "+1 340",
+    "code": "VI"
+  }
+]
\ No newline at end of file
diff --git a/TwoFactorAuth/Test/Integration/Block/ChangeProviderTest.php b/TwoFactorAuth/Test/Integration/Block/ChangeProviderTest.php
new file mode 100644
index 00000000..eb24c216
--- /dev/null
+++ b/TwoFactorAuth/Test/Integration/Block/ChangeProviderTest.php
@@ -0,0 +1,127 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Test\Integration\Block;
+
+use Magento\Authorization\Model\CompositeUserContext;
+use Magento\Backend\Model\Auth;
+use Magento\Backend\Model\Auth\Session;
+use Magento\Framework\View\LayoutInterface;
+use Magento\Security\Model\Plugin\Auth as AuthPlugin;
+use Magento\TestFramework\Bootstrap as TestFrameworkBootstrap;
+use Magento\TestFramework\Helper\Bootstrap;
+use Magento\TwoFactorAuth\Api\TfaInterface;
+use Magento\TwoFactorAuth\Block\ChangeProvider;
+use Magento\TwoFactorAuth\Model\Provider\Engine\Authy;
+use Magento\TwoFactorAuth\Model\Provider\Engine\Google;
+use Magento\User\Model\Authorization\AdminSessionUserContext;
+use PHPUnit\Framework\TestCase;
+
+/**
+ * @magentoDbIsolation enabled
+ */
+class ChangeProviderTest extends TestCase
+{
+    /**
+     * @var ChangeProvider
+     */
+    private $block;
+
+    /**
+     * @var Session
+     */
+    private $session;
+
+    /**
+     * @var TfaInterface
+     */
+    private $tfa;
+
+    protected function setUp()
+    {
+        $objectManager = Bootstrap::getObjectManager();
+        $objectManager->configure([
+            CompositeUserContext::class => [
+                'arguments' => [
+                    'userContexts' => [
+                        'adminSessionUserContext' => [
+                            'type' => ['instance' => AdminSessionUserContext::class],
+                            'sortOrder' => 10
+                        ]
+                    ]
+                ]
+            ]
+        ]);
+        $auth = $objectManager->get(Auth::class);
+        $auth->login(TestFrameworkBootstrap::ADMIN_NAME, TestFrameworkBootstrap::ADMIN_PASSWORD);
+        $objectManager->get(AuthPlugin::class)
+            ->afterLogin($auth);
+        $this->session = $auth->getAuthStorage();
+        $this->tfa = Bootstrap::getObjectManager()->get(TfaInterface::class);
+        $this->block = $objectManager->get(LayoutInterface::class)
+            ->createBlock(ChangeProvider::class);
+        $this->block->setData('area', 'adminhtml');
+        $this->block->setTemplate('Magento_TwoFactorAuth::tfa/change_provider.phtml');
+    }
+
+    /**
+     * @magentoConfigFixture default/twofactorauth/general/force_providers authy,duo_security
+     * @magentoConfigFixture default/twofactorauth/authy/api_key abc123
+     * @magentoConfigFixture default/twofactorauth/duo/integration_key abc123
+     * @magentoConfigFixture default/twofactorauth/duo/api_hostname abc123
+     * @magentoConfigFixture default/twofactorauth/duo/secret_key abc123
+     */
+    public function testBlockRendersWithActiveProviders(): void
+    {
+        $userId = (int)$this->session->getUser()->getId();
+        $this->tfa->getProvider(Authy::CODE)->activate($userId);
+        $jsLayout = json_decode($this->block->getJsLayout(), true);
+        $actualProviders = array_map(
+            function ($item) {
+                return $item['code'];
+            },
+            $jsLayout['components']['tfa-change-provider']['providers']
+        );
+
+        self::assertSame(['authy'], $actualProviders);
+    }
+
+    /**
+     * @magentoConfigFixture default/twofactorauth/general/force_providers authy,duo_security
+     * @magentoConfigFixture default/twofactorauth/authy/api_key abc123
+     * @magentoConfigFixture default/twofactorauth/duo/integration_key abc123
+     * @magentoConfigFixture default/twofactorauth/duo/api_hostname abc123
+     * @magentoConfigFixture default/twofactorauth/duo/secret_key abc123
+     */
+    public function testBlockRendersWhenCurrentProviderIsActivated(): void
+    {
+        $userId = (int)$this->session->getUser()->getId();
+        $this->tfa->getProvider(Authy::CODE)->activate($userId);
+        $this->block->setData('provider', 'authy');
+        $html = $this->block->toHtml();
+
+        self::assertContains('id="tfa', $html);
+    }
+
+    /**
+     * @magentoConfigFixture default/twofactorauth/general/force_providers authy,duo_security
+     * @magentoConfigFixture default/twofactorauth/authy/api_key abc123
+     * @magentoConfigFixture default/twofactorauth/duo/integration_key abc123
+     * @magentoConfigFixture default/twofactorauth/duo/api_hostname abc123
+     * @magentoConfigFixture default/twofactorauth/duo/secret_key abc123
+     */
+    public function testBlockRendersWhenCurrentProviderIsNotActivated(): void
+    {
+        $userId = (int)$this->session->getUser()->getId();
+        $this->tfa->getProvider(Authy::CODE)->activate($userId);
+        $this->block->setData('provider', 'duo_security');
+        $html = $this->block->toHtml();
+
+        self::assertSame('', $html);
+    }
+}
diff --git a/TwoFactorAuth/Test/Integration/Block/ConfigureLaterTest.php b/TwoFactorAuth/Test/Integration/Block/ConfigureLaterTest.php
new file mode 100644
index 00000000..f76b25a7
--- /dev/null
+++ b/TwoFactorAuth/Test/Integration/Block/ConfigureLaterTest.php
@@ -0,0 +1,113 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Test\Integration\Block;
+
+use Magento\Authorization\Model\CompositeUserContext;
+use Magento\Backend\Model\Auth;
+use Magento\Backend\Model\Auth\Session;
+use Magento\Framework\View\LayoutInterface;
+use Magento\Security\Model\Plugin\Auth as AuthPlugin;
+use Magento\TestFramework\Bootstrap as TestFrameworkBootstrap;
+use Magento\TestFramework\Helper\Bootstrap;
+use Magento\TwoFactorAuth\Api\TfaInterface;
+use Magento\TwoFactorAuth\Block\ConfigureLater;
+use Magento\TwoFactorAuth\Model\Provider\Engine\Authy;
+use Magento\User\Model\Authorization\AdminSessionUserContext;
+use PHPUnit\Framework\TestCase;
+
+/**
+ * @magentoDbIsolation enabled
+ */
+class ConfigureLaterTest extends TestCase
+{
+    /**
+     * @var ConfigureLater
+     */
+    private $block;
+
+    /**
+     * @var Session
+     */
+    private $session;
+
+    /**
+     * @var TfaInterface
+     */
+    private $tfa;
+
+    protected function setUp()
+    {
+        $objectManager = Bootstrap::getObjectManager();
+        $objectManager->configure([
+            CompositeUserContext::class => [
+                'arguments' => [
+                    'userContexts' => [
+                        'adminSessionUserContext' => [
+                            'type' => ['instance' => AdminSessionUserContext::class],
+                            'sortOrder' => 10
+                        ]
+                    ]
+                ]
+            ]
+        ]);
+        $auth = $objectManager->get(Auth::class);
+        $auth->login(TestFrameworkBootstrap::ADMIN_NAME, TestFrameworkBootstrap::ADMIN_PASSWORD);
+        $objectManager->get(AuthPlugin::class)
+            ->afterLogin($auth);
+        $this->session = $auth->getAuthStorage();
+        $this->tfa = Bootstrap::getObjectManager()->get(TfaInterface::class);
+        $this->block = $objectManager->get(LayoutInterface::class)
+            ->createBlock(ConfigureLater::class);
+        $this->block->setData('area', 'adminhtml');
+        $this->block->setTemplate('Magento_TwoFactorAuth::tfa/configure_later.phtml');
+    }
+
+    public function testGetPostData(): void
+    {
+        $this->block->setData('provider', 'provider1');
+
+        $data = json_decode($this->block->getPostData(), true);
+
+        self::assertNotEmpty($data['action']);
+        self::assertNotEmpty($data['data']);
+        self::assertNotEmpty($data['data']['form_key']);
+        self::assertSame('provider1', $data['data']['provider']);
+    }
+
+    /**
+     * @magentoConfigFixture default/twofactorauth/general/force_providers authy,duo_security
+     * @magentoConfigFixture default/twofactorauth/authy/api_key abc123
+     * @magentoConfigFixture default/twofactorauth/duo/integration_key abc123
+     * @magentoConfigFixture default/twofactorauth/duo/api_hostname abc123
+     * @magentoConfigFixture default/twofactorauth/duo/secret_key abc123
+     */
+    public function testBlockRendersWithCurrentInactiveAndOneOtherActive(): void
+    {
+        $userId = (int)$this->session->getUser()->getId();
+        $this->tfa->getProvider(Authy::CODE)->activate($userId);
+        $this->block->setData('provider', 'duo_security');
+        $html = $this->block->toHtml();
+
+        self::assertContains('id="tfa', $html);
+    }
+
+    /**
+     * @magentoConfigFixture default/twofactorauth/general/force_providers duo_security
+     * @magentoConfigFixture default/twofactorauth/duo/integration_key abc123
+     * @magentoConfigFixture default/twofactorauth/duo/api_hostname abc123
+     * @magentoConfigFixture default/twofactorauth/duo/secret_key abc123
+     */
+    public function testBlockDoesntRenderWithCurrentInactiveAndNoOtherActive(): void
+    {
+        $this->block->setData('provider', 'duo_security');
+        $html = $this->block->toHtml();
+
+        self::assertSame('', $html);
+    }
+}
diff --git a/TwoFactorAuth/Test/Integration/Controller/Adminhtml/Authy/ConfigureTest.php b/TwoFactorAuth/Test/Integration/Controller/Adminhtml/Authy/ConfigureTest.php
new file mode 100644
index 00000000..7bd4bd0f
--- /dev/null
+++ b/TwoFactorAuth/Test/Integration/Controller/Adminhtml/Authy/ConfigureTest.php
@@ -0,0 +1,56 @@
+<?php
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Test\Integration\Controller\Adminhtml\Authy;
+
+use Magento\Framework\HTTP\PhpEnvironment\Request;
+use Magento\TwoFactorAuth\TestFramework\TestCase\AbstractConfigureBackendController;
+
+/**
+ * Test for the configure authy 2FA form page.
+ *
+ * @magentoAppArea adminhtml
+ * @magentoDbIsolation enabled
+ */
+class ConfigureTest extends AbstractConfigureBackendController
+{
+    /**
+     * @inheritDoc
+     */
+    protected $uri = 'backend/tfa/authy/configure';
+
+    /**
+     * @inheritDoc
+     */
+    protected $httpMethod = Request::METHOD_GET;
+
+    /**
+     * @inheritDoc
+     * @magentoConfigFixture default/twofactorauth/general/force_providers authy
+     * @magentoConfigFixture default/twofactorauth/authy/api_key some-key
+     */
+    public function testTokenAccess(): void
+    {
+        parent::testTokenAccess();
+    }
+
+    /**
+     * @inheritDoc
+     * @magentoConfigFixture default/twofactorauth/general/force_providers authy
+     * @magentoConfigFixture default/twofactorauth/authy/api_key some-key
+     */
+    public function testAclHasAccess()
+    {
+        parent::testAclHasAccess();
+    }
+
+    /**
+     * @inheritDoc
+     * @magentoConfigFixture default/twofactorauth/general/force_providers authy
+     * @magentoConfigFixture default/twofactorauth/authy/api_key some-key
+     */
+    public function testAclNoAccess()
+    {
+        parent::testAclNoAccess();
+    }
+}
diff --git a/TwoFactorAuth/Test/Integration/Controller/Adminhtml/Authy/ConfigurepostTest.php b/TwoFactorAuth/Test/Integration/Controller/Adminhtml/Authy/ConfigurepostTest.php
new file mode 100644
index 00000000..69fadc9c
--- /dev/null
+++ b/TwoFactorAuth/Test/Integration/Controller/Adminhtml/Authy/ConfigurepostTest.php
@@ -0,0 +1,56 @@
+<?php
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Test\Integration\Controller\Adminhtml\Authy;
+
+use Magento\Framework\HTTP\PhpEnvironment\Request;
+use Magento\TwoFactorAuth\TestFramework\TestCase\AbstractConfigureBackendController;
+
+/**
+ * Test for the configure authy 2FA form processor.
+ *
+ * @magentoAppArea adminhtml
+ * @magentoDbIsolation enabled
+ */
+class ConfigurepostTest extends AbstractConfigureBackendController
+{
+    /**
+     * @inheritDoc
+     */
+    protected $uri = 'backend/tfa/authy/configurepost';
+
+    /**
+     * @inheritDoc
+     */
+    protected $httpMethod = Request::METHOD_POST;
+
+    /**
+     * @inheritDoc
+     * @magentoConfigFixture default/twofactorauth/general/force_providers authy
+     * @magentoConfigFixture default/twofactorauth/authy/api_key some-key
+     */
+    public function testTokenAccess(): void
+    {
+        parent::testTokenAccess();
+    }
+
+    /**
+     * @inheritDoc
+     * @magentoConfigFixture default/twofactorauth/general/force_providers authy
+     * @magentoConfigFixture default/twofactorauth/authy/api_key some-key
+     */
+    public function testAclHasAccess()
+    {
+        parent::testAclHasAccess();
+    }
+
+    /**
+     * @inheritDoc
+     * @magentoConfigFixture default/twofactorauth/general/force_providers authy
+     * @magentoConfigFixture default/twofactorauth/authy/api_key some-key
+     */
+    public function testAclNoAccess()
+    {
+        parent::testAclNoAccess();
+    }
+}
diff --git a/TwoFactorAuth/Test/Integration/Controller/Adminhtml/Authy/ConfigureverifypostTest.php b/TwoFactorAuth/Test/Integration/Controller/Adminhtml/Authy/ConfigureverifypostTest.php
new file mode 100644
index 00000000..6c4865a9
--- /dev/null
+++ b/TwoFactorAuth/Test/Integration/Controller/Adminhtml/Authy/ConfigureverifypostTest.php
@@ -0,0 +1,56 @@
+<?php
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Test\Integration\Controller\Adminhtml\Authy;
+
+use Magento\Framework\HTTP\PhpEnvironment\Request;
+use Magento\TwoFactorAuth\TestFramework\TestCase\AbstractConfigureBackendController;
+
+/**
+ * Test for the configure authy 2FA form processor.
+ *
+ * @magentoAppArea adminhtml
+ * @magentoDbIsolation enabled
+ */
+class ConfigureverifypostTest extends AbstractConfigureBackendController
+{
+    /**
+     * @inheritDoc
+     */
+    protected $uri = 'backend/tfa/authy/configurepost';
+
+    /**
+     * @inheritDoc
+     */
+    protected $httpMethod = Request::METHOD_POST;
+
+    /**
+     * @inheritDoc
+     * @magentoConfigFixture default/twofactorauth/general/force_providers authy
+     * @magentoConfigFixture default/twofactorauth/authy/api_key some-key
+     */
+    public function testTokenAccess(): void
+    {
+        parent::testTokenAccess();
+    }
+
+    /**
+     * @inheritDoc
+     * @magentoConfigFixture default/twofactorauth/general/force_providers authy
+     * @magentoConfigFixture default/twofactorauth/authy/api_key some-key
+     */
+    public function testAclHasAccess()
+    {
+        parent::testAclHasAccess();
+    }
+
+    /**
+     * @inheritDoc
+     * @magentoConfigFixture default/twofactorauth/general/force_providers authy
+     * @magentoConfigFixture default/twofactorauth/authy/api_key some-key
+     */
+    public function testAclNoAccess()
+    {
+        parent::testAclNoAccess();
+    }
+}
diff --git a/TwoFactorAuth/Test/Integration/Controller/Adminhtml/Duo/AuthTest.php b/TwoFactorAuth/Test/Integration/Controller/Adminhtml/Duo/AuthTest.php
new file mode 100644
index 00000000..348ac94a
--- /dev/null
+++ b/TwoFactorAuth/Test/Integration/Controller/Adminhtml/Duo/AuthTest.php
@@ -0,0 +1,65 @@
+<?php
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Test\Integration\Controller\Adminhtml\Duo;
+
+use Magento\Framework\HTTP\PhpEnvironment\Request;
+use Magento\TwoFactorAuth\TestFramework\TestCase\AbstractConfigureBackendController;
+
+/**
+ * Test for the DuoSecurity form.
+ *
+ * @magentoAppArea adminhtml
+ * @magentoDbIsolation enabled
+ */
+class AuthTest extends AbstractConfigureBackendController
+{
+    /**
+     * @inheritDoc
+     */
+    protected $uri = 'backend/tfa/duo/auth';
+
+    /**
+     * @inheritDoc
+     */
+    protected $httpMethod = Request::METHOD_GET;
+
+    /**
+     * @inheritDoc
+     * @magentoConfigFixture default/twofactorauth/general/force_providers duo_security
+     * @magentoConfigFixture default/twofactorauth/duo/integration_key duo_security
+     * @magentoConfigFixture default/twofactorauth/duo/secret_key duo_security
+     * @magentoConfigFixture default/twofactorauth/duo/api_hostname duo_security
+     * @magentoConfigFixture default/twofactorauth/duo/application_key duo_security
+     */
+    public function testTokenAccess(): void
+    {
+        parent::testTokenAccess();
+    }
+
+    /**
+     * @inheritDoc
+     * @magentoConfigFixture default/twofactorauth/general/force_providers duo_security
+     * @magentoConfigFixture default/twofactorauth/duo/integration_key duo_security
+     * @magentoConfigFixture default/twofactorauth/duo/secret_key duo_security
+     * @magentoConfigFixture default/twofactorauth/duo/api_hostname duo_security
+     * @magentoConfigFixture default/twofactorauth/duo/application_key duo_security
+     */
+    public function testAclHasAccess()
+    {
+        parent::testAclHasAccess();
+    }
+
+    /**
+     * @inheritDoc
+     * @magentoConfigFixture default/twofactorauth/general/force_providers duo_security
+     * @magentoConfigFixture default/twofactorauth/duo/integration_key duo_security
+     * @magentoConfigFixture default/twofactorauth/duo/secret_key duo_security
+     * @magentoConfigFixture default/twofactorauth/duo/api_hostname duo_security
+     * @magentoConfigFixture default/twofactorauth/duo/application_key duo_security
+     */
+    public function testAclNoAccess()
+    {
+        parent::testAclNoAccess();
+    }
+}
diff --git a/TwoFactorAuth/Test/Integration/Controller/Adminhtml/Duo/AuthpostTest.php b/TwoFactorAuth/Test/Integration/Controller/Adminhtml/Duo/AuthpostTest.php
new file mode 100644
index 00000000..a6bcd0d5
--- /dev/null
+++ b/TwoFactorAuth/Test/Integration/Controller/Adminhtml/Duo/AuthpostTest.php
@@ -0,0 +1,81 @@
+<?php
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Test\Integration\Controller\Adminhtml\Duo;
+
+use Magento\Framework\HTTP\PhpEnvironment\Request;
+use Magento\TwoFactorAuth\TestFramework\TestCase\AbstractConfigureBackendController;
+
+/**
+ * Test for the DuoSecurity form processor.
+ *
+ * @magentoAppArea adminhtml
+ * @magentoDbIsolation enabled
+ */
+class AuthpostTest extends AbstractConfigureBackendController
+{
+    /**
+     * @inheritDoc
+     */
+    protected $uri = 'backend/tfa/duo/authpost';
+
+    /**
+     * @inheritDoc
+     */
+    protected $httpMethod = Request::METHOD_POST;
+
+    /**
+     * @inheritDoc
+     */
+    protected function setUp()
+    {
+        parent::setUp();
+        $this->expectedNoAccessResponseCode = 302;
+    }
+
+    /**
+     * @inheritDoc
+     * @magentoConfigFixture default/twofactorauth/general/force_providers duo_security
+     * @magentoConfigFixture default/twofactorauth/duo/integration_key duo_security
+     * @magentoConfigFixture default/twofactorauth/duo/secret_key duo_security
+     * @magentoConfigFixture default/twofactorauth/duo/api_hostname duo_security
+     * @magentoConfigFixture default/twofactorauth/duo/application_key duo_security
+     */
+    public function testTokenAccess(): void
+    {
+        parent::testTokenAccess();
+        //Redirect when isAllowed returns false
+        $this->assertRedirect($this->stringContains('auth/login'));
+    }
+
+    /**
+     * @inheritDoc
+     * @magentoConfigFixture default/twofactorauth/general/force_providers duo_security
+     * @magentoConfigFixture default/twofactorauth/duo/integration_key duo_security
+     * @magentoConfigFixture default/twofactorauth/duo/secret_key duo_security
+     * @magentoConfigFixture default/twofactorauth/duo/api_hostname duo_security
+     * @magentoConfigFixture default/twofactorauth/duo/application_key duo_security
+     */
+    public function testAclHasAccess()
+    {
+        $this->expectedNoAccessResponseCode = 200;
+        parent::testAclHasAccess();
+        //Redirect that Authpost supplies when signatures is not provided in a request.
+        $this->assertRedirect($this->stringContains('duo/auth'));
+    }
+
+    /**
+     * @inheritDoc
+     * @magentoConfigFixture default/twofactorauth/general/force_providers duo_security
+     * @magentoConfigFixture default/twofactorauth/duo/integration_key duo_security
+     * @magentoConfigFixture default/twofactorauth/duo/secret_key duo_security
+     * @magentoConfigFixture default/twofactorauth/duo/api_hostname duo_security
+     * @magentoConfigFixture default/twofactorauth/duo/application_key duo_security
+     */
+    public function testAclNoAccess()
+    {
+        parent::testAclNoAccess();
+        //Redirect when isAllowed returns false
+        $this->assertRedirect($this->stringContains('auth/login'));
+    }
+}
diff --git a/TwoFactorAuth/Test/Integration/Controller/Adminhtml/Google/ConfigureTest.php b/TwoFactorAuth/Test/Integration/Controller/Adminhtml/Google/ConfigureTest.php
new file mode 100644
index 00000000..17055633
--- /dev/null
+++ b/TwoFactorAuth/Test/Integration/Controller/Adminhtml/Google/ConfigureTest.php
@@ -0,0 +1,53 @@
+<?php
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Test\Integration\Controller\Adminhtml\Google;
+
+use Magento\Framework\HTTP\PhpEnvironment\Request;
+use Magento\TwoFactorAuth\TestFramework\TestCase\AbstractConfigureBackendController;
+
+/**
+ * Test for the configure google 2FA form page.
+ *
+ * @magentoAppArea adminhtml
+ * @magentoDbIsolation enabled
+ */
+class ConfigureTest extends AbstractConfigureBackendController
+{
+    /**
+     * @inheritDoc
+     */
+    protected $uri = 'backend/tfa/google/configure';
+
+    /**
+     * @inheritDoc
+     */
+    protected $httpMethod = Request::METHOD_GET;
+
+    /**
+     * @inheritDoc
+     * @magentoConfigFixture default/twofactorauth/general/force_providers google
+     */
+    public function testTokenAccess(): void
+    {
+        parent::testTokenAccess();
+    }
+
+    /**
+     * @inheritDoc
+     * @magentoConfigFixture default/twofactorauth/general/force_providers google
+     */
+    public function testAclHasAccess()
+    {
+        parent::testAclHasAccess();
+    }
+
+    /**
+     * @inheritDoc
+     * @magentoConfigFixture default/twofactorauth/general/force_providers google
+     */
+    public function testAclNoAccess()
+    {
+        parent::testAclNoAccess();
+    }
+}
diff --git a/TwoFactorAuth/Test/Integration/Controller/Adminhtml/Google/ConfigurepostTest.php b/TwoFactorAuth/Test/Integration/Controller/Adminhtml/Google/ConfigurepostTest.php
new file mode 100644
index 00000000..9c8db08d
--- /dev/null
+++ b/TwoFactorAuth/Test/Integration/Controller/Adminhtml/Google/ConfigurepostTest.php
@@ -0,0 +1,53 @@
+<?php
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Test\Integration\Controller\Adminhtml\Google;
+
+use Magento\Framework\HTTP\PhpEnvironment\Request;
+use Magento\TwoFactorAuth\TestFramework\TestCase\AbstractConfigureBackendController;
+
+/**
+ * Test for the configure google 2FA form page processor.
+ *
+ * @magentoAppArea adminhtml
+ * @magentoDbIsolation enabled
+ */
+class ConfigurepostTest extends AbstractConfigureBackendController
+{
+    /**
+     * @inheritDoc
+     */
+    protected $uri = 'backend/tfa/google/configurepost';
+
+    /**
+     * @inheritDoc
+     */
+    protected $httpMethod = Request::METHOD_POST;
+
+    /**
+     * @inheritDoc
+     * @magentoConfigFixture default/twofactorauth/general/force_providers google
+     */
+    public function testTokenAccess(): void
+    {
+        parent::testTokenAccess();
+    }
+
+    /**
+     * @inheritDoc
+     * @magentoConfigFixture default/twofactorauth/general/force_providers google
+     */
+    public function testAclHasAccess()
+    {
+        parent::testAclHasAccess();
+    }
+
+    /**
+     * @inheritDoc
+     * @magentoConfigFixture default/twofactorauth/general/force_providers google
+     */
+    public function testAclNoAccess()
+    {
+        parent::testAclNoAccess();
+    }
+}
diff --git a/TwoFactorAuth/Test/Integration/Controller/Adminhtml/Tfa/ConfigureLaterTest.php b/TwoFactorAuth/Test/Integration/Controller/Adminhtml/Tfa/ConfigureLaterTest.php
new file mode 100644
index 00000000..220ec109
--- /dev/null
+++ b/TwoFactorAuth/Test/Integration/Controller/Adminhtml/Tfa/ConfigureLaterTest.php
@@ -0,0 +1,153 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Test\Integration\Controller\Adminhtml\Tfa;
+
+use Magento\TwoFactorAuth\Api\TfaInterface;
+use Magento\TwoFactorAuth\Api\TfaSessionInterface;
+use Magento\TwoFactorAuth\Model\Provider\Engine\DuoSecurity;
+use Magento\TwoFactorAuth\TestFramework\TestCase\AbstractBackendController;
+use Magento\TwoFactorAuth\Api\UserConfigTokenManagerInterface;
+
+/**
+ * @magentoAppArea adminhtml
+ * @magentoDbIsolation enabled
+ */
+class ConfigureLaterTest extends AbstractBackendController
+{
+    /**
+     * @inheritDoc
+     */
+    protected $uri = 'backend/tfa/tfa/configurelater';
+
+    /**
+     * @inheritDoc
+     */
+    protected $resource = 'Magento_TwoFactorAuth::tfa';
+
+    /**
+     * @var TfaInterface
+     */
+    private $tfa;
+
+    /**
+     * @var UserConfigTokenManagerInterface
+     */
+    private $tokenManager;
+
+    /**
+     * @var TfaSessionInterface
+     */
+    private $tfaSession;
+
+    protected function setUp()
+    {
+        parent::setUp();
+        $this->tfa = $this->_objectManager->get(TfaInterface::class);
+        $this->tfaSession = $this->_objectManager->get(TfaSessionInterface::class);
+        $this->tokenManager = $this->_objectManager->get(UserConfigTokenManagerInterface::class);
+    }
+
+    /**
+     * @magentoConfigFixture default/twofactorauth/general/force_providers duo_security
+     * @magentoConfigFixture default/twofactorauth/duo/integration_key abc123
+     * @magentoConfigFixture default/twofactorauth/duo/api_hostname abc123
+     * @magentoConfigFixture default/twofactorauth/duo/secret_key abc123
+     */
+    public function testNotAllowedWhenProviderAlreadyActivated(): void
+    {
+        $userId = (int)$this->_session->getUser()->getId();
+        $this->tfa->getProvider(DuoSecurity::CODE)->activate($userId);
+        $this->getRequest()
+            ->setMethod('POST')
+            ->setQueryValue('tfat', $this->tokenManager->issueFor($userId))
+            ->setPostValue('provider', 'duo_security');
+        $this->dispatch($this->uri);
+        $this->assertRedirect($this->stringContains('auth/login'));
+    }
+
+    /**
+     * @magentoConfigFixture default/twofactorauth/general/force_providers duo_security
+     * @magentoConfigFixture default/twofactorauth/duo/integration_key abc123
+     * @magentoConfigFixture default/twofactorauth/duo/api_hostname abc123
+     * @magentoConfigFixture default/twofactorauth/duo/secret_key abc123
+     */
+    public function testNotAllowedWhenProviderNotActivatedButIsTheOnlyProvider(): void
+    {
+        $userId = (int)$this->_session->getUser()->getId();
+        $this->getRequest()
+            ->setMethod('POST')
+            ->setQueryValue('tfat', $this->tokenManager->issueFor($userId))
+            ->setPostValue('provider', 'google');
+        $this->dispatch($this->uri);
+        $this->assertRedirect($this->stringContains('auth/login'));
+    }
+
+    /**
+     * @magentoConfigFixture default/twofactorauth/general/force_providers google,duo_security,authy
+     * @magentoConfigFixture default/twofactorauth/authy/api_key abc123
+     * @magentoConfigFixture default/twofactorauth/duo/integration_key abc123
+     * @magentoConfigFixture default/twofactorauth/duo/api_hostname abc123
+     * @magentoConfigFixture default/twofactorauth/duo/secret_key abc123
+     */
+    public function testSkippingAProvider(): void
+    {
+        $userId = (int)$this->_session->getUser()->getId();
+        $this->getRequest()
+            ->setMethod('POST')
+            ->setQueryValue('tfat', $this->tokenManager->issueFor($userId))
+            ->setPostValue('provider', 'authy');
+        $this->dispatch($this->uri);
+        self::assertTrue($this->tfaSession->getSkippedProviderConfig()['authy']);
+        $this->assertRedirect($this->stringContains('tfa/index'));
+    }
+
+    /**
+     * @magentoConfigFixture default/twofactorauth/general/force_providers duo_security,authy
+     * @magentoConfigFixture default/twofactorauth/authy/api_key abc123
+     * @magentoConfigFixture default/twofactorauth/duo/integration_key abc123
+     * @magentoConfigFixture default/twofactorauth/duo/api_hostname abc123
+     * @magentoConfigFixture default/twofactorauth/duo/secret_key abc123
+     */
+    public function testSkippingAllProvidersWhenThereAreNoneConfigured(): void
+    {
+        $userId = (int)$this->_session->getUser()->getId();
+        $this->tfaSession->setSkippedProviderConfig(
+            [
+                'duo_security' => true,
+                'already disabled provider' => true,
+                'authy' => true,
+            ]
+        );
+        $this->getRequest()
+            ->setMethod('POST')
+            ->setQueryValue('tfat', $this->tokenManager->issueFor($userId))
+            ->setPostValue('provider', 'authy');
+        $this->dispatch($this->uri);
+        $this->assertSessionMessages(
+            $this->equalTo(['At least one two-factor authentication provider must be configured.'])
+        );
+        $this->assertRedirect($this->stringContains('tfa/index'));
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function testAclHasAccess()
+    {
+        $this->markTestSkipped('Tested with the tests above.');
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function testAclNoAccess()
+    {
+        $this->markTestSkipped('Tested with the tests above.');
+    }
+}
diff --git a/TwoFactorAuth/Test/Integration/Controller/Adminhtml/Tfa/ConfigureTest.php b/TwoFactorAuth/Test/Integration/Controller/Adminhtml/Tfa/ConfigureTest.php
new file mode 100644
index 00000000..fe0a6cb4
--- /dev/null
+++ b/TwoFactorAuth/Test/Integration/Controller/Adminhtml/Tfa/ConfigureTest.php
@@ -0,0 +1,93 @@
+<?php
+declare(strict_types=1);
+
+
+namespace Magento\TwoFactorAuth\Test\Integration\Controller\Adminhtml\Tfa;
+
+use Magento\TestFramework\Helper\Bootstrap;
+use Magento\TwoFactorAuth\TestFramework\TestCase\AbstractBackendController;
+use Magento\TwoFactorAuth\Api\UserConfigTokenManagerInterface;
+
+/**
+ * Testing the controller for the page that presents forced providers list to users.
+ *
+ * @magentoAppArea adminhtml
+ * @magentoDbIsolation enabled
+ */
+class ConfigureTest extends AbstractBackendController
+{
+    /**
+     * @inheritDoc
+     */
+    protected $uri = 'backend/tfa/tfa/configure';
+
+    /**
+     * @inheritDoc
+     */
+    protected $resource = 'Magento_TwoFactorAuth::config';
+
+    /**
+     * @var UserConfigTokenManagerInterface
+     */
+    private $tokenManager;
+
+    /**
+     * @inheritDoc
+     */
+    protected $expectedNoAccessResponseCode = 302;
+
+    /**
+     * @inheritDoc
+     */
+    protected function setUp()
+    {
+        parent::setUp();
+
+        $this->tokenManager = Bootstrap::getObjectManager()->get(UserConfigTokenManagerInterface::class);
+    }
+
+    /**
+     * Verify that 2FA providers form is shown to users when 2FA for the app is not configured and token is present.
+     *
+     * @return void
+     */
+    public function testList(): void
+    {
+        $this->getRequest()
+            ->setQueryValue('tfat', $this->tokenManager->issueFor((int)$this->_session->getUser()->getId()));
+        $this->dispatch($this->uri);
+        $this->assertRegExp('/google/', $this->getResponse()->getBody());
+    }
+
+    /**
+     * Verify that 2FA config request is displayed for users when 2FA is not configured for the user.
+     *
+     * @return void
+     */
+    public function testWithoutToken(): void
+    {
+        $this->dispatch($this->uri);
+        $this->assertRedirect($this->stringContains('requestconfig'));
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function testAclHasAccess()
+    {
+        $this->getRequest()
+            ->setQueryValue('tfat', $this->tokenManager->issueFor((int)$this->_session->getUser()->getId()));
+        parent::testAclHasAccess();
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function testAclNoAccess()
+    {
+        $this->getRequest()
+            ->setQueryValue('tfat', $this->tokenManager->issueFor((int)$this->_session->getUser()->getId()));
+        parent::testAclNoAccess();
+        $this->assertRedirect($this->stringContains('login'));
+    }
+}
diff --git a/TwoFactorAuth/Test/Integration/Controller/Adminhtml/Tfa/ConfigurepostTest.php b/TwoFactorAuth/Test/Integration/Controller/Adminhtml/Tfa/ConfigurepostTest.php
new file mode 100644
index 00000000..dd0ac7a6
--- /dev/null
+++ b/TwoFactorAuth/Test/Integration/Controller/Adminhtml/Tfa/ConfigurepostTest.php
@@ -0,0 +1,154 @@
+<?php
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Test\Integration\Controller\Adminhtml\Tfa;
+
+use Magento\TestFramework\Helper\Bootstrap;
+use Magento\TwoFactorAuth\TestFramework\TestCase\AbstractBackendController;
+use Magento\TwoFactorAuth\Api\ProviderInterface;
+use Magento\TwoFactorAuth\Api\TfaInterface;
+use Magento\TwoFactorAuth\Api\UserConfigTokenManagerInterface;
+use Magento\Framework\HTTP\PhpEnvironment\Request;
+use Magento\TwoFactorAuth\Model\Provider\Engine\Google;
+
+/**
+ * Testing the controller for the page that allows to configure 2FA providers.
+ *
+ * @magentoAppArea adminhtml
+ * @magentoDbIsolation enabled
+ */
+class ConfigurepostTest extends AbstractBackendController
+{
+    /**
+     * @inheritDoc
+     */
+    protected $uri = 'backend/tfa/tfa/configurepost';
+
+    /**
+     * @inheritDoc
+     */
+    protected $resource = 'Magento_TwoFactorAuth::config';
+
+    /**
+     * @inheritDoc
+     */
+    protected $httpMethod = Request::METHOD_POST;
+
+    /**
+     * @var UserConfigTokenManagerInterface
+     */
+    private $tokenManager;
+
+    /**
+     * @var TfaInterface
+     */
+    private $tfa;
+
+    /**
+     * @inheritDoc
+     */
+    protected $expectedNoAccessResponseCode = 302;
+
+    /**
+     * @inheritDoc
+     */
+    protected function setUp()
+    {
+        parent::setUp();
+
+        $this->tokenManager = Bootstrap::getObjectManager()->get(UserConfigTokenManagerInterface::class);
+        $this->tfa = Bootstrap::getObjectManager()->get(TfaInterface::class);
+    }
+
+    /**
+     * Verify that 2FA providers are updated when a user submits the form.
+     *
+     * @return void
+     */
+    public function testUpdated(): void
+    {
+        $providerCode = Google::CODE;
+        $this->getRequest()->setMethod(Request::METHOD_POST);
+        $this->getRequest()
+            ->setParam('tfat', $this->tokenManager->issueFor((int)$this->_session->getUser()->getId()));
+        $this->getRequest()->setPostValue([
+            'tfa_selected' => [$providerCode => 'on']
+        ]);
+        $this->dispatch($this->uri);
+        $this->assertRedirect($this->stringContains('admin'));
+        $this->assertNotEmpty($providers = $this->tfa->getForcedProviders());
+        /** @var ProviderInterface $provider */
+        $provider = array_pop($providers);
+        $this->assertEquals($providerCode, $provider->getCode());
+    }
+
+    /**
+     * Verify that token is required to proceed.
+     *
+     * @return void
+     */
+    public function testWithoutToken(): void
+    {
+        $this->getRequest()->setMethod(Request::METHOD_POST);
+        $this->getRequest()->setPostValue([
+            'tfa_selected' => [Google::CODE => 'on']
+        ]);
+        $this->dispatch($this->uri);
+        $this->assertRedirect($this->stringContains('login'));
+        $this->assertEmpty($this->tfa->getForcedProviders());
+    }
+
+    /**
+     * Verify that token is required to proceed even if providers area already configured.
+     *
+     * @return void
+     * @magentoConfigFixture default/twofactorauth/general/force_providers google
+     */
+    public function testConfiguredWithoutToken(): void
+    {
+        $this->getRequest()->setMethod(Request::METHOD_POST);
+        $this->getRequest()->setPostValue([
+            'tfa_selected' => ['nonExisting' => 'on']
+        ]);
+        $this->dispatch($this->uri);
+        $this->assertRedirect($this->stringContains('login'));
+    }
+
+    /**
+     * Verify that 2FA providers are validated
+     *
+     * @return void
+     */
+    public function testValidated(): void
+    {
+        $this->getRequest()->setMethod(Request::METHOD_POST);
+        $this->getRequest()
+            ->setQueryValue('tfat', $this->tokenManager->issueFor((int)$this->_session->getUser()->getId()));
+        $this->getRequest()->setPostValue([
+            'tfa_selected' => ['nonExisting' => 'on']
+        ]);
+        $this->dispatch($this->uri);
+        $this->assertRedirect($this->stringContains('configure'));
+        $this->assertEmpty($this->tfa->getForcedProviders());
+        $this->assertSessionMessages($this->contains(__('Please select valid providers.')->render()));
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function testAclHasAccess()
+    {
+        $this->markTestSkipped('Subsequently tested with the tests above.');
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function testAclNoAccess()
+    {
+        $this->getRequest()
+            ->setQueryValue('tfat', $this->tokenManager->issueFor((int)$this->_session->getUser()->getId()));
+        parent::testAclNoAccess();
+        $this->assertRedirect($this->stringContains('login'));
+    }
+}
diff --git a/TwoFactorAuth/Test/Integration/Controller/Adminhtml/Tfa/IndexTest.php b/TwoFactorAuth/Test/Integration/Controller/Adminhtml/Tfa/IndexTest.php
new file mode 100644
index 00000000..d0c05429
--- /dev/null
+++ b/TwoFactorAuth/Test/Integration/Controller/Adminhtml/Tfa/IndexTest.php
@@ -0,0 +1,166 @@
+<?php
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Test\Integration\Controller\Adminhtml\Tfa;
+
+use Magento\TestFramework\Helper\Bootstrap;
+use Magento\TwoFactorAuth\Api\TfaSessionInterface;
+use Magento\TwoFactorAuth\Model\Provider\Engine\Authy;
+use Magento\TwoFactorAuth\Model\Provider\Engine\DuoSecurity;
+use Magento\TwoFactorAuth\TestFramework\TestCase\AbstractBackendController;
+use Magento\TwoFactorAuth\Api\TfaInterface;
+use Magento\TwoFactorAuth\Model\Provider\Engine\Google;
+use Magento\TwoFactorAuth\Api\UserConfigManagerInterface;
+
+/**
+ * Testing the controller for the page that redirects user to proper pages depending on 2FA state.
+ *
+ * @magentoAppArea adminhtml
+ * @magentoDbIsolation enabled
+ */
+class IndexTest extends AbstractBackendController
+{
+    /**
+     * @inheritDoc
+     */
+    protected $uri = 'backend/tfa/tfa/index';
+
+    /**
+     * @var TfaInterface
+     */
+    private $tfa;
+
+    /**
+     * @var UserConfigManagerInterface
+     */
+    private $userManager;
+
+    /**
+     * @var TfaSessionInterface
+     */
+    private $tfaSession;
+
+    /**
+     * @inheritDoc
+     */
+    protected function setUp()
+    {
+        parent::setUp();
+
+        $objectManager = Bootstrap::getObjectManager();
+
+        $this->tfaSession = $objectManager->get(TfaSessionInterface::class);
+        $this->userManager = $objectManager->get(UserConfigManagerInterface::class);
+        $this->tfa = $objectManager->get(TfaInterface::class);
+    }
+
+    /**
+     * Verify that user is taken to Config Request page when 2FA is not configured.
+     *
+     * @return void
+     */
+    public function testNoneConfigured(): void
+    {
+        $this->dispatch($this->uri);
+        $this->assertRedirect($this->stringContains('requestconfig'));
+    }
+
+    /**
+     * Verify that user is taken to provider's configuration page when only personal 2FA is not configured.
+     *
+     * @return void
+     * @magentoConfigFixture default/twofactorauth/general/force_providers google
+     */
+    public function testUserNotConfigured(): void
+    {
+        $this->dispatch($this->uri);
+        $this->assertRedirect($this->stringContains('google/configure'));
+    }
+
+    /**
+     * Verify that user is taken to configured provider's challenge page.
+     *
+     * @return void
+     * @magentoConfigFixture default/twofactorauth/general/force_providers google
+     * @magentoDbIsolation enabled
+     */
+    public function testConfigured(): void
+    {
+        //Activating a provider for the user.
+        $this->tfa->getProvider(Google::CODE)->activate((int)$this->_session->getUser()->getId());
+
+        $this->dispatch($this->uri);
+        //Taken to the provider's challenge page.
+        $this->assertRedirect($this->stringContains('google/auth'));
+    }
+
+    /**
+     * @magentoConfigFixture default/twofactorauth/general/force_providers google,authy
+     * @magentoConfigFixture default/twofactorauth/authy/api_key abc123
+     * @magentoDbIsolation enabled
+     */
+    public function testNotConfiguredWithSkipped(): void
+    {
+        $this->tfaSession->setSkippedProviderConfig(['google' => true]);
+
+        $this->dispatch($this->uri);
+        $this->assertRedirect($this->stringContains('authy/configure'));
+    }
+
+    /**
+     * @magentoConfigFixture default/twofactorauth/general/force_providers google,authy,duo_security
+     * @magentoConfigFixture default/twofactorauth/authy/api_key abc123
+     * @magentoConfigFixture default/twofactorauth/duo/integration_key abc123
+     * @magentoConfigFixture default/twofactorauth/duo/api_hostname abc123
+     * @magentoConfigFixture default/twofactorauth/duo/secret_key abc123
+     * @magentoDbIsolation enabled
+     */
+    public function testDefaultProviderIsUsedForAuth(): void
+    {
+        $userId = (int)$this->_session->getUser()->getId();
+        $this->tfa->getProvider(Google::CODE)->activate($userId);
+        $this->tfa->getProvider(Authy::CODE)->activate($userId);
+        $this->tfa->getProvider(DuoSecurity::CODE)->activate($userId);
+        $this->userManager->setDefaultProvider($userId, Authy::CODE);
+        $this->dispatch($this->uri);
+        $this->assertRedirect($this->stringContains('authy/auth'));
+    }
+
+    /**
+     * @magentoConfigFixture default/twofactorauth/general/force_providers google,authy,duo_security
+     * @magentoConfigFixture default/twofactorauth/authy/api_key abc123
+     * @magentoConfigFixture default/twofactorauth/duo/integration_key abc123
+     * @magentoConfigFixture default/twofactorauth/duo/api_hostname abc123
+     * @magentoConfigFixture default/twofactorauth/duo/secret_key abc123
+     * @magentoDbIsolation enabled
+     */
+    public function testFirstProviderIsUsedForAuthWithoutADefault(): void
+    {
+        $userId = (int)$this->_session->getUser()->getId();
+        $this->userManager->setDefaultProvider($userId, '');
+        $this->tfa->getProvider(Google::CODE)->activate($userId);
+        $this->tfa->getProvider(Authy::CODE)->activate($userId);
+        $this->tfa->getProvider(DuoSecurity::CODE)->activate($userId);
+        $this->dispatch($this->uri);
+        $this->assertRedirect($this->stringContains('google/auth'));
+    }
+
+    /**
+     * @magentoConfigFixture default/twofactorauth/general/force_providers google,authy,duo_security
+     * @magentoConfigFixture default/twofactorauth/authy/api_key abc123
+     * @magentoConfigFixture default/twofactorauth/duo/integration_key abc123
+     * @magentoConfigFixture default/twofactorauth/duo/api_hostname abc123
+     * @magentoConfigFixture default/twofactorauth/duo/secret_key abc123
+     * @magentoDbIsolation enabled
+     */
+    public function testFirstProviderIsUsedForAuthWhenDefaultIsInvalid(): void
+    {
+        $userId = (int)$this->_session->getUser()->getId();
+        $this->userManager->setDefaultProvider($userId, 'foobar');
+        $this->tfa->getProvider(Google::CODE)->activate($userId);
+        $this->tfa->getProvider(Authy::CODE)->activate($userId);
+        $this->tfa->getProvider(DuoSecurity::CODE)->activate($userId);
+        $this->dispatch($this->uri);
+        $this->assertRedirect($this->stringContains('google/auth'));
+    }
+}
diff --git a/TwoFactorAuth/Test/Integration/Controller/Adminhtml/Tfa/RequestconfigTest.php b/TwoFactorAuth/Test/Integration/Controller/Adminhtml/Tfa/RequestconfigTest.php
new file mode 100644
index 00000000..e6c66799
--- /dev/null
+++ b/TwoFactorAuth/Test/Integration/Controller/Adminhtml/Tfa/RequestconfigTest.php
@@ -0,0 +1,111 @@
+<?php
+declare(strict_types=1);
+
+
+namespace Magento\TwoFactorAuth\Test\Integration\Controller\Adminhtml\Tfa;
+
+use Magento\TestFramework\Helper\Bootstrap;
+use Magento\TwoFactorAuth\TestFramework\TestCase\AbstractBackendController;
+use Magento\TwoFactorAuth\Api\TfaInterface;
+use Magento\TwoFactorAuth\Api\UserConfigTokenManagerInterface;
+use Magento\TwoFactorAuth\Model\Provider\Engine\Google;
+
+/**
+ * Testing the controller for the page that requests 2FA config from users.
+ *
+ * @magentoAppArea adminhtml
+ * @magentoDbIsolation enabled
+ */
+class RequestconfigTest extends AbstractBackendController
+{
+    /**
+     * @inheritDoc
+     */
+    protected $uri = 'backend/tfa/tfa/requestconfig';
+
+    /**
+     * @var TfaInterface
+     */
+    private $tfa;
+
+    /**
+     * @var UserConfigTokenManagerInterface
+     */
+    private $tokenManager;
+
+    /**
+     * @inheritDoc
+     */
+    protected function setUp()
+    {
+        parent::setUp();
+
+        $this->tfa = Bootstrap::getObjectManager()->get(TfaInterface::class);
+        $this->tokenManager = Bootstrap::getObjectManager()->get(UserConfigTokenManagerInterface::class);
+    }
+
+    /**
+     * Verify that 2FA config request is display for users when 2FA is not configured for the app.
+     *
+     * @return void
+     */
+    public function testAppConfigRequested(): void
+    {
+        $this->dispatch($this->uri);
+        $this->assertRegExp('/You need to configure Two\-Factor Authorization/', $this->getResponse()->getBody());
+    }
+
+    /**
+     * Verify that 2FA config request is display for users when 2FA is not configured for the user.
+     *
+     * @return void
+     * @magentoConfigFixture default/twofactorauth/general/force_providers google
+     */
+    public function testUserConfigRequested(): void
+    {
+        $this->dispatch($this->uri);
+        $this->assertRegExp('/You need to configure Two\-Factor Authorization/', $this->getResponse()->getBody());
+    }
+
+
+    /**
+     * Verify that 2FA config is not requested when 2FA is configured.
+     *
+     * @return void
+     * @magentoConfigFixture default/twofactorauth/general/force_providers google
+     * @magentoDbIsolation enabled
+     * @expectedException \Magento\Framework\Exception\AuthorizationException
+     */
+    public function testNotRequested(): void
+    {
+        $this->tfa->getProvider(Google::CODE)->activate((int)$this->_session->getUser()->getId());
+        $this->dispatch($this->uri);
+    }
+
+    /**
+     * Verify that users with valid tokens get redirected to the app 2FA config page.
+     *
+     * @return void
+     */
+    public function testRedirectToAppConfig(): void
+    {
+        $this->getRequest()
+            ->setQueryValue('tfat', $this->tokenManager->issueFor((int)$this->_session->getUser()->getId()));
+        $this->dispatch($this->uri);
+        $this->assertRedirect($this->stringContains('tfa/configure'));
+    }
+
+    /**
+     * Verify that users with valid tokens get redirected to the user 2FA config page.
+     *
+     * @return void
+     * @magentoConfigFixture default/twofactorauth/general/force_providers google
+     */
+    public function testRedirectToUserConfig(): void
+    {
+        $this->getRequest()
+            ->setQueryValue('tfat', $this->tokenManager->issueFor((int)$this->_session->getUser()->getId()));
+        $this->dispatch($this->uri);
+        $this->assertRedirect($this->stringContains('tfa/index'));
+    }
+}
diff --git a/TwoFactorAuth/Test/Integration/Controller/Adminhtml/U2f/ConfigureTest.php b/TwoFactorAuth/Test/Integration/Controller/Adminhtml/U2f/ConfigureTest.php
new file mode 100644
index 00000000..bbf35b4b
--- /dev/null
+++ b/TwoFactorAuth/Test/Integration/Controller/Adminhtml/U2f/ConfigureTest.php
@@ -0,0 +1,53 @@
+<?php
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Test\Integration\Controller\Adminhtml\U2f;
+
+use Magento\Framework\HTTP\PhpEnvironment\Request;
+use Magento\TwoFactorAuth\TestFramework\TestCase\AbstractConfigureBackendController;
+
+/**
+ * Test for the configure U2F 2FA form page.
+ *
+ * @magentoAppArea adminhtml
+ * @magentoDbIsolation enabled
+ */
+class ConfigureTest extends AbstractConfigureBackendController
+{
+    /**
+     * @inheritDoc
+     */
+    protected $uri = 'backend/tfa/u2f/configure';
+
+    /**
+     * @inheritDoc
+     */
+    protected $httpMethod = Request::METHOD_GET;
+
+    /**
+     * @inheritDoc
+     * @magentoConfigFixture default/twofactorauth/general/force_providers u2fkey
+     */
+    public function testTokenAccess(): void
+    {
+        parent::testTokenAccess();
+    }
+
+    /**
+     * @inheritDoc
+     * @magentoConfigFixture default/twofactorauth/general/force_providers u2fkey
+     */
+    public function testAclHasAccess()
+    {
+        parent::testAclHasAccess();
+    }
+
+    /**
+     * @inheritDoc
+     * @magentoConfigFixture default/twofactorauth/general/force_providers u2fkey
+     */
+    public function testAclNoAccess()
+    {
+        parent::testAclNoAccess();
+    }
+}
diff --git a/TwoFactorAuth/Test/Integration/Controller/Adminhtml/U2f/ConfigurepostTest.php b/TwoFactorAuth/Test/Integration/Controller/Adminhtml/U2f/ConfigurepostTest.php
new file mode 100644
index 00000000..bd64b18f
--- /dev/null
+++ b/TwoFactorAuth/Test/Integration/Controller/Adminhtml/U2f/ConfigurepostTest.php
@@ -0,0 +1,53 @@
+<?php
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Test\Integration\Controller\Adminhtml\U2f;
+
+use Magento\Framework\HTTP\PhpEnvironment\Request;
+use Magento\TwoFactorAuth\TestFramework\TestCase\AbstractConfigureBackendController;
+
+/**
+ * Test for the configure U2F 2FA form processor.
+ *
+ * @magentoAppArea adminhtml
+ * @magentoDbIsolation enabled
+ */
+class ConfigurepostTest extends AbstractConfigureBackendController
+{
+    /**
+     * @inheritDoc
+     */
+    protected $uri = 'backend/tfa/u2f/configurepost';
+
+    /**
+     * @inheritDoc
+     */
+    protected $httpMethod = Request::METHOD_POST;
+
+    /**
+     * @inheritDoc
+     * @magentoConfigFixture default/twofactorauth/general/force_providers u2fkey
+     */
+    public function testTokenAccess(): void
+    {
+        parent::testTokenAccess();
+    }
+
+    /**
+     * @inheritDoc
+     * @magentoConfigFixture default/twofactorauth/general/force_providers u2fkey
+     */
+    public function testAclHasAccess()
+    {
+        parent::testAclHasAccess();
+    }
+
+    /**
+     * @inheritDoc
+     * @magentoConfigFixture default/twofactorauth/general/force_providers u2fkey
+     */
+    public function testAclNoAccess()
+    {
+        parent::testAclNoAccess();
+    }
+}
diff --git a/TwoFactorAuth/Test/Integration/ControllerActionPredispatchTest.php b/TwoFactorAuth/Test/Integration/ControllerActionPredispatchTest.php
new file mode 100644
index 00000000..77489e9a
--- /dev/null
+++ b/TwoFactorAuth/Test/Integration/ControllerActionPredispatchTest.php
@@ -0,0 +1,160 @@
+<?php
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Test\Integration;
+
+use Magento\Framework\Stdlib\Cookie\CookieReaderInterface;
+use Magento\TestFramework\Helper\Bootstrap;
+use Magento\TwoFactorAuth\TestFramework\TestCase\AbstractBackendController;
+use Magento\TwoFactorAuth\Api\TfaInterface;
+use Magento\TwoFactorAuth\Api\TfaSessionInterface;
+use Magento\TwoFactorAuth\Api\UserConfigTokenManagerInterface;
+use Magento\TwoFactorAuth\Model\Provider\Engine\Google;
+
+/**
+ * Test for 2FA enforcement.
+ *
+ * @magentoAppArea adminhtml
+ * @magentoDbIsolation enabled
+ */
+class ControllerActionPredispatchTest extends AbstractBackendController
+{
+    /**
+     * @var CookieReaderInterface
+     */
+    private $cookieReader;
+
+    /**
+     * @var UserConfigTokenManagerInterface
+     */
+    private $tokenManager;
+
+    /**
+     * @var TfaInterface
+     */
+    private $tfa;
+
+    /**
+     * @var TfaSessionInterface
+     */
+    private $tfaSession;
+
+    /**
+     * @inheritDoc
+     */
+    protected function setUp()
+    {
+        parent::setUp();
+
+        $this->cookieReader = Bootstrap::getObjectManager()->get(CookieReaderInterface::class);
+        $this->tokenManager = Bootstrap::getObjectManager()->get(UserConfigTokenManagerInterface::class);
+        $this->tfaSession = Bootstrap::getObjectManager()->get(TfaSessionInterface::class);
+        $this->tfa = Bootstrap::getObjectManager()->get(TfaInterface::class);
+    }
+
+    /**
+     * Verify that users with configured 2FA and 2FA completed can proceed to desired page.
+     *
+     * @return void
+     * @magentoConfigFixture default/twofactorauth/general/force_providers google
+     * @magentoDbIsolation enabled
+     * @magentoAppIsolation enabled
+     */
+    public function testTfaCompleted(): void
+    {
+        //Configuring 2FA for the user and completing 2FA.
+        $this->tfa->getProvider(Google::CODE)->activate((int)$this->_session->getUser()->getId());
+        $this->tfaSession->grantAccess();
+        //Accessing a page in adminhtml area
+        $this->dispatch('backend/admin/user/');
+        //Authenticated user with 2FA configured and completed is taken to the Users page as requested.
+        $this->assertRegExp('/' .$this->_session->getUser()->getUserName() .'/i', $this->getResponse()->getBody());
+    }
+
+    /**
+     * Verify that unauthenticated user is redirected to login page.
+     *
+     * @return void
+     * @magentoAppIsolation enabled
+     */
+    public function testUnauthenticated(): void
+    {
+        $this->logout();
+        $this->dispatch('backend/admin/index/index');
+        //Login controller redirects to full start-up URL
+        $this->assertRedirect($this->stringContains('index'));
+        $properUrl = $this->getResponse()->getHeader('Location')->getFieldValue();
+
+        //Login page must be rendered without redirects
+        $this->getRequest()->setDispatched(false);
+        $this->getRequest()->setUri($properUrl);
+        $this->dispatch($properUrl);
+        $this->assertContains('Welcome, please sign in', $this->getResponse()->getBody());
+    }
+
+    /**
+     * Verify that users would be redirected to "2FA Config Request" page when 2FA is not configured for the app.
+     *
+     * @magentoConfigFixture default/twofactorauth/general/force_providers google,duo_security
+     * @return void
+     */
+    public function testConfigRequested(): void
+    {
+        $this->tfa->getProvider(Google::CODE)->resetConfiguration((int)$this->_session->getUser()->getId());
+
+        //Accessing a page in adminhtml area
+        $this->dispatch('backend/admin/user/');
+        //Authenticated user gets a redirect to 2FA configuration page since none is configured.
+        $this->assertRedirect($this->stringContains('requestconfig'));
+    }
+
+    /**
+     * Verify that users would be redirected to "2FA Config Request" page when 2FA is not configured for the user.
+     *
+     * @return void
+     * @magentoConfigFixture default/twofactorauth/general/force_providers google
+     */
+    public function testUserConfigRequested(): void
+    {
+        //Accessing a page in adminhtml area
+        $this->dispatch('backend/admin/user/');
+        //Authenticated user gets a redirect to 2FA configuration page since none is configured for the user.
+        $this->assertRedirect($this->stringContains('requestconfig'));
+    }
+
+    /**
+     * Verify that users returning with a token from the E-mail get a new cookie with it.
+     *
+     * @magentoConfigFixture default/twofactorauth/general/force_providers google,duo_security
+     * @return void
+     */
+    public function testCookieSet(): void
+    {
+        $this->tfa->getProvider(Google::CODE)->resetConfiguration((int)$this->_session->getUser()->getId());
+
+        //Accessing a page in adminhtml area with a valid token.
+        $this->getRequest()
+            ->setQueryValue('tfat', $token = $this->tokenManager->issueFor((int)$this->_session->getUser()->getId()));
+        $this->dispatch('backend/admin/user/');
+        //Authenticated user gets a redirect to 2FA configuration page since none is configured.
+        $this->assertRedirect($this->stringContains('requestconfig'));
+        $this->assertNotEmpty($cookie = $this->cookieReader->getCookie('tfa-ct'));
+        $this->assertEquals($token, $cookie);
+    }
+
+    /**
+     * Verify that users returning with a valid token from the E-mail and 2FA configured get redirected to 2FA form.
+     *
+     * @return void
+     * @magentoConfigFixture default/twofactorauth/general/force_providers google
+     * @magentoDbIsolation enabled
+     */
+    public function testTfaChallenged(): void
+    {
+        $this->tfa->getProvider(Google::CODE)->activate((int)$this->_session->getUser()->getId());
+        //Accessing a page in adminhtml area
+        $this->dispatch('backend/admin/user/');
+        //Authenticated user with 2FA configured is redirected to 2FA code form.
+        $this->assertRedirect($this->stringContains('tfa/tfa/index'));
+    }
+}
diff --git a/TwoFactorAuth/Test/Integration/Model/Provider/Engine/U2fKey/SessionTest.php b/TwoFactorAuth/Test/Integration/Model/Provider/Engine/U2fKey/SessionTest.php
new file mode 100644
index 00000000..b58b1ce6
--- /dev/null
+++ b/TwoFactorAuth/Test/Integration/Model/Provider/Engine/U2fKey/SessionTest.php
@@ -0,0 +1,38 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+
+declare(strict_types=1);
+
+namespace Magento\Model\Provider\Engine\U2fKey;
+
+use Magento\Framework\App\ObjectManager;
+use Magento\TwoFactorAuth\Model\Provider\Engine\U2fKey\Session;
+use PHPUnit\Framework\TestCase;
+
+class SessionTest extends TestCase
+{
+    /**
+     * @var Session
+     */
+    private $session;
+
+    protected function setUp()
+    {
+        $this->session = ObjectManager::getInstance()->get(Session::class);
+    }
+
+    public function testU2fChallenge()
+    {
+        self::assertNull($this->session->getU2fChallenge());
+        $this->session->setU2fChallenge([123, 456]);
+        self::assertSame([123, 456], $this->session->getU2fChallenge());
+        $this->session->setU2fChallenge([345, 678]);
+        self::assertSame([345, 678], $this->session->getU2fChallenge());
+        $this->session->setU2fChallenge(null);
+        self::assertNull($this->session->getU2fChallenge());
+        $this->session->setU2fChallenge([]);
+    }
+}
diff --git a/TwoFactorAuth/Test/Integration/Model/TfaSessionTest.php b/TwoFactorAuth/Test/Integration/Model/TfaSessionTest.php
new file mode 100644
index 00000000..8b1c20ca
--- /dev/null
+++ b/TwoFactorAuth/Test/Integration/Model/TfaSessionTest.php
@@ -0,0 +1,37 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+
+declare(strict_types=1);
+
+namespace Magento\Model;
+
+use Magento\Framework\App\ObjectManager;
+use Magento\TwoFactorAuth\Model\TfaSession;
+use PHPUnit\Framework\TestCase;
+
+class TfaSessionTest extends TestCase
+{
+    /**
+     * @var TfaSession
+     */
+    private $session;
+
+    protected function setUp()
+    {
+        $this->session = ObjectManager::getInstance()->get(TfaSession::class);
+    }
+
+    public function testSkipProvider()
+    {
+        self::assertSame([], $this->session->getSkippedProviderConfig());
+        $this->session->setSkippedProviderConfig(['foo' => true]);
+        self::assertSame(['foo' => true], $this->session->getSkippedProviderConfig());
+        $this->session->setSkippedProviderConfig(['foo' => true, 'bar' => true]);
+        self::assertSame(['foo' => true, 'bar' => true], $this->session->getSkippedProviderConfig());
+        $this->session->setSkippedProviderConfig([]);
+        self::assertSame([], $this->session->getSkippedProviderConfig());
+    }
+}
diff --git a/TwoFactorAuth/Test/Integration/UserConfigManagerTest.php b/TwoFactorAuth/Test/Integration/UserConfigManagerTest.php
new file mode 100644
index 00000000..2c0f4dc0
--- /dev/null
+++ b/TwoFactorAuth/Test/Integration/UserConfigManagerTest.php
@@ -0,0 +1,268 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Test\Integration;
+
+use Magento\Framework\App\ResourceConnection;
+use Magento\Framework\Encryption\EncryptorInterface;
+use Magento\Framework\Serialize\SerializerInterface;
+use Magento\TestFramework\Helper\Bootstrap;
+use Magento\User\Model\ResourceModel\User\Collection as AdminUserCollection;
+use Magento\TwoFactorAuth\Api\UserConfigManagerInterface;
+use PHPUnit\Framework\TestCase;
+
+/**
+ * @magentoDbIsolation enabled
+ */
+class UserConfigManagerTest extends TestCase
+{
+    /**
+     * @var UserConfigManagerInterface
+     */
+    private $userConfigManager;
+
+    /**
+     * @var SerializerInterface
+     */
+    private $serializer;
+
+    /**
+     * @inheritDoc
+     */
+    protected function setUp()
+    {
+        $this->userConfigManager = Bootstrap::getObjectManager()->get(UserConfigManagerInterface::class);
+        $this->serializer = Bootstrap::getObjectManager()->get(SerializerInterface::class);
+    }
+
+    /**
+     * @magentoDataFixture Magento/User/_files/dummy_user.php
+     */
+    public function testShouldSetAndGetProviderConfiguration(): void
+    {
+        /** @var AdminUserCollection $dummyUserCollection */
+        $dummyUserCollection = Bootstrap::getObjectManager()->create(AdminUserCollection::class);
+        $dummyUserCollection->addFieldToFilter('username', 'dummy_username');
+        $dummyUser = $dummyUserCollection->getFirstItem();
+
+        $configPayload = ['a' => 1, 'b' => 2];
+
+        $this->userConfigManager->setProviderConfig(
+            (int)$dummyUser->getId(),
+            'test_provider',
+            $configPayload
+        );
+
+        $this->assertSame(
+            $configPayload,
+            $this->userConfigManager->getProviderConfig((int)$dummyUser->getId(), 'test_provider')
+        );
+    }
+
+    /**
+     * @magentoDataFixture Magento/User/_files/dummy_user.php
+     */
+    public function testShouldSetAndGetConfiguredProviders(): void
+    {
+        /** @var AdminUserCollection $dummyUserCollection */
+        $dummyUserCollection = Bootstrap::getObjectManager()->create(AdminUserCollection::class);
+        $dummyUserCollection->addFieldToFilter('username', 'dummy_username');
+        $dummyUser = $dummyUserCollection->getFirstItem();
+
+        $providers = ['test_provider1', 'test_provider2'];
+
+        $this->userConfigManager->setProvidersCodes((int)$dummyUser->getId(), $providers);
+
+        $this->assertSame(
+            $providers,
+            $this->userConfigManager->getProvidersCodes((int)$dummyUser->getId())
+        );
+    }
+
+    /**
+     * @magentoDataFixture Magento/User/_files/dummy_user.php
+     */
+    public function testShouldSetAndGetDefaultProvider(): void
+    {
+        /** @var AdminUserCollection $dummyUserCollection */
+        $dummyUserCollection = Bootstrap::getObjectManager()->create(AdminUserCollection::class);
+        $dummyUserCollection->addFieldToFilter('username', 'dummy_username');
+        $dummyUser = $dummyUserCollection->getFirstItem();
+
+        $provider = 'test_provider';
+
+        $this->userConfigManager->setDefaultProvider((int)$dummyUser->getId(), $provider);
+
+        $this->assertSame(
+            $provider,
+            $this->userConfigManager->getDefaultProvider((int)$dummyUser->getId())
+        );
+    }
+
+    /**
+     * @magentoDataFixture Magento/User/_files/dummy_user.php
+     */
+    public function testShouldResetProviderConfiguration(): void
+    {
+        /** @var AdminUserCollection $dummyUserCollection */
+        $dummyUserCollection = Bootstrap::getObjectManager()->create(AdminUserCollection::class);
+        $dummyUserCollection->addFieldToFilter('username', 'dummy_username');
+        $dummyUser = $dummyUserCollection->getFirstItem();
+
+        $configPayload = ['a' => 1, 'b' => 2];
+
+        $this->userConfigManager->setProviderConfig(
+            (int)$dummyUser->getId(),
+            'test_provider',
+            $configPayload
+        );
+        $this->userConfigManager->resetProviderConfig((int)$dummyUser->getId(), 'test_provider');
+
+        $this->assertNull(
+            $this->userConfigManager->getProviderConfig((int)$dummyUser->getId(), 'test_provider')
+        );
+    }
+
+    /**
+     * @magentoDataFixture Magento/User/_files/dummy_user.php
+     */
+    public function testShouldActivateProvider(): void
+    {
+        /** @var AdminUserCollection $dummyUserCollection */
+        $dummyUserCollection = Bootstrap::getObjectManager()->create(AdminUserCollection::class);
+        $dummyUserCollection->addFieldToFilter('username', 'dummy_username');
+        $dummyUser = $dummyUserCollection->getFirstItem();
+
+        $configPayload = ['a' => 1, 'b' => 2];
+        $this->userConfigManager->setProviderConfig(
+            (int)$dummyUser->getId(),
+            'test_provider',
+            $configPayload
+        );
+
+        // Check precondition
+        $this->assertFalse(
+            $this->userConfigManager->isProviderConfigurationActive((int)$dummyUser->getId(), 'test_provider')
+        );
+
+        $this->userConfigManager->activateProviderConfiguration((int)$dummyUser->getId(), 'test_provider');
+
+        $this->assertTrue(
+            $this->userConfigManager->isProviderConfigurationActive((int)$dummyUser->getId(), 'test_provider')
+        );
+    }
+
+    /**
+     * @magentoDataFixture Magento/User/_files/dummy_user.php
+     */
+    public function testShouldEncryptConfiguration(): void
+    {
+        /** @var AdminUserCollection $dummyUserCollection */
+        $dummyUserCollection = Bootstrap::getObjectManager()->create(AdminUserCollection::class);
+        $dummyUserCollection->addFieldToFilter('username', 'dummy_username');
+        $dummyUser = $dummyUserCollection->getFirstItem();
+
+        /** @var EncryptorInterface $encryptor */
+        $encryptor = Bootstrap::getObjectManager()->create(EncryptorInterface::class);
+
+        /** @var ResourceConnection $resourceConnection */
+        $connection = Bootstrap::getObjectManager()->get(ResourceConnection::class)
+            ->getConnection(ResourceConnection::DEFAULT_CONNECTION);
+
+        $configPayload = ['a' => 1, 'b' => 2];
+
+        $this->userConfigManager->setProviderConfig(
+            (int)$dummyUser->getId(),
+            'test_provider',
+            $configPayload
+        );
+
+        $qry = $connection->select()
+            ->from('tfa_user_config', 'encoded_config')
+            ->where('user_id = ?', (int)$dummyUser->getId());
+
+        $res = $connection->fetchOne($qry);
+        $this->assertSame(
+            ['test_provider' => $configPayload],
+            $this->serializer->unserialize($encryptor->decrypt($res))
+        );
+    }
+
+    /**
+     * @magentoDataFixture Magento/User/_files/dummy_user.php
+     */
+    public function testShouldGetLegacyNonEncryptedProviderConfiguration(): void
+    {
+        /** @var AdminUserCollection $dummyUserCollection */
+        $dummyUserCollection = Bootstrap::getObjectManager()->create(AdminUserCollection::class);
+
+        /** @var ResourceConnection $resourceConnection */
+        $resourceConnection = Bootstrap::getObjectManager()->get(ResourceConnection::class);
+        $connection = $resourceConnection->getConnection(ResourceConnection::DEFAULT_CONNECTION);
+
+        $dummyUserCollection->addFieldToFilter('username', 'dummy_username');
+        $dummyUser = $dummyUserCollection->getFirstItem();
+
+        $tfaUserConfig = $resourceConnection->getTableName('tfa_user_config');
+        $connection = $resourceConnection->getConnection();
+
+        $configPayload = ['a' => 1, 'b' => 2];
+        $connection->insertOnDuplicate(
+            $tfaUserConfig,
+            [
+                'encoded_config' => $this->serializer->serialize(['test_provider' => $configPayload]),
+                'default_provider' => 'test_provider',
+                'encoded_providers' => $this->serializer->serialize(['test_Provider']),
+                'user_id' => (int)$dummyUser->getId()
+            ],
+            [
+                'encoded_config',
+                'default_provider',
+                'encoded_providers'
+            ]
+        );
+
+        $this->assertSame(
+            $configPayload,
+            $this->userConfigManager->getProviderConfig((int)$dummyUser->getId(), 'test_provider')
+        );
+    }
+
+    /**
+     * @magentoDataFixture Magento/User/_files/dummy_user.php
+     */
+    public function testShouldAddProviderConfiguration(): void
+    {
+        /** @var AdminUserCollection $dummyUserCollection */
+        $dummyUserCollection = Bootstrap::getObjectManager()->create(AdminUserCollection::class);
+
+        $dummyUserCollection->addFieldToFilter('username', 'dummy_username');
+        $dummyUser = $dummyUserCollection->getFirstItem();
+
+        $configPayload1 = ['a' => 1, 'b' => 2];
+        $configPayload2 = ['c' => 1, 'd' => 2];
+        $this->userConfigManager->addProviderConfig(
+            (int)$dummyUser->getId(),
+            'test_provider1',
+            $configPayload1
+        );
+        $this->userConfigManager->addProviderConfig(
+            (int)$dummyUser->getId(),
+            'test_provider2',
+            $configPayload2
+        );
+
+        $this->assertSame(
+            $configPayload1,
+            $this->userConfigManager->getProviderConfig((int)$dummyUser->getId(), 'test_provider1')
+        );
+        $this->assertSame(
+            $configPayload2,
+            $this->userConfigManager->getProviderConfig((int)$dummyUser->getId(), 'test_provider2')
+        );
+    }
+}
diff --git a/TwoFactorAuth/Test/Integration/UserConfigRequestManagerTest.php b/TwoFactorAuth/Test/Integration/UserConfigRequestManagerTest.php
new file mode 100644
index 00000000..4e576ac6
--- /dev/null
+++ b/TwoFactorAuth/Test/Integration/UserConfigRequestManagerTest.php
@@ -0,0 +1,174 @@
+<?php
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Test\Integration;
+
+use Magento\Framework\Acl\Builder;
+use Magento\TestFramework\Helper\Bootstrap;
+use Magento\TestFramework\Mail\Template\TransportBuilderMock;
+use Magento\User\Model\User;
+use Magento\TwoFactorAuth\Api\TfaInterface;
+use Magento\TwoFactorAuth\Api\UserConfigRequestManagerInterface;
+use Magento\TwoFactorAuth\Api\UserConfigTokenManagerInterface;
+use Magento\TwoFactorAuth\Model\Provider\Engine\Google;
+use PHPUnit\Framework\TestCase;
+
+/**
+ * @magentoDbIsolation enabled
+ */
+class UserConfigRequestManagerTest extends TestCase
+{
+    /**
+     * @var UserConfigRequestManagerInterface
+     */
+    private $manager;
+
+    /**
+     * @var User
+     */
+    private $user;
+
+    /**
+     * @var TfaInterface
+     */
+    private $tfa;
+
+    /**
+     * @var TransportBuilderMock
+     */
+    private $transportBuilderMock;
+
+    /**
+     * @var UserConfigTokenManagerInterface
+     */
+    private $tokenManager;
+    /**
+     * @var Builder
+     */
+    private $aclBuilder;
+
+    /**
+     * @inheritDoc
+     */
+    protected function setUp()
+    {
+        /** @var User $user */
+        $user = Bootstrap::getObjectManager()->create(User::class);
+        $user->loadByUsername(\Magento\TestFramework\Bootstrap::ADMIN_NAME);
+        $this->user = $user;
+        $this->tfa = Bootstrap::getObjectManager()->get(TfaInterface::class);
+        $this->transportBuilderMock = Bootstrap::getObjectManager()->get(TransportBuilderMock::class);
+        $this->tokenManager = Bootstrap::getObjectManager()->get(UserConfigTokenManagerInterface::class);
+        $this->aclBuilder = Bootstrap::getObjectManager()->get(Builder::class);
+
+        $this->manager = Bootstrap::getObjectManager()->get(UserConfigRequestManagerInterface::class);
+    }
+
+    /**
+     * Check that config is required when no providers are enabled for the app.
+     *
+     * @return void
+     */
+    public function testIsRequiredWithoutAppProviders(): void
+    {
+        $this->assertTrue($this->manager->isConfigurationRequiredFor((int)$this->user->getId()));
+    }
+
+    /**
+     * Check that config is required when personal provider config is empty.
+     *
+     * @return void
+     * @magentoConfigFixture default/twofactorauth/general/force_providers google
+     */
+    public function testIsRequiredWithoutUserProviders(): void
+    {
+        $this->assertTrue($this->manager->isConfigurationRequiredFor((int)$this->user->getId()));
+    }
+
+    /**
+     * Check that config is not required when both app and personal provider config is present.
+     *
+     * @return void
+     * @magentoConfigFixture default/twofactorauth/general/force_providers google
+     * @magentoDbIsolation enabled
+     */
+    public function testIsRequiredWithConfig(): void
+    {
+        $this->tfa->getProvider(Google::CODE)->activate((int)$this->user->getId());
+        $this->assertFalse($this->manager->isConfigurationRequiredFor((int)$this->user->getId()));
+    }
+
+    /**
+     * Check that app config request E-mail is NOT sent for a user that does not posses proper rights.
+     *
+     * @return void
+     * @expectedException \Magento\Framework\Exception\AuthorizationException
+     * @throws \Throwable
+     * @magentoAppArea adminhtml
+     * @magentoAppIsolation enabled
+     */
+    public function testFailAppConfigRequest(): void
+    {
+        $this->aclBuilder->getAcl()->deny(null, 'Magento_TwoFactorAuth::config');
+        $this->manager->sendConfigRequestTo($this->user);
+    }
+
+    /**
+     * Check that app config request E-mail is sent for a user that posseses proper rights.
+     *
+     * @return void
+     * @throws \Throwable
+     * @magentoAppArea adminhtml
+     */
+    public function testSendAppConfigRequest(): void
+    {
+        $this->manager->sendConfigRequestTo($this->user);
+
+        $this->assertNotEmpty($message = $this->transportBuilderMock->getSentMessage());
+        $messageHtml = $message->getBody()->getParts()[0]->getRawContent();
+        $this->assertContains(
+            'You are required to configure website-wide and personal Two-Factor Authorization in order to login to',
+            $messageHtml
+        );
+        $this->assertThat(
+            $messageHtml,
+            $this->matchesRegularExpression(
+                '/\<a\s+href\=[\'\"].+\/tfat\/[A-Za-z0-9+\/=]+.+[\'\"]\>/s'
+            )
+        );
+        preg_match('/\/tfat\/([^\/]+)/s', $messageHtml, $tokenMatches);
+        $this->assertNotEmpty($tokenMatches[1]);
+        $token = urldecode($tokenMatches[1]);
+        $this->assertTrue($this->tokenManager->isValidFor((int)$this->user->getId(), $token));
+    }
+
+    /**
+     * Check that personal 2FA config request E-mail is sent for users.
+     *
+     * @return void
+     * @throws \Throwable
+     * @magentoAppArea adminhtml
+     * @magentoConfigFixture default/twofactorauth/general/force_providers google
+     */
+    public function testSendUserConfigRequest(): void
+    {
+        $this->manager->sendConfigRequestTo($this->user);
+
+        $this->assertNotEmpty($message = $this->transportBuilderMock->getSentMessage());
+        $messageHtml = $message->getBody()->getParts()[0]->getRawContent();
+        $this->assertContains(
+            'You are required to configure personal Two-Factor Authorization in order to login to',
+            $messageHtml
+        );
+        $this->assertThat(
+            $messageHtml,
+            $this->matchesRegularExpression(
+                '/\<a\s+href\=[\'\"].+\/tfat\/[A-Za-z0-9+\/=]+.+[\'\"]\>/s'
+            )
+        );
+        preg_match('/\/tfat\/([^\/]+)/s', $messageHtml, $tokenMatches);
+        $this->assertNotEmpty($tokenMatches[1]);
+        $token = urldecode($tokenMatches[1]);
+        $this->assertTrue($this->tokenManager->isValidFor((int)$this->user->getId(), $token));
+    }
+}
diff --git a/TwoFactorAuth/Test/Integration/UserConfigTokenManagerTest.php b/TwoFactorAuth/Test/Integration/UserConfigTokenManagerTest.php
new file mode 100644
index 00000000..901b4594
--- /dev/null
+++ b/TwoFactorAuth/Test/Integration/UserConfigTokenManagerTest.php
@@ -0,0 +1,87 @@
+<?php
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Test\Integration;
+
+use Magento\Framework\Stdlib\DateTime\DateTime;
+use Magento\TwoFactorAuth\Api\UserConfigTokenManagerInterface;
+use PHPUnit\Framework\MockObject\MockObject;
+use PHPUnit\Framework\TestCase;
+use Magento\TestFramework\Helper\Bootstrap;
+use Magento\User\Model\UserFactory;
+
+/**
+ * @magentoDbIsolation enabled
+ */
+class UserConfigTokenManagerTest extends TestCase
+{
+    /**
+     * @var UserConfigTokenManagerInterface
+     */
+    private $tokenManager;
+
+    /**
+     * @var DateTime|MockObject
+     */
+    private $dateTimeMock;
+
+    /**
+     * @var UserFactory
+     */
+    private $userFactory;
+
+    /**
+     * @inheritDoc
+     */
+    protected function setUp()
+    {
+        $this->dateTimeMock = $this->getMockBuilder(DateTime::class)->disableOriginalConstructor()->getMock();
+        $this->userFactory = Bootstrap::getObjectManager()->get(UserFactory::class);
+        $this->tokenManager = Bootstrap::getObjectManager()->create(
+            UserConfigTokenManagerInterface::class,
+            ['dateTime' => $this->dateTimeMock]
+        );
+    }
+
+    /**
+     * Test that issued tokens are valid for specific users and can expire.
+     *
+     * @return void
+     * @magentoDataFixture Magento/User/_files/user_with_role.php
+     */
+    public function testToken(): void
+    {
+        $time = time();
+        $this->dateTimeMock->method('timestamp')
+            ->willReturnCallback(
+                function () use (&$time) {
+                    return $time;
+                }
+            );
+        /** @var \Magento\User\Model\User $user1 */
+        $user1 = $this->userFactory->create();
+        $user1->loadByUsername(\Magento\TestFramework\Bootstrap::ADMIN_NAME);
+        /** @var \Magento\User\Model\User $user2 */
+        $user2 = $this->userFactory->create();
+        $user2->loadByUsername('adminUser');
+        $this->assertNotEmpty($user1->getId());
+        $this->assertNotEmpty($user2->getId());
+
+        //Checking that tokens for different users are different even when issued at the same time.
+        $token1 = $this->tokenManager->issueFor((int)$user1->getId());
+        $token2 = $this->tokenManager->issueFor((int)$user2->getId());
+        $this->assertNotEquals($token1, $token2);
+
+        //Checking that valid tokens are only valid for corresponding users.
+        $time += 5;
+        $this->assertTrue($this->tokenManager->isValidFor((int)$user1->getId(), $token1));
+        $this->assertTrue($this->tokenManager->isValidFor((int)$user2->getId(), $token2));
+        $this->assertFalse($this->tokenManager->isValidFor((int)$user1->getId(), $token2));
+        $this->assertFalse($this->tokenManager->isValidFor((int)$user2->getId(), $token1));
+
+        //Checking that tokens do expire
+        $time += 3601;
+        $this->assertFalse($this->tokenManager->isValidFor((int)$user1->getId(), $token1));
+        $this->assertFalse($this->tokenManager->isValidFor((int)$user2->getId(), $token2));
+    }
+}
diff --git a/TwoFactorAuth/Test/Unit/Model/Config/Backend/Duo/ApiHostnameTest.php b/TwoFactorAuth/Test/Unit/Model/Config/Backend/Duo/ApiHostnameTest.php
new file mode 100644
index 00000000..df640d54
--- /dev/null
+++ b/TwoFactorAuth/Test/Unit/Model/Config/Backend/Duo/ApiHostnameTest.php
@@ -0,0 +1,57 @@
+<?php
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Test\Unit\Model\Config\Backend;
+
+use Magento\Framework\Exception\ValidatorException;
+use Magento\Framework\TestFramework\Unit\Helper\ObjectManager;
+use Magento\TwoFactorAuth\Model\Config\Backend\Duo\ApiHostname;
+use PHPUnit\Framework\TestCase;
+
+class ApiHostnameTest extends TestCase
+{
+    /**
+     * @var ApiHostname
+     */
+    private $model;
+
+    /**
+     * @inheritDoc
+     */
+    protected function setUp()
+    {
+        $objectManager = new ObjectManager($this);
+        $this->model = $objectManager->getObject(ApiHostname::class);
+    }
+
+    /**
+     * @dataProvider valuesDataProvider
+     */
+    public function testBefore($value, $isValid): void
+    {
+        if (!$isValid) {
+            $this->expectException(ValidatorException::class);
+        }
+        $this->model->setValue($value);
+        $this->model->beforeSave();
+    }
+
+    public function valuesDataProvider()
+    {
+        return [
+            ['', true],
+            ['foo', false],
+            ['123', false],
+            ['http://google.com', false],
+            ['http://duosecurity.com', false],
+            ['http://foo.duosecurity.com', false],
+            ['http://foo.duosecurity.com', false],
+            ['foo.duosecurity.com', true],
+            ['abc123-123dc.duosecurity.com', true],
+            ['abc123-123dc.duosecurity.com.foo', false],
+            ['abc123/123dc.duosecurity.com.foo', false],
+            ['abc123/123dc.duosecurity.com/foo', false],
+            ['abc123-123dc.duosecurity.com/foo', false],
+        ];
+    }
+}
diff --git a/TwoFactorAuth/Test/Unit/Model/Config/Backend/ForceProvidersTest.php b/TwoFactorAuth/Test/Unit/Model/Config/Backend/ForceProvidersTest.php
new file mode 100644
index 00000000..467a6391
--- /dev/null
+++ b/TwoFactorAuth/Test/Unit/Model/Config/Backend/ForceProvidersTest.php
@@ -0,0 +1,75 @@
+<?php
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Test\Unit\Model\Config\Backend;
+
+use Magento\Framework\TestFramework\Unit\Helper\ObjectManager;
+use Magento\TwoFactorAuth\Api\ProviderInterface;
+use Magento\TwoFactorAuth\Api\TfaInterface;
+use Magento\TwoFactorAuth\Model\Config\Backend\ForceProviders;
+use PHPUnit\Framework\MockObject\MockObject;
+use PHPUnit\Framework\TestCase;
+
+class ForceProvidersTest extends TestCase
+{
+    /**
+     * @var ForceProviders
+     */
+    private $model;
+
+    /**
+     * @var TfaInterface|MockObject
+     */
+    private $tfa;
+
+    /**
+     * @inheritDoc
+     */
+    protected function setUp()
+    {
+        $objectManager = new ObjectManager($this);
+        $this->tfa = $this->createMock(TfaInterface::class);
+
+        $this->model = $objectManager->getObject(
+            ForceProviders::class,
+            [
+                'tfa' => $this->tfa
+            ]
+        );
+    }
+
+    /**
+     * Check that beforeSave validates values.
+     *
+     * @return void
+     * @expectedException \Magento\Framework\Exception\ValidatorException
+     */
+    public function testBeforeSaveInvalid(): void
+    {
+        $this->model->setValue('');
+        $this->model->beforeSave();
+    }
+
+    /**
+     * Check that beforeSave validates values.
+     *
+     * @return void
+     */
+    public function testBeforeSaveValid(): void
+    {
+        $provider1 = $this->createMock(ProviderInterface::class);
+        $provider1->method('getCode')
+            ->willReturn('provider1');
+        $provider2 = $this->createMock(ProviderInterface::class);
+        $provider2->method('getCode')
+            ->willReturn('provider2');
+        $provider3 = $this->createMock(ProviderInterface::class);
+        $provider3->method('getCode')
+            ->willReturn('provider3');
+        $this->tfa->method('getAllProviders')
+            ->willReturn([$provider1, $provider2, $provider3]);
+        $this->model->setValue(['provider1', 'ignoreme', 'provider2']);
+        $this->model->beforeSave();
+        self::assertSame(['provider1', 'provider2'], $this->model->getValue());
+    }
+}
diff --git a/TwoFactorAuth/Test/Unit/Model/Provider/Engine/AuthyTest.php b/TwoFactorAuth/Test/Unit/Model/Provider/Engine/AuthyTest.php
new file mode 100644
index 00000000..f36e6bf8
--- /dev/null
+++ b/TwoFactorAuth/Test/Unit/Model/Provider/Engine/AuthyTest.php
@@ -0,0 +1,67 @@
+<?php
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Test\Unit\Model\Provider\Engine;
+
+use Magento\TwoFactorAuth\Model\Provider\Engine\Authy;
+use PHPUnit\Framework\MockObject\MockObject;
+use PHPUnit\Framework\TestCase;
+use Magento\Framework\TestFramework\Unit\Helper\ObjectManager;
+
+class AuthyTest extends TestCase
+{
+    /**
+     * @var Authy
+     */
+    private $model;
+
+    /**
+     * @var MockObject|Authy\Service
+     */
+    private $serviceMock;
+
+    /**
+     * @inheritDoc
+     */
+    protected function setUp()
+    {
+        $objectManager = new ObjectManager($this);
+        $this->serviceMock = $this->getMockBuilder(Authy\Service::class)->disableOriginalConstructor()->getMock();
+
+        $this->model = $objectManager->getObject(Authy::class, ['service' => $this->serviceMock]);
+    }
+
+    /**
+     * Enabled test dataset.
+     *
+     * @return array
+     */
+    public function getIsEnabledTestDataSet(): array
+    {
+        return [
+            'api key present' => [
+                'api-key',
+                true
+            ],
+            'api key not configured' => [
+                null,
+                false
+            ]
+        ];
+    }
+
+    /**
+     * Check that the provider is available based on configuration.
+     *
+     * @param string|null $apiKey
+     * @param bool $expected
+     * @return void
+     * @dataProvider getIsEnabledTestDataSet
+     */
+    public function testIsEnabled(?string $apiKey, bool $expected): void
+    {
+        $this->serviceMock->method('getApiKey')->willReturn($apiKey);
+
+        $this->assertEquals($expected, $this->model->isEnabled());
+    }
+}
diff --git a/TwoFactorAuth/Test/Unit/Model/Provider/Engine/DuoSecurityTest.php b/TwoFactorAuth/Test/Unit/Model/Provider/Engine/DuoSecurityTest.php
new file mode 100644
index 00000000..6eef7bad
--- /dev/null
+++ b/TwoFactorAuth/Test/Unit/Model/Provider/Engine/DuoSecurityTest.php
@@ -0,0 +1,117 @@
+<?php
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Test\Unit\Model\Provider\Engine;
+
+use Magento\Framework\App\Config\ScopeConfigInterface;
+use Magento\TwoFactorAuth\Model\Provider\Engine\DuoSecurity;
+use PHPUnit\Framework\MockObject\MockObject;
+use PHPUnit\Framework\TestCase;
+use Magento\Framework\TestFramework\Unit\Helper\ObjectManager;
+
+class DuoSecurityTest extends TestCase
+{
+    /**
+     * @var DuoSecurity
+     */
+    private $model;
+
+    /**
+     * @var ScopeConfigInterface|MockObject
+     */
+    private $configMock;
+
+    /**
+     * @inheritDoc
+     */
+    protected function setUp()
+    {
+        $objectManager = new ObjectManager($this);
+        $this->configMock = $this->getMockBuilder(ScopeConfigInterface::class)->disableOriginalConstructor()->getMock();
+
+        $this->model = $objectManager->getObject(DuoSecurity::class, ['scopeConfig' => $this->configMock]);
+    }
+
+    /**
+     * Enabled test dataset.
+     *
+     * @return array
+     */
+    public function getIsEnabledTestDataSet(): array
+    {
+        return [
+            [
+                'value',
+                'value',
+                'value',
+                'value',
+                true
+            ],
+            [
+                null,
+                null,
+                null,
+                null,
+                false
+            ],
+            [
+                'value',
+                null,
+                null,
+                null,
+                false
+            ],
+            [
+                null,
+                'value',
+                null,
+                null,
+                false
+            ],
+            [
+                null,
+                null,
+                'value',
+                null,
+                false
+            ],
+            [
+                null,
+                null,
+                null,
+                'value',
+                false
+            ]
+        ];
+    }
+
+    /**
+     * Check that the provider is available based on configuration.
+     *
+     * @param string|null $apiHostname
+     * @param string|null $appKey
+     * @param string|null $secretKey
+     * @param string|null $integrationKey
+     * @param bool $expected
+     * @return void
+     * @dataProvider getIsEnabledTestDataSet
+     */
+    public function testIsEnabled(
+        ?string $apiHostname,
+        ?string $appKey,
+        ?string $secretKey,
+        ?string $integrationKey,
+        bool $expected
+    ): void {
+        $this->configMock->method('getValue')->willReturnMap(
+            [
+                [DuoSecurity::XML_PATH_API_HOSTNAME, 'default', null, $apiHostname],
+                [DuoSecurity::XML_PATH_APPLICATION_KEY, 'default', null, $appKey],
+                [DuoSecurity::XML_PATH_SECRET_KEY, 'default', null, $secretKey],
+                [DuoSecurity::XML_PATH_INTEGRATION_KEY, 'default', null, $integrationKey]
+            ]
+        );
+
+        $this->assertEquals($expected, $this->model->isEnabled());
+    }
+}
diff --git a/TwoFactorAuth/Test/Unit/Model/Provider/Engine/GoogleTest.php b/TwoFactorAuth/Test/Unit/Model/Provider/Engine/GoogleTest.php
new file mode 100644
index 00000000..9f45e801
--- /dev/null
+++ b/TwoFactorAuth/Test/Unit/Model/Provider/Engine/GoogleTest.php
@@ -0,0 +1,35 @@
+<?php
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Test\Unit\Model\Provider\Engine;
+
+use Magento\TwoFactorAuth\Model\Provider\Engine\Google;
+use PHPUnit\Framework\TestCase;
+use Magento\Framework\TestFramework\Unit\Helper\ObjectManager;
+
+class GoogleTest extends TestCase
+{
+    /**
+     * @var Google
+     */
+    private $model;
+
+    /**
+     * @inheritDoc
+     */
+    protected function setUp()
+    {
+        $objectManager = new ObjectManager($this);
+
+        $this->model = $objectManager->getObject(Google::class);
+    }
+
+    /**
+     * Check that the provider is available based on configuration.
+     *
+     * @return void
+     */
+    public function testIsEnabled(): void {
+        $this->assertTrue($this->model->isEnabled());
+    }
+}
diff --git a/TwoFactorAuth/Test/Unit/Model/Provider/Engine/U2fKeyTest.php b/TwoFactorAuth/Test/Unit/Model/Provider/Engine/U2fKeyTest.php
new file mode 100644
index 00000000..c7e6b18c
--- /dev/null
+++ b/TwoFactorAuth/Test/Unit/Model/Provider/Engine/U2fKeyTest.php
@@ -0,0 +1,35 @@
+<?php
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Test\Unit\Model\Provider\Engine;
+
+use Magento\TwoFactorAuth\Model\Provider\Engine\U2fKey;
+use PHPUnit\Framework\TestCase;
+use Magento\Framework\TestFramework\Unit\Helper\ObjectManager;
+
+class U2fKeyTest extends TestCase
+{
+    /**
+     * @var U2fKey
+     */
+    private $model;
+
+    /**
+     * @inheritDoc
+     */
+    protected function setUp()
+    {
+        $objectManager = new ObjectManager($this);
+
+        $this->model = $objectManager->getObject(U2fKey::class);
+    }
+
+    /**
+     * Check that the provider is available based on configuration.
+     *
+     * @return void
+     */
+    public function testIsEnabled(): void {
+        $this->assertTrue($this->model->isEnabled());
+    }
+}
diff --git a/TwoFactorAuth/Test/Unit/Model/TfaTest.php b/TwoFactorAuth/Test/Unit/Model/TfaTest.php
new file mode 100644
index 00000000..46ae8050
--- /dev/null
+++ b/TwoFactorAuth/Test/Unit/Model/TfaTest.php
@@ -0,0 +1,226 @@
+<?php
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Test\Unit\Model;
+
+use Magento\Framework\App\Config\ScopeConfigInterface;
+use Magento\Framework\Exception\NoSuchEntityException;
+use Magento\Framework\TestFramework\Unit\Helper\ObjectManager;
+use Magento\TwoFactorAuth\Api\ProviderInterface;
+use Magento\TwoFactorAuth\Api\ProviderPoolInterface;
+use Magento\TwoFactorAuth\Model\Tfa;
+use PHPUnit\Framework\MockObject\MockObject;
+use PHPUnit\Framework\TestCase;
+
+class TfaTest extends TestCase
+{
+    /**
+     * @var Tfa
+     */
+    private $model;
+
+    /**
+     * @var ProviderPoolInterface|MockObject
+     */
+    private $pool;
+
+    /**
+     * @var ProviderInterface[]|MockObject[]
+     */
+    private $providersMockList;
+
+    /**
+     * @var ScopeConfigInterface|MockObject
+     */
+    private $configMock;
+
+    /**
+     * @inheritDoc
+     */
+    protected function setUp()
+    {
+        $objectManager = new ObjectManager($this);
+        $this->pool = $this->getMockForAbstractClass(ProviderPoolInterface::class);
+        $this->pool->method('getProviders')
+            ->willReturnCallback(
+                function (): array {
+                    return $this->providersMockList;
+                }
+            );
+        $this->pool->method('getProviderByCode')
+            ->willReturnCallback(
+                function (string $code): ProviderInterface {
+                    if (array_key_exists($code, $this->providersMockList)) {
+                        return $this->providersMockList[$code];
+                    }
+                    throw new NoSuchEntityException();
+                }
+            );
+        $this->configMock = $this->getMockForAbstractClass(ScopeConfigInterface::class);
+
+        $this->model = $objectManager->getObject(
+            Tfa::class,
+            ['providerPool' => $this->pool, 'scopeConfig' => $this->configMock]
+        );
+    }
+
+    /**
+     * Define existing providers.
+     *
+     * @param array $providersData Keys - codes, values - {enabled: bool}.
+     * @return void
+     */
+    private function defineProvidersList(array $providersData): void
+    {
+        $providers = [];
+        foreach ($providersData as $code => $providerData) {
+            $provider = $this->getMockForAbstractClass(ProviderInterface::class);
+            $provider->method('getCode')->willReturn($code);
+            $provider->method('isEnabled')->willReturn($providerData['enabled']);
+            $providers[$code] = $provider;
+        }
+
+        $this->providersMockList = $providers;
+    }
+
+    /**
+     * Extract codes from a providers list.
+     *
+     * @param ProviderInterface[] $providers
+     * @return string[]
+     */
+    private function extractProviderCodes(array $providers): array
+    {
+        return array_map(
+            function (ProviderInterface $provider): string {
+                return $provider->getCode();
+            },
+            $providers
+        );
+    }
+
+    /**
+     * Check that enabled providers list updates when the pool or providers update.
+     *
+     * @return void
+     */
+    public function testAllEnabledProvidersUpdates(): void
+    {
+        $providersData = ['provider1' => ['enabled' => true], 'provider2' => ['enabled' => true]];
+        $this->defineProvidersList($providersData);
+        $this->assertEquals(
+            ['provider1', 'provider2'],
+            $this->extractProviderCodes($this->model->getAllEnabledProviders())
+        );
+
+        $providersData = ['provider1' => ['enabled' => true], 'provider2' => ['enabled' => false]];
+        $this->defineProvidersList($providersData);
+        $this->assertEquals(
+            ['provider1'],
+            $this->extractProviderCodes($this->model->getAllEnabledProviders())
+        );
+
+        $providersData = [
+            'provider1' => ['enabled' => true],
+            'provider2' => ['enabled' => true],
+            'provider3' => ['enabled' => true]
+        ];
+        $this->defineProvidersList($providersData);
+        $this->assertEquals(
+            ['provider1', 'provider2', 'provider3'],
+            $this->extractProviderCodes($this->model->getAllEnabledProviders())
+        );
+    }
+
+    /**
+     * Data set for the forcedProviders test.
+     *
+     * @return array
+     */
+    public function getForcedProvidersDataSet(): array
+    {
+        return [
+            'not defined' => [
+                null,
+                ['provider1' => ['enabled' => true]],
+                []
+            ],
+            'not defined string' => [
+                '',
+                ['provider1' => ['enabled' => true]],
+                []
+            ],
+            'not defined array' => [
+                [],
+                ['provider1' => ['enabled' => true]],
+                []
+            ],
+            'valid array' => [
+                ['provider1'],
+                ['provider1' => ['enabled' => true], 'provider2' => ['enabled' => true]],
+                ['provider1']
+            ],
+            'valid string' => [
+                'provider1, provider2',
+                ['provider1' => ['enabled' => true], 'provider2' => ['enabled' => true]],
+                ['provider1', 'provider2']
+            ],
+            'invalid code' => [
+                'nonExistingProvider',
+                ['provider1' => ['enabled' => true], 'provider2' => ['enabled' => true]],
+                []
+            ],
+            'disabledProvider' => [
+                'provider1',
+                ['provider1' => ['enabled' => false], 'provider2' => ['enabled' => true]],
+                []
+            ]
+        ];
+    }
+
+    /**
+     * Test getForcedProviders method.
+     *
+     * @param string|null|array $configValue
+     * @param array $providersList
+     * @param array $expected
+     * @return void
+     * @dataProvider getForcedProvidersDataSet
+     */
+    public function testGetForcedProviders($configValue, array $providersList, $expected): void
+    {
+        $this->configMock->method('getValue')->willReturn($configValue);
+        $this->defineProvidersList($providersList);
+
+        $result = $this->model->getForcedProviders();
+
+        $this->assertEquals($expected, $this->extractProviderCodes($result));
+    }
+
+    /**
+     * Check that user providers = forced providers.
+     *
+     * @return void
+     */
+    public function testGetUserProviders(): void
+    {
+        $this->configMock->method('getValue')->willReturnReference($configValue);
+        $this->defineProvidersList(['provider1' => ['enabled' => true]]);
+
+        $configValue = 'provider1';
+        $this->assertEquals(['provider1'], $this->extractProviderCodes($this->model->getUserProviders(1)));
+
+        $configValue = '';
+        $this->assertEmpty($this->model->getUserProviders(1));
+    }
+
+    /**
+     * Verify that 2FA is always enabled
+     *
+     * @return void
+     */
+    public function testIsEnabled(): void
+    {
+        $this->assertTrue($this->model->isEnabled());
+    }
+}
diff --git a/TwoFactorAuth/Test/Unit/Model/UserConfig/HtmlAreaTokenVerifierTest.php b/TwoFactorAuth/Test/Unit/Model/UserConfig/HtmlAreaTokenVerifierTest.php
new file mode 100644
index 00000000..501e60a5
--- /dev/null
+++ b/TwoFactorAuth/Test/Unit/Model/UserConfig/HtmlAreaTokenVerifierTest.php
@@ -0,0 +1,200 @@
+<?php
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Test\Unit\Model\UserConfig;
+
+use Magento\Backend\Model\Auth\Session;
+use Magento\Framework\App\RequestInterface;
+use Magento\Framework\Stdlib\Cookie\CookieMetadataFactory;
+use Magento\Framework\Stdlib\Cookie\SensitiveCookieMetadata;
+use Magento\Framework\Stdlib\CookieManagerInterface;
+use Magento\Framework\TestFramework\Unit\Helper\ObjectManager;
+use Magento\User\Model\User;
+use Magento\TwoFactorAuth\Api\UserConfigTokenManagerInterface;
+use Magento\TwoFactorAuth\Model\UserConfig\HtmlAreaTokenVerifier;
+use PHPUnit\Framework\MockObject\MockObject;
+use Magento\Backend\Model\Session as SessionManager;
+use PHPUnit\Framework\TestCase;
+
+class HtmlAreaTokenVerifierTest extends TestCase
+{
+    /**
+     * @var HtmlAreaTokenVerifier
+     */
+    private $model;
+
+    /**
+     * @var RequestInterface|MockObject
+     */
+    private $requestMock;
+
+    /**
+     * @var UserConfigTokenManagerInterface|MockObject
+     */
+    private $tokenManagerMock;
+
+    /**
+     * @var CookieManagerInterface|MockObject
+     */
+    private $cookiesMock;
+
+    /**
+     * @var CookieMetadataFactory|MockObject
+     */
+    private $cookiesMetaFactoryMock;
+
+    /**
+     * @var Session|MockObject
+     */
+    private $sessionMock;
+
+    /**
+     * @var SessionManager|MockObject
+     */
+    private $sessionManagerMock;
+
+    /**
+     * @inheritDoc
+     */
+    protected function setUp()
+    {
+        $objectManager = new ObjectManager($this);
+        $this->requestMock = $this->getMockForAbstractClass(RequestInterface::class);
+        $this->tokenManagerMock = $this->getMockForAbstractClass(UserConfigTokenManagerInterface::class);
+        $this->cookiesMock = $this->getMockForAbstractClass(CookieManagerInterface::class);
+        $this->cookiesMetaFactoryMock = $this->getMockBuilder(CookieMetadataFactory::class)
+            ->disableOriginalConstructor()
+            ->getMock();
+        $this->sessionMock = $this->getMockBuilder(Session::class)
+            ->disableOriginalConstructor()
+            ->getMock();
+        $this->sessionManagerMock = $this->getMockBuilder(SessionManager::class)
+            ->disableOriginalConstructor()
+            ->getMock();
+
+        $this->model = $objectManager->getObject(
+            HtmlAreaTokenVerifier::class,
+            [
+                'request' => $this->requestMock,
+                'tokenManager' => $this->tokenManagerMock,
+                'cookies' => $this->cookiesMock,
+                'cookieMetadataFactory' => $this->cookiesMetaFactoryMock,
+                'session' => $this->sessionMock,
+                'sessionManager' => $this->sessionManagerMock
+            ]
+        );
+    }
+
+    /**
+     * Request/cookies data sets.
+     *
+     * @return array
+     */
+    public function getTokenRequestData(): array
+    {
+        return [
+            'token in query' => [
+                true,
+                'token',
+                null,
+                true,
+                true,
+                'token'
+            ],
+            'token in cookies' => [
+                true,
+                null,
+                'token',
+                true,
+                false,
+                'token'
+            ],
+            'token is absent' => [
+                true,
+                null,
+                null,
+                false,
+                false,
+                null
+            ],
+            'invalid token' => [
+                true,
+                'token',
+                null,
+                false,
+                false,
+                null
+            ],
+            'invalid token from cookies' => [
+                true,
+                null,
+                'token',
+                false,
+                false,
+                null
+            ],
+            'token in both' => [
+                true,
+                'token',
+                'token',
+                true,
+                false,
+                'token'
+            ],
+            'no user' => [
+                false,
+                'token',
+                'token',
+                true,
+                false,
+                null
+            ]
+        ];
+    }
+
+    /**
+     * Test "readConfigToken" method with different variation of request/cookie parameters provided.
+     *
+     * @param bool $userPresent
+     * @param string|null $fromRequest
+     * @param string|null $fromCookies
+     * @param bool $isValid
+     * @param bool $cookieSet
+     * @param string|null $expected
+     * @return void
+     * @dataProvider getTokenRequestData
+     */
+    public function testReadConfigToken(
+        bool $userPresent,
+        ?string $fromRequest,
+        ?string $fromCookies,
+        bool $isValid,
+        bool $cookieSet,
+        ?string $expected
+    ): void {
+        $this->sessionMock->method('__call')
+            ->willReturn(
+                $userPresent ? $this->getMockBuilder(User::class)->disableOriginalConstructor()->getMock() : null
+            );
+        $this->requestMock->method('getParam')->with('tfat')->willReturn($fromRequest);
+        $this->cookiesMock->method('getCookie')->with('tfa-ct')->willReturn($fromCookies);
+        $this->tokenManagerMock->method('isValidFor')->willReturn($isValid);
+        $this->sessionManagerMock->method('getCookiePath')->willReturn('admin_path');
+        $this->cookiesMetaFactoryMock->method('createSensitiveCookieMetadata')
+            ->willReturn(
+                $metaMock = $this->getMockBuilder(SensitiveCookieMetadata::class)
+                    ->disableOriginalConstructor()
+                    ->getMock()
+            );
+        if ($cookieSet) {
+            $metaMock->expects($this->atLeastOnce())->method('setPath')->with('admin_path')->willReturn($metaMock);
+            $this->cookiesMock->expects($this->once())
+                ->method('setSensitiveCookie')
+                ->with('tfa-ct', $fromRequest, $metaMock);
+        } else {
+            $this->cookiesMock->expects($this->never())->method('setSensitiveCookie');
+        }
+
+        $this->assertEquals($expected, $this->model->readConfigToken());
+    }
+}
diff --git a/TwoFactorAuth/TestFramework/ControllerActionPredispatch.php b/TwoFactorAuth/TestFramework/ControllerActionPredispatch.php
new file mode 100644
index 00000000..dc4353e4
--- /dev/null
+++ b/TwoFactorAuth/TestFramework/ControllerActionPredispatch.php
@@ -0,0 +1,32 @@
+<?php
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\TestFramework;
+
+use Magento\Backend\App\AbstractAction;
+use Magento\Framework\Event\Observer;
+use Magento\TwoFactorAuth\Observer\ControllerActionPredispatch as ParentObserver;
+
+/**
+ * Observer that allows integration controller tests that are not aware of 2FA to run.
+ */
+class ControllerActionPredispatch extends ParentObserver
+{
+    /**
+     * @inheritDoc
+     */
+    public function execute(Observer $observer)
+    {
+        /** @var $controllerAction AbstractAction */
+        $controllerAction = $observer->getEvent()->getData('controller_action');
+        if (class_exists('Magento\TestFramework\Request')
+            && $controllerAction->getRequest() instanceof \Magento\TestFramework\Request
+            && !$controllerAction->getRequest()->getParam('tfa_enabled')
+        ) {
+            //Hack that allows integration controller tests that are not aware of 2FA to run
+            return;
+        }
+
+        parent::execute($observer);
+    }
+}
diff --git a/TwoFactorAuth/TestFramework/TestCase/AbstractBackendController.php b/TwoFactorAuth/TestFramework/TestCase/AbstractBackendController.php
new file mode 100644
index 00000000..05a91a43
--- /dev/null
+++ b/TwoFactorAuth/TestFramework/TestCase/AbstractBackendController.php
@@ -0,0 +1,63 @@
+<?php
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\TestFramework\TestCase;
+
+use Magento\TestFramework\TestCase\AbstractBackendController as Base;
+
+/**
+ * Adds the ability to perform tests without anonymous user.
+ */
+class AbstractBackendController extends Base
+{
+    /**
+     * @inheritDoc
+     *
+     * @throws \Magento\Framework\Exception\AuthenticationException
+     */
+    protected function setUp()
+    {
+        parent::setUp();
+
+        $this->_objectManager->get(\Magento\Backend\Model\UrlInterface::class)->turnOffSecretKey();
+        $this->_auth = $this->_objectManager->get(\Magento\Backend\Model\Auth::class);
+        $this->_session = $this->_auth->getAuthStorage();
+        $this->login();
+    }
+
+    /**
+     * Perform logout
+     *
+     * @return void
+     */
+    protected function logout(): void
+    {
+        $this->_auth->getAuthStorage()->destroy(['send_expire_cookie' => false]);
+    }
+
+    /**
+     * Login as default admin user.
+     *
+     * @return void
+     */
+    protected function login(): void
+    {
+        $credentials = $this->_getAdminCredentials();
+        $this->_auth->login($credentials['user'], $credentials['password']);
+        /** @var \Magento\Security\Model\Plugin\Auth $authPlugin */
+        $authPlugin = $this->_objectManager->get(\Magento\Security\Model\Plugin\Auth::class);
+        $authPlugin->afterLogin($this->_auth);
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function dispatch($uri)
+    {
+        if ($this->getRequest()->getParam('tfa_enabled') === null) {
+            $this->getRequest()->setParam('tfa_enabled', true);
+        }
+
+        parent::dispatch($uri);
+    }
+}
diff --git a/TwoFactorAuth/TestFramework/TestCase/AbstractConfigureBackendController.php b/TwoFactorAuth/TestFramework/TestCase/AbstractConfigureBackendController.php
new file mode 100644
index 00000000..040f58b0
--- /dev/null
+++ b/TwoFactorAuth/TestFramework/TestCase/AbstractConfigureBackendController.php
@@ -0,0 +1,72 @@
+<?php
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\TestFramework\TestCase;
+
+use Magento\TestFramework\Helper\Bootstrap;
+use Magento\TwoFactorAuth\Api\UserConfigTokenManagerInterface;
+
+/**
+ * Base for 2FA configuration related controller tests.
+ */
+class AbstractConfigureBackendController extends AbstractBackendController
+{
+    /**
+     * @inheritDoc
+     */
+    protected $expectedNoAccessResponseCode = 302;
+
+    /**
+     * @inheritDoc
+     */
+    protected $resource = 'Magento_Backend::admin';
+
+    /**
+     * @var UserConfigTokenManagerInterface
+     */
+    protected $tokenManager;
+
+    /**
+     * @inheritDoc
+     */
+    protected function setUp()
+    {
+        parent::setUp();
+
+        $this->tokenManager = Bootstrap::getObjectManager()->get(UserConfigTokenManagerInterface::class);
+    }
+
+    /**
+     * Verify that even with ACL an admin user needs token to access the page.
+     *
+     * @return void
+     */
+    public function testTokenAccess(): void
+    {
+        $this->getRequest()->setMethod($this->httpMethod);
+        $this->dispatch($this->uri);
+        $this->assertRedirect($this->stringContains('login'));
+    }
+
+    /**
+     * Check that a user with proper token and rights can access the page.
+     */
+    public function testAclHasAccess()
+    {
+        $this->getRequest()
+            ->setParam('tfat', $this->tokenManager->issueFor((int)$this->_session->getUser()->getId()));
+
+        parent::testAclHasAccess();
+    }
+
+    /**
+     * Check that a user with proper token but without rights cannot access the page.
+     */
+    public function testAclNoAccess()
+    {
+        $this->getRequest()
+            ->setParam('tfat', $this->tokenManager->issueFor((int)$this->_session->getUser()->getId()));
+
+        parent::testAclNoAccess();
+    }
+}
diff --git a/TwoFactorAuth/Ui/Component/Form/User/DataProvider.php b/TwoFactorAuth/Ui/Component/Form/User/DataProvider.php
new file mode 100644
index 00000000..a43cfaa5
--- /dev/null
+++ b/TwoFactorAuth/Ui/Component/Form/User/DataProvider.php
@@ -0,0 +1,158 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\TwoFactorAuth\Ui\Component\Form\User;
+
+use Magento\Framework\UrlInterface;
+use Magento\Ui\DataProvider\AbstractDataProvider;
+use Magento\User\Model\ResourceModel\User\CollectionFactory;
+use Magento\User\Model\User;
+use Magento\TwoFactorAuth\Api\TfaInterface;
+use Magento\TwoFactorAuth\Api\UserConfigManagerInterface;
+use Magento\TwoFactorAuth\Model\Config\Source\EnabledProvider;
+
+class DataProvider extends AbstractDataProvider
+{
+    private $loadedData = null;
+
+    /**
+     * @var TfaInterface
+     */
+    private $tfa;
+
+    /**
+     * @var EnabledProvider
+     */
+    private $enabledProvider;
+
+    /**
+     * @var UserConfigManagerInterface
+     */
+    private $userConfigManager;
+
+    /**
+     * @var UrlInterface
+     */
+    private $url;
+
+    /**
+     * DataProvider constructor.
+     * @param CollectionFactory $collectionFactory
+     * @param EnabledProvider $enabledProvider
+     * @param UserConfigManagerInterface $userConfigManager
+     * @param UrlInterface $url
+     * @param TfaInterface $tfa
+     * @param string $name
+     * @param string $primaryFieldName
+     * @param string $requestFieldName
+     * @param array $meta
+     * @param array $data
+     * @SuppressWarnings("PHPMD.ExcessiveParameterList")
+     */
+    public function __construct(
+        CollectionFactory $collectionFactory,
+        EnabledProvider $enabledProvider,
+        UserConfigManagerInterface $userConfigManager,
+        UrlInterface $url,
+        TfaInterface $tfa,
+        $name,
+        $primaryFieldName,
+        $requestFieldName,
+        array $meta = [],
+        array $data = []
+    ) {
+        parent::__construct($name, $primaryFieldName, $requestFieldName, $meta, $data);
+        $this->collection = $collectionFactory->create();
+        $this->tfa = $tfa;
+        $this->enabledProvider = $enabledProvider;
+        $this->userConfigManager = $userConfigManager;
+        $this->url = $url;
+    }
+
+    /**
+     * Get a list of forced providers
+     * @return array
+     */
+    private function getForcedProviders()
+    {
+        $names = [];
+        $forcedProviders = $this->tfa->getForcedProviders();
+        if (!empty($forcedProviders)) {
+            foreach ($forcedProviders as $forcedProvider) {
+                $names[] = $forcedProvider->getName();
+            }
+        }
+
+        return $names;
+    }
+
+    /**
+     * Get reset provider urls
+     * @param User $user
+     * @return array
+     */
+    private function getResetProviderUrls(User $user)
+    {
+        $providers = $this->tfa->getAllEnabledProviders();
+
+        $resetProviders = [];
+        foreach ($providers as $provider) {
+            if ($provider->isConfigured((int) $user->getId()) && $provider->isResetAllowed()) {
+                $resetProviders[] = [
+                    'value' => $provider->getCode(),
+                    'label' => __('Reset %1', $provider->getName()),
+                    'url' => $this->url->getUrl('tfa/tfa/reset', [
+                        'id' => (int) $user->getId(),
+                        'provider' => $provider->getCode(),
+                    ]),
+                ];
+            }
+        }
+
+        return $resetProviders;
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function getMeta()
+    {
+        $meta = parent::getMeta();
+
+        $meta['base_fieldset']['children']['tfa_providers']['arguments']['data']['config']['forced_providers'] =
+            $this->getForcedProviders();
+        $meta['base_fieldset']['children']['tfa_providers']['arguments']['data']['config']['enabled_providers'] =
+            $this->enabledProvider->toOptionArray();
+
+        return $meta;
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function getData()
+    {
+        if ($this->loadedData === null) {
+            $this->loadedData = [];
+            $items = $this->collection->getItems();
+
+            /** @var User $user */
+            foreach ($items as $user) {
+                $providerCodes = $this->userConfigManager->getProvidersCodes((int) $user->getId());
+                $resetProviders = $this->getResetProviderUrls($user);
+
+                $data = [
+                    'reset_providers' => $resetProviders,
+                    'tfa_providers' => $providerCodes,
+                ];
+                $this->loadedData[(int) $user->getId()] = $data;
+            }
+        }
+
+        return $this->loadedData;
+    }
+}
diff --git a/TwoFactorAuth/composer.json b/TwoFactorAuth/composer.json
new file mode 100644
index 00000000..366dcff4
--- /dev/null
+++ b/TwoFactorAuth/composer.json
@@ -0,0 +1,40 @@
+{
+    "name": "magento/module-two-factor-auth",
+    "version": "5.0.0",
+    "description": "Two Factor Authentication module for Magento2",
+    "require": {
+        "php": "~7.1.3||~7.2.0||~7.3.0",
+        "magento/magento-composer-installer": "*",
+        "magento/module-backend": "*",
+        "magento/module-config": "*",
+        "magento/module-store": "*",
+        "magento/module-ui": "*",
+        "magento/module-user": "*",
+        "christian-riesen/base32": "^1.3",
+        "spomky-labs/otphp": "~8.3",
+        "endroid/qr-code": "^2.5",
+        "donatj/phpuseragentparser": "~0.7",
+        "2tvenom/cborencode": "^1.0",
+        "phpseclib/phpseclib": "~2.0"
+    },
+    "authors": [
+        {
+            "name": "Riccardo Tempesta",
+            "email": "riccardo.tempesta@magespecialist.it"
+        },
+        {
+            "name": "Giacomo Mirabassi",
+            "email": "giacomo.mirabassi@magespecialist.it"
+        }
+    ],
+    "type": "magento2-module",
+    "license": "OSL-3.0",
+    "autoload": {
+        "files": [
+            "registration.php"
+        ],
+        "psr-4": {
+            "Magento\\TwoFactorAuth\\": ""
+        }
+    }
+}
diff --git a/TwoFactorAuth/etc/acl.xml b/TwoFactorAuth/etc/acl.xml
new file mode 100644
index 00000000..0ff1cdeb
--- /dev/null
+++ b/TwoFactorAuth/etc/acl.xml
@@ -0,0 +1,35 @@
+<?xml version="1.0"?>
+<!--
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+ -->
+<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:noNamespaceSchemaLocation="urn:magento:framework:Acl/etc/acl.xsd">
+    <acl>
+        <resources>
+            <resource id="Magento_Backend::admin">
+                <resource id="Magento_Backend::system">
+                    <resource id="Magento_User::acl">
+                        <resource id="Magento_TwoFactorAuth::tfa"
+                                  title="Two Factor Auth"
+                                  translate="title"
+                                  sortOrder="40" />
+                    </resource>
+                </resource>
+
+                <resource id="Magento_Backend::stores">
+                    <resource id="Magento_Backend::stores_settings">
+                        <resource id="Magento_Config::config">
+                            <resource id="Magento_TwoFactorAuth::config"
+                                      title="Two Factor Auth"
+                                      translate="title"
+                                      sortOrder="10" />
+                        </resource>
+                    </resource>
+                </resource>
+            </resource>
+        </resources>
+    </acl>
+</config>
diff --git a/TwoFactorAuth/etc/adminhtml/di.xml b/TwoFactorAuth/etc/adminhtml/di.xml
new file mode 100644
index 00000000..2c57e43f
--- /dev/null
+++ b/TwoFactorAuth/etc/adminhtml/di.xml
@@ -0,0 +1,20 @@
+<?xml version="1.0"?>
+<!--
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+-->
+<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:noNamespaceSchemaLocation="urn:magento:framework:ObjectManager/etc/config.xsd">
+
+    <type name="Magento\User\Block\User\Edit\Tabs">
+        <plugin sortOrder="1" name="add_2fa_tabs" type="Magento\TwoFactorAuth\Plugin\AddTabToAdminUserEdit"/>
+    </type>
+
+    <type name="Magento\User\Observer\Backend\ForceAdminPasswordChangeObserver">
+        <plugin sortOrder="1" name="avoid_2fa_recursion_on_admin_password_change"
+                type="Magento\TwoFactorAuth\Plugin\AvoidRecursionOnPasswordChange"/>
+    </type>
+    <type name="Magento\TwoFactorAuth\Block\Provider\U2fKey\Auth" shared="false"/>
+</config>
diff --git a/TwoFactorAuth/etc/adminhtml/events.xml b/TwoFactorAuth/etc/adminhtml/events.xml
new file mode 100644
index 00000000..0d5c1f23
--- /dev/null
+++ b/TwoFactorAuth/etc/adminhtml/events.xml
@@ -0,0 +1,20 @@
+<?xml version="1.0"?>
+<!--
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+-->
+<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:noNamespaceSchemaLocation="urn:magento:framework:Event/etc/events.xsd">
+
+    <event name="controller_action_predispatch">
+        <observer name="two_factor_auth_check" instance="Magento\TwoFactorAuth\Observer\ControllerActionPredispatch"/>
+    </event>
+    <event name="admin_user_save_after">
+        <observer name="two_factor_auth_admin_user_save_after" instance="Magento\TwoFactorAuth\Observer\AdminUserSaveAfter"/>
+    </event>
+    <event name="admin_user_load_after">
+        <observer name="two_factor_auth_admin_user_load_after" instance="Magento\TwoFactorAuth\Observer\AdminUserLoadAfter"/>
+    </event>
+</config>
diff --git a/TwoFactorAuth/etc/adminhtml/routes.xml b/TwoFactorAuth/etc/adminhtml/routes.xml
new file mode 100644
index 00000000..bbc7e5c6
--- /dev/null
+++ b/TwoFactorAuth/etc/adminhtml/routes.xml
@@ -0,0 +1,16 @@
+<?xml version="1.0"?>
+<!--
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+-->
+<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:noNamespaceSchemaLocation="urn:magento:framework:App/etc/routes.xsd">
+
+    <router id="admin">
+        <route id="tfa" frontName="tfa">
+            <module name="Magento_TwoFactorAuth" before="Magento_Backend" />
+        </route>
+    </router>
+</config>
diff --git a/TwoFactorAuth/etc/adminhtml/system.xml b/TwoFactorAuth/etc/adminhtml/system.xml
new file mode 100644
index 00000000..94180a24
--- /dev/null
+++ b/TwoFactorAuth/etc/adminhtml/system.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0"?>
+<!--
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+-->
+<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Config:etc/system_file.xsd">
+    <system>
+        <tab id="security" translate="label" sortOrder="200">
+            <label>Security</label>
+        </tab>
+
+        <section id="twofactorauth" translate="label" type="text" sortOrder="500" showInDefault="1"
+                 showInWebsite="1" showInStore="1">
+            <class>separator-top</class>
+            <label>2FA</label>
+            <tab>security</tab>
+            <resource>Magento_TwoFactorAuth::config</resource>
+
+            <group id="general" translate="label" type="text" sortOrder="20" showInDefault="1" showInWebsite="0"
+                   showInStore="0">
+                <label>General</label>
+                <field canRestore="1" id="force_providers" translate="label" type="multiselect" sortOrder="30"
+                       showInDefault="1" showInWebsite="0" showInStore="0">
+                    <label>Providers to use</label>
+                    <source_model>Magento\TwoFactorAuth\Model\Config\Source\Provider</source_model>
+                    <frontend_model>Magento\TwoFactorAuth\Block\Adminhtml\System\Config\Providers</frontend_model>
+                    <comment>Two-factor authorization providers for admin users to use during login</comment>
+                    <backend_model>Magento\TwoFactorAuth\Model\Config\Backend\ForceProviders</backend_model>
+                </field>
+            </group>
+
+            <group id="duo" translate="label" type="text" sortOrder="40" showInDefault="1" showInWebsite="0"
+                   showInStore="0">
+                <label>Duo Security</label>
+                <field id="integration_key" translate="label comment" type="text" sortOrder="20" showInDefault="1"
+                       showInWebsite="0" showInStore="0">
+                    <label>Integration key</label>
+                </field>
+                <field id="secret_key" translate="label comment" type="obscure" sortOrder="30" showInDefault="1"
+                       showInWebsite="0" showInStore="0">
+                    <label>Secret key</label>
+                    <backend_model>Magento\Config\Model\Config\Backend\Encrypted</backend_model>
+                </field>
+                <field id="api_hostname" translate="label comment" type="text" sortOrder="40" showInDefault="1"
+                       showInWebsite="0" showInStore="0">
+                    <label>API hostname</label>
+                    <backend_model>Magento\TwoFactorAuth\Model\Config\Backend\Duo\ApiHostname</backend_model>
+                </field>
+            </group>
+
+            <group id="authy" translate="label" type="text" sortOrder="50" showInDefault="1" showInWebsite="0"
+                   showInStore="0">
+                <label>Authy</label>
+                <field id="api_key" translate="label comment" type="obscure" sortOrder="20" showInDefault="1"
+                       showInWebsite="0" showInStore="0">
+                    <label>API key</label>
+                    <backend_model>Magento\Config\Model\Config\Backend\Encrypted</backend_model>
+                </field>
+                <field canRestore="1" id="onetouch_message" translate="label" type="text" sortOrder="40"
+                       showInDefault="1" showInWebsite="0" showInStore="0">
+                    <label>OneTouch Message</label>
+                </field>
+            </group>
+        </section>
+    </system>
+</config>
diff --git a/TwoFactorAuth/etc/config.xml b/TwoFactorAuth/etc/config.xml
new file mode 100644
index 00000000..9dba4e2b
--- /dev/null
+++ b/TwoFactorAuth/etc/config.xml
@@ -0,0 +1,25 @@
+<?xml version="1.0"?>
+<!--
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+-->
+<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Store:etc/config.xsd">
+    <default>
+        <twofactorauth>
+            <general>
+                <force_providers></force_providers>
+            </general>
+            <authy>
+                <onetouch_message>Login request to your Magento Admin</onetouch_message>
+                <api_key backend_model="Magento\Config\Model\Config\Backend\Encrypted"/>
+            </authy>
+            <duo>
+                <secret_key backend_model="Magento\Config\Model\Config\Backend\Encrypted"/>
+                <application_key backend_model="Magento\Config\Model\Config\Backend\Encrypted"/>
+            </duo>
+        </twofactorauth>
+    </default>
+</config>
diff --git a/TwoFactorAuth/etc/db_schema.xml b/TwoFactorAuth/etc/db_schema.xml
new file mode 100644
index 00000000..711a24c2
--- /dev/null
+++ b/TwoFactorAuth/etc/db_schema.xml
@@ -0,0 +1,40 @@
+<?xml version="1.0"?>
+<!--
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+-->
+<schema xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:noNamespaceSchemaLocation="urn:magento:framework:Setup/Declaration/Schema/etc/schema.xsd">
+
+    <table name="tfa_user_config" resource="default" engine="innodb" comment="tfa_user_config">
+        <column xsi:type="int" name="config_id" padding="10" unsigned="true" nullable="false"
+                identity="true" comment="TFA admin user ID"/>
+        <column xsi:type="int" name="user_id" padding="10" unsigned="true" nullable="false" identity="false"
+                comment="User ID"/>
+        <column xsi:type="text" name="encoded_providers" nullable="true" comment="Encoded providers list"/>
+        <column xsi:type="text" name="encoded_config" nullable="true" comment="Encoded providers configuration"/>
+        <column xsi:type="varchar" name="default_provider" nullable="true" comment="Default provider"/>
+        <constraint xsi:type="primary" referenceId="PRIMARY">
+            <column name="config_id"/>
+        </constraint>
+        <constraint xsi:type="foreign" referenceId="TFA_USER_CONFIG_USER_ID_ADMIN_USER_USER_ID"
+                    table="tfa_user_config" column="user_id" referenceTable="admin_user" referenceColumn="user_id"
+                    onDelete="CASCADE"/>
+    </table>
+
+    <table name="tfa_country_codes" resource="default" engine="innodb" comment="tfa_country_codes">
+        <column xsi:type="int" name="country_id" padding="10" unsigned="true" nullable="false"
+                identity="true" comment="TFA admin user ID"/>
+        <column xsi:type="varchar" length="2" name="code" nullable="false" comment="Country code"/>
+        <column xsi:type="varchar" name="name" nullable="false" comment="Country name"/>
+        <column xsi:type="varchar" name="dial_code" nullable="false" comment="Prefix"/>
+        <constraint xsi:type="primary" referenceId="PRIMARY">
+            <column name="country_id"/>
+        </constraint>
+        <index referenceId="TFA_COUNTRY_CODES_CODE" indexType="btree">
+            <column name="code" />
+        </index>
+    </table>
+</schema>
diff --git a/TwoFactorAuth/etc/db_schema_whitelist.json b/TwoFactorAuth/etc/db_schema_whitelist.json
new file mode 100644
index 00000000..c81eca73
--- /dev/null
+++ b/TwoFactorAuth/etc/db_schema_whitelist.json
@@ -0,0 +1,16 @@
+{
+    "tfa_user_config": {
+        "constraint": {
+            "PRIMARY": true,
+            "TFA_USER_CONFIG_USER_ID_ADMIN_USER_USER_ID": true
+        }
+    },
+    "tfa_country_codes": {
+        "constraint": {
+            "PRIMARY": true
+        },
+        "index": {
+            "TFA_COUNTRY_CODES_CODE": true
+        }
+    }
+}
diff --git a/TwoFactorAuth/etc/di.xml b/TwoFactorAuth/etc/di.xml
new file mode 100644
index 00000000..3f80d9fa
--- /dev/null
+++ b/TwoFactorAuth/etc/di.xml
@@ -0,0 +1,141 @@
+<?xml version="1.0"?>
+<!--
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+-->
+<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:noNamespaceSchemaLocation="urn:magento:framework:ObjectManager/etc/config.xsd">
+
+    <preference for="Magento\TwoFactorAuth\Api\ProviderPoolInterface" type="Magento\TwoFactorAuth\Model\ProviderPool"/>
+    <preference for="Magento\TwoFactorAuth\Api\Data\CountryInterface" type="Magento\TwoFactorAuth\Model\Data\Country"/>
+    <preference for="Magento\TwoFactorAuth\Api\CountryRepositoryInterface"
+                type="Magento\TwoFactorAuth\Model\ResourceModel\CountryRepository"/>
+    <preference for="Magento\TwoFactorAuth\Api\Data\CountrySearchResultsInterface"
+                type="Magento\Framework\Api\SearchResults"/>
+    <preference for="Magento\TwoFactorAuth\Api\Data\UserConfigInterface" type="Magento\TwoFactorAuth\Model\Data\UserConfig"/>
+    <preference for="Magento\TwoFactorAuth\Api\UserConfigRepositoryInterface"
+                type="Magento\TwoFactorAuth\Model\ResourceModel\UserConfigRepository"/>
+    <preference for="Magento\TwoFactorAuth\Api\Data\UserConfigSearchResultsInterface"
+                type="Magento\Framework\Api\SearchResults"/>
+    <preference for="Magento\TwoFactorAuth\Api\TfaInterface" type="Magento\TwoFactorAuth\Model\Tfa"/>
+    <preference for="Magento\TwoFactorAuth\Api\UserConfigManagerInterface"
+                type="Magento\TwoFactorAuth\Model\UserConfigManager"/>
+    <preference for="Magento\TwoFactorAuth\Api\TfaSessionInterface" type="Magento\TwoFactorAuth\Model\TfaSession"/>
+    <preference for="Magento\TwoFactorAuth\Model\AlertInterface" type="Magento\TwoFactorAuth\Model\Alert"/>
+
+    <type name="Magento\Framework\Console\CommandListInterface">
+        <arguments>
+            <argument name="commands" xsi:type="array">
+                <item name="tfa_reset" xsi:type="object">Magento\TwoFactorAuth\Command\TfaReset</item>
+                <item name="tfa_providers" xsi:type="object">Magento\TwoFactorAuth\Command\TfaProviders</item>
+            </argument>
+        </arguments>
+    </type>
+
+    <!-- Set sensitive information -->
+    <type name="Magento\Config\Model\Config\TypePool">
+        <arguments>
+            <argument name="sensitive" xsi:type="array">
+                <item name="twofactorauth/duo/integration_key" xsi:type="string">1</item>
+                <item name="twofactorauth/duo/secret_key" xsi:type="string">1</item>
+                <item name="twofactorauth/duo/api_hostname" xsi:type="string">1</item>
+                <item name="twofactorauth/authy/api_key" xsi:type="string">1</item>
+            </argument>
+            <argument name="environment" xsi:type="array">
+                <item name="twofactorauth/duo/integration_key" xsi:type="string">1</item>
+                <item name="twofactorauth/duo/secret_key" xsi:type="string">1</item>
+                <item name="twofactorauth/duo/api_hostname" xsi:type="string">1</item>
+                <item name="twofactorauth/authy/api_key" xsi:type="string">1</item>
+            </argument>
+        </arguments>
+    </type>
+
+    <!-- System 2FA providers list -->
+    <type name="Magento\TwoFactorAuth\Api\ProviderPoolInterface">
+        <arguments>
+            <argument name="providers" xsi:type="array">
+                <!-- Parameter "name" must be the same as defined in virtualType "code" parameter -->
+                <item name="google" xsi:type="object">Magento\TwoFactorAuth\Model\Provider\Google</item>
+                <item name="duo_security" xsi:type="object">Magento\TwoFactorAuth\Model\Provider\DuoSecurity</item>
+                <item name="authy" xsi:type="object">Magento\TwoFactorAuth\Model\Provider\Authy</item>
+                <item name="u2fkey" xsi:type="object">Magento\TwoFactorAuth\Model\Provider\U2fKey</item>
+            </argument>
+        </arguments>
+    </type>
+
+    <virtualType name="Magento\TwoFactorAuth\Model\Provider\Google" type="Magento\TwoFactorAuth\Model\Provider">
+        <arguments>
+            <argument name="engine" xsi:type="object">Magento\TwoFactorAuth\Model\Provider\Engine\Google</argument>
+            <argument name="code" xsi:type="string">google</argument>
+            <argument name="name" xsi:type="string">Google Authenticator</argument>
+            <argument name="icon" xsi:type="string">Magento_TwoFactorAuth::images/providers/google.png</argument>
+            <argument name="configureAction" xsi:type="string">tfa/google/configure</argument>
+            <argument name="authAction" xsi:type="string">tfa/google/auth</argument>
+            <argument name="extraActions" xsi:type="array">
+                <item name="qr" xsi:type="string">tfa/google/qr</item>
+                <item name="configurepost" xsi:type="string">tfa/google/configurepost</item>
+                <item name="authpost" xsi:type="string">tfa/google/authpost</item>
+            </argument>
+            <argument name="canReset" xsi:type="boolean">true</argument>
+        </arguments>
+    </virtualType>
+
+    <virtualType name="Magento\TwoFactorAuth\Model\Provider\DuoSecurity" type="Magento\TwoFactorAuth\Model\Provider">
+        <arguments>
+            <argument name="engine" xsi:type="object">Magento\TwoFactorAuth\Model\Provider\Engine\DuoSecurity</argument>
+            <argument name="code" xsi:type="string">duo_security</argument>
+            <argument name="name" xsi:type="string">Duo Security</argument>
+            <argument name="icon" xsi:type="string">Magento_TwoFactorAuth::images/providers/duo_security.png</argument>
+            <argument name="configureAction" xsi:type="string">tfa/duo/configure</argument>
+            <argument name="authAction" xsi:type="string">tfa/duo/auth</argument>
+            <argument name="extraActions" xsi:type="array">
+                <item name="authpost" xsi:type="string">tfa/duo/authpost</item>
+            </argument>
+            <argument name="canReset" xsi:type="boolean">false</argument>
+        </arguments>
+    </virtualType>
+
+    <virtualType name="Magento\TwoFactorAuth\Model\Provider\Authy" type="Magento\TwoFactorAuth\Model\Provider">
+        <arguments>
+            <argument name="engine" xsi:type="object">Magento\TwoFactorAuth\Model\Provider\Engine\Authy</argument>
+            <argument name="code" xsi:type="string">authy</argument>
+            <argument name="name" xsi:type="string">Authy</argument>
+            <argument name="icon" xsi:type="string">Magento_TwoFactorAuth::images/providers/authy.png</argument>
+            <argument name="configureAction" xsi:type="string">tfa/authy/configure</argument>
+            <argument name="authAction" xsi:type="string">tfa/authy/auth</argument>
+            <argument name="extraActions" xsi:type="array">
+                <item name="configurepost" xsi:type="string">tfa/authy/configurepost</item>
+                <item name="configureverifypost" xsi:type="string">tfa/authy/configureverifypost</item>
+                <item name="verify" xsi:type="string">tfa/authy/verify</item>
+                <item name="authpost" xsi:type="string">tfa/authy/authpost</item>
+                <item name="token" xsi:type="string">tfa/authy/token</item>
+                <item name="onetouch" xsi:type="string">tfa/authy/onetouch</item>
+                <item name="verifyonetouch" xsi:type="string">tfa/authy/verifyonetouch</item>
+            </argument>
+            <argument name="canReset" xsi:type="boolean">true</argument>
+        </arguments>
+    </virtualType>
+
+    <virtualType name="Magento\TwoFactorAuth\Model\Provider\U2fKey" type="Magento\TwoFactorAuth\Model\Provider">
+        <arguments>
+            <argument name="engine" xsi:type="object">Magento\TwoFactorAuth\Model\Provider\Engine\U2fKey</argument>
+            <argument name="code" xsi:type="string">u2fkey</argument>
+            <argument name="name" xsi:type="string">U2F (Yubikey and others)</argument>
+            <argument name="icon" xsi:type="string">Magento_TwoFactorAuth::images/providers/u2fkey.png</argument>
+            <argument name="configureAction" xsi:type="string">tfa/u2f/configure</argument>
+            <argument name="authAction" xsi:type="string">tfa/u2f/auth</argument>
+            <argument name="extraActions" xsi:type="array">
+                <item name="configurepost" xsi:type="string">tfa/u2f/configurepost</item>
+                <item name="authpost" xsi:type="string">tfa/u2f/authpost</item>
+            </argument>
+            <argument name="canReset" xsi:type="boolean">true</argument>
+        </arguments>
+    </virtualType>
+
+    <preference for="Magento\TwoFactorAuth\Api\UserConfigRequestManagerInterface" type="Magento\TwoFactorAuth\Model\UserConfig\UserConfigRequestManager" />
+    <preference for="Magento\TwoFactorAuth\Api\UserConfigTokenManagerInterface" type="Magento\TwoFactorAuth\Model\UserConfig\SignedTokenManager" />
+    <preference for="Magento\TwoFactorAuth\Api\UserNotifierInterface" type="Magento\TwoFactorAuth\Model\EmailUserNotifier" />
+    <preference for="Magento\TwoFactorAuth\Observer\ControllerActionPredispatch" type="Magento\TwoFactorAuth\TestFramework\ControllerActionPredispatch" />
+</config>
diff --git a/TwoFactorAuth/etc/email_templates.xml b/TwoFactorAuth/etc/email_templates.xml
new file mode 100644
index 00000000..addfd7bd
--- /dev/null
+++ b/TwoFactorAuth/etc/email_templates.xml
@@ -0,0 +1,11 @@
+<?xml version="1.0"?>
+<!--
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+-->
+<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Email:etc/email_templates.xsd">
+    <template id="tfa_admin_user_config_required" label="2FA Configuration Required by User" file="user_config_required.html" type="html" module="Magento_TwoFactorAuth" area="adminhtml"/>
+    <template id="tfa_admin_app_config_required" label="2FA Configuration Required for the Application" file="app_config_required.html" type="html" module="Magento_TwoFactorAuth" area="adminhtml"/>
+</config>
diff --git a/TwoFactorAuth/etc/module.xml b/TwoFactorAuth/etc/module.xml
new file mode 100644
index 00000000..5cfe6c60
--- /dev/null
+++ b/TwoFactorAuth/etc/module.xml
@@ -0,0 +1,15 @@
+<?xml version="1.0"?>
+<!--
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+-->
+<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:noNamespaceSchemaLocation="urn:magento:framework:Module/etc/module.xsd">
+    <module name="Magento_TwoFactorAuth">
+        <sequence>
+            <module name="Magento_User"/>
+        </sequence>
+    </module>
+</config>
diff --git a/TwoFactorAuth/etc/webapi.xml b/TwoFactorAuth/etc/webapi.xml
new file mode 100644
index 00000000..917171ac
--- /dev/null
+++ b/TwoFactorAuth/etc/webapi.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0"?>
+<!--
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+ -->
+<routes xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Webapi:etc/webapi.xsd">
+
+    <route url="/V1/tfa/installed-providers" method="GET">
+        <service class="\Magento\TwoFactorAuth\Api\TfaInterface" method="getAllProviders"/>
+        <resources>
+            <resource ref="Magento_TwoFactorAuth::tfa" />
+        </resources>
+    </route>
+
+    <route url="/V1/tfa/forced-providers" method="GET">
+        <service class="\Magento\TwoFactorAuth\Api\TfaInterface" method="getForcedProviders"/>
+        <resources>
+            <resource ref="Magento_TwoFactorAuth::tfa" />
+        </resources>
+    </route>
+
+    <route url="/V1/tfa/user-providers/:userId" method="GET">
+        <service class="\Magento\TwoFactorAuth\Api\TfaInterface" method="getUserProviders"/>
+        <resources>
+            <resource ref="Magento_TwoFactorAuth::tfa" />
+        </resources>
+    </route>
+
+    <route url="/V1/tfa/providers-to-activate/:userId" method="GET">
+        <service class="\Magento\TwoFactorAuth\Api\TfaInterface" method="getProvidersToActivate"/>
+        <resources>
+            <resource ref="Magento_TwoFactorAuth::tfa" />
+        </resources>
+    </route>
+
+    <route url="/V1/tfa/default-provider-code/:userId" method="GET">
+        <service class="\Magento\TwoFactorAuth\Api\UserConfigManagerInterface" method="getDefaultProvider"/>
+        <resources>
+            <resource ref="Magento_TwoFactorAuth::tfa" />
+        </resources>
+    </route>
+
+    <route url="/V1/tfa/default-provider-code/:userId" method="PUT">
+        <service class="\Magento\TwoFactorAuth\Api\TfaInterface" method="setDefaultProviderCode"/>
+        <resources>
+            <resource ref="Magento_TwoFactorAuth::tfa" />
+        </resources>
+    </route>
+
+    <route url="/V1/tfa/user-providers/:userId" method="PUT">
+        <service class="\Magento\TwoFactorAuth\Api\TfaInterface" method="setProvidersCodes"/>
+        <resources>
+            <resource ref="Magento_TwoFactorAuth::tfa" />
+        </resources>
+    </route>
+
+    <route url="/V1/tfa/reset-provider/:userId/:providerCode" method="POST">
+        <service class="\Magento\TwoFactorAuth\Api\TfaInterface" method="resetProviderConfig"/>
+        <resources>
+            <resource ref="Magento_TwoFactorAuth::tfa" />
+        </resources>
+    </route>
+</routes>
diff --git a/TwoFactorAuth/registration.php b/TwoFactorAuth/registration.php
new file mode 100644
index 00000000..3048cf3a
--- /dev/null
+++ b/TwoFactorAuth/registration.php
@@ -0,0 +1,12 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+\Magento\Framework\Component\ComponentRegistrar::register(
+    \Magento\Framework\Component\ComponentRegistrar::MODULE,
+    'Magento_TwoFactorAuth',
+    __DIR__
+);
diff --git a/TwoFactorAuth/view/adminhtml/email/app_config_required.html b/TwoFactorAuth/view/adminhtml/email/app_config_required.html
new file mode 100644
index 00000000..6bf3684d
--- /dev/null
+++ b/TwoFactorAuth/view/adminhtml/email/app_config_required.html
@@ -0,0 +1,21 @@
+<!--
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+-->
+<!--@subject {{trans "2FA configuration required for %name" name=$store_name}} @-->
+<!--@vars {
+"var username":"Admin User Name",
+"var store_name":"Current Store (Website) Name",
+"var token":"Token query parameter",
+"var url":"URL to User 2FA Configuration Page"
+} @-->
+
+<p>{{var username}},</p>
+<p>
+    {{trans "You are required to configure website-wide and personal Two-Factor Authorization in order to login to %store" store=$store_name }}
+    <br/>
+    {{trans "To do that please <a href="%url">Click here</a>" url=$url |noescape}}
+</p>
+<p>{{trans "Thank you,"}} {{var store_name}}</p>
diff --git a/TwoFactorAuth/view/adminhtml/email/user_config_required.html b/TwoFactorAuth/view/adminhtml/email/user_config_required.html
new file mode 100644
index 00000000..efffe609
--- /dev/null
+++ b/TwoFactorAuth/view/adminhtml/email/user_config_required.html
@@ -0,0 +1,21 @@
+<!--
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+-->
+<!--@subject {{trans "2FA configuration required for %name" name=$username}} @-->
+<!--@vars {
+"var username":"Admin User Name",
+"var store_name":"Current Store (Website) Name",
+"var token":"Token query parameter",
+"var url":"URL to User 2FA Configuration Page"
+} @-->
+
+<p>{{var username}},</p>
+<p>
+    {{trans "You are required to configure personal Two-Factor Authorization in order to login to %store" store=$store_name}}
+    <br/>
+    {{trans "To do that please <a href="%url">Click here</a>" url=$url |noescape}}
+</p>
+<p>{{trans "Thank you, %store" store=$store_name}}</p>
diff --git a/TwoFactorAuth/view/adminhtml/layout/adminhtml_user_edit.xml b/TwoFactorAuth/view/adminhtml/layout/adminhtml_user_edit.xml
new file mode 100644
index 00000000..c9771d6c
--- /dev/null
+++ b/TwoFactorAuth/view/adminhtml/layout/adminhtml_user_edit.xml
@@ -0,0 +1,18 @@
+<?xml version="1.0"?>
+<!--
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+-->
+<page xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+      xsi:noNamespaceSchemaLocation="urn:magento:framework:View/Layout/etc/page_configuration.xsd">
+
+    <head>
+        <css src="Magento_TwoFactorAuth::css/tfa.css"/>
+    </head>
+
+    <body>
+        <uiComponent name="tfa_edit_user_form" />
+    </body>
+</page>
diff --git a/TwoFactorAuth/view/adminhtml/layout/tfa_authy_auth.xml b/TwoFactorAuth/view/adminhtml/layout/tfa_authy_auth.xml
new file mode 100644
index 00000000..54b37fa1
--- /dev/null
+++ b/TwoFactorAuth/view/adminhtml/layout/tfa_authy_auth.xml
@@ -0,0 +1,49 @@
+<?xml version="1.0"?>
+<!--
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+-->
+<page xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+      xsi:noNamespaceSchemaLocation="urn:magento:framework:View/Layout/etc/page_configuration.xsd">
+    <update handle="admin_login" />
+
+    <head>
+        <css src="Magento_TwoFactorAuth::css/auth.css"/>
+        <css src="Magento_TwoFactorAuth::css/authy.css"/>
+    </head>
+
+    <body>
+        <referenceContainer name="login.content">
+            <block class="Magento\TwoFactorAuth\Block\Provider\Authy\Auth" name="content"
+                   template="Magento_TwoFactorAuth::tfa/provider/auth.phtml">
+
+                <arguments>
+                    <argument name="jsLayout" xsi:type="array">
+                        <item name="components" xsi:type="array">
+                            <item name="tfa-auth" xsi:type="array">
+                                <item name="component" xsi:type="string">Magento_TwoFactorAuth/js/authy/auth</item>
+                            </item>
+                        </item>
+                    </argument>
+                </arguments>
+
+                <block class="Magento\TwoFactorAuth\Block\ChangeProvider" name="change-provider"
+                       template="Magento_TwoFactorAuth::tfa/change_provider.phtml">
+
+                    <arguments>
+                        <argument name="provider" xsi:type="string">authy</argument>
+                        <argument name="jsLayout" xsi:type="array">
+                            <item name="components" xsi:type="array">
+                                <item name="tfa-change-provider" xsi:type="array">
+                                    <item name="component" xsi:type="string">Magento_TwoFactorAuth/js/change_provider</item>
+                                </item>
+                            </item>
+                        </argument>
+                    </arguments>
+                </block>
+            </block>
+        </referenceContainer>
+    </body>
+</page>
diff --git a/TwoFactorAuth/view/adminhtml/layout/tfa_authy_configure.xml b/TwoFactorAuth/view/adminhtml/layout/tfa_authy_configure.xml
new file mode 100644
index 00000000..99301065
--- /dev/null
+++ b/TwoFactorAuth/view/adminhtml/layout/tfa_authy_configure.xml
@@ -0,0 +1,50 @@
+<?xml version="1.0"?>
+<!--
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+-->
+<page xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+      xsi:noNamespaceSchemaLocation="urn:magento:framework:View/Layout/etc/page_configuration.xsd">
+    <update handle="admin_login" />
+
+    <head>
+        <css src="Magento_TwoFactorAuth::css/auth.css"/>
+        <css src="Magento_TwoFactorAuth::css/authy.css"/>
+    </head>
+
+    <body>
+        <referenceContainer name="login.content">
+            <block class="Magento\TwoFactorAuth\Block\Provider\Authy\Configure" name="content"
+                   template="Magento_TwoFactorAuth::tfa/provider/configure.phtml">
+
+                <arguments>
+                    <argument name="jsLayout" xsi:type="array">
+                        <item name="components" xsi:type="array">
+                            <item name="tfa-configure" xsi:type="array">
+                                <item name="component" xsi:type="string">Magento_TwoFactorAuth/js/authy/configure</item>
+                                <item name="children" xsi:type="array">
+                                    <item name="register" xsi:type="array">
+                                        <item name="component" xsi:type="string">Magento_TwoFactorAuth/js/authy/configure/register</item>
+                                        <item name="displayArea" xsi:type="string">step-register</item>
+                                    </item>
+                                    <item name="verify" xsi:type="array">
+                                        <item name="component" xsi:type="string">Magento_TwoFactorAuth/js/authy/configure/verify</item>
+                                        <item name="displayArea" xsi:type="string">step-verify</item>
+                                    </item>
+                                </item>
+                            </item>
+                        </item>
+                    </argument>
+                </arguments>
+            </block>
+            <block class="Magento\TwoFactorAuth\Block\ConfigureLater" name="configure-later"
+                   template="Magento_TwoFactorAuth::tfa/configure_later.phtml">
+                <arguments>
+                    <argument name="provider" xsi:type="string">authy</argument>
+                </arguments>
+            </block>
+        </referenceContainer>
+    </body>
+</page>
diff --git a/TwoFactorAuth/view/adminhtml/layout/tfa_duo_auth.xml b/TwoFactorAuth/view/adminhtml/layout/tfa_duo_auth.xml
new file mode 100644
index 00000000..067c3497
--- /dev/null
+++ b/TwoFactorAuth/view/adminhtml/layout/tfa_duo_auth.xml
@@ -0,0 +1,55 @@
+<?xml version="1.0"?>
+<!--
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+-->
+<page xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+      xsi:noNamespaceSchemaLocation="urn:magento:framework:View/Layout/etc/page_configuration.xsd">
+    <update handle="admin_login" />
+
+    <head>
+        <css src="Magento_TwoFactorAuth::css/auth.css"/>
+        <css src="Magento_TwoFactorAuth::css/duo.css"/>
+    </head>
+
+    <body>
+        <referenceContainer name="login.content">
+            <block class="Magento\TwoFactorAuth\Block\Provider\Duo\Auth" name="content"
+                   template="Magento_TwoFactorAuth::tfa/provider/auth.phtml">
+
+                <arguments>
+                    <argument name="jsLayout" xsi:type="array">
+                        <item name="components" xsi:type="array">
+                            <item name="tfa-auth" xsi:type="array">
+                                <item name="component" xsi:type="string">Magento_TwoFactorAuth/js/duo/auth</item>
+                            </item>
+                        </item>
+                    </argument>
+                </arguments>
+
+                <block class="Magento\TwoFactorAuth\Block\ChangeProvider" name="change-provider"
+                       template="Magento_TwoFactorAuth::tfa/change_provider.phtml">
+
+                    <arguments>
+                        <argument name="provider" xsi:type="string">duo_security</argument>
+                        <argument name="jsLayout" xsi:type="array">
+                            <item name="components" xsi:type="array">
+                                <item name="tfa-change-provider" xsi:type="array">
+                                    <item name="component" xsi:type="string">Magento_TwoFactorAuth/js/change_provider</item>
+                                </item>
+                            </item>
+                        </argument>
+                    </arguments>
+                </block>
+            </block>
+            <block class="Magento\TwoFactorAuth\Block\ConfigureLater" name="configure-later"
+                   template="Magento_TwoFactorAuth::tfa/configure_later.phtml">
+                <arguments>
+                    <argument name="provider" xsi:type="string">duo_security</argument>
+                </arguments>
+            </block>
+        </referenceContainer>
+    </body>
+</page>
diff --git a/TwoFactorAuth/view/adminhtml/layout/tfa_google_auth.xml b/TwoFactorAuth/view/adminhtml/layout/tfa_google_auth.xml
new file mode 100644
index 00000000..c361ea70
--- /dev/null
+++ b/TwoFactorAuth/view/adminhtml/layout/tfa_google_auth.xml
@@ -0,0 +1,49 @@
+<?xml version="1.0"?>
+<!--
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+-->
+<page xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+      xsi:noNamespaceSchemaLocation="urn:magento:framework:View/Layout/etc/page_configuration.xsd">
+    <update handle="admin_login" />
+
+    <head>
+        <css src="Magento_TwoFactorAuth::css/auth.css"/>
+        <css src="Magento_TwoFactorAuth::css/google.css"/>
+    </head>
+
+    <body>
+        <referenceContainer name="login.content">
+            <block class="Magento\TwoFactorAuth\Block\Provider\Google\Auth" name="content"
+                   template="Magento_TwoFactorAuth::tfa/provider/auth.phtml">
+
+                <arguments>
+                    <argument name="jsLayout" xsi:type="array">
+                        <item name="components" xsi:type="array">
+                            <item name="tfa-auth" xsi:type="array">
+                                <item name="component" xsi:type="string">Magento_TwoFactorAuth/js/google/auth</item>
+                            </item>
+                        </item>
+                    </argument>
+                </arguments>
+
+                <block class="Magento\TwoFactorAuth\Block\ChangeProvider" name="change-provider"
+                       template="Magento_TwoFactorAuth::tfa/change_provider.phtml">
+
+                    <arguments>
+                        <argument name="provider" xsi:type="string">google</argument>
+                        <argument name="jsLayout" xsi:type="array">
+                            <item name="components" xsi:type="array">
+                                <item name="tfa-change-provider" xsi:type="array">
+                                    <item name="component" xsi:type="string">Magento_TwoFactorAuth/js/change_provider</item>
+                                </item>
+                            </item>
+                        </argument>
+                    </arguments>
+                </block>
+            </block>
+        </referenceContainer>
+    </body>
+</page>
diff --git a/TwoFactorAuth/view/adminhtml/layout/tfa_google_configure.xml b/TwoFactorAuth/view/adminhtml/layout/tfa_google_configure.xml
new file mode 100644
index 00000000..cfc8f5a3
--- /dev/null
+++ b/TwoFactorAuth/view/adminhtml/layout/tfa_google_configure.xml
@@ -0,0 +1,41 @@
+<?xml version="1.0"?>
+<!--
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+-->
+<page xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+      xsi:noNamespaceSchemaLocation="urn:magento:framework:View/Layout/etc/page_configuration.xsd">
+    <update handle="admin_login" />
+
+    <head>
+        <css src="Magento_TwoFactorAuth::css/auth.css"/>
+        <css src="Magento_TwoFactorAuth::css/google.css"/>
+    </head>
+
+    <body>
+        <referenceContainer name="login.content">
+            <block class="Magento\TwoFactorAuth\Block\Provider\Google\Configure" name="content"
+                   template="Magento_TwoFactorAuth::tfa/provider/configure.phtml">
+
+                <arguments>
+                    <argument name="jsLayout" xsi:type="array">
+                        <item name="components" xsi:type="array">
+                            <item name="tfa-configure" xsi:type="array">
+                                <item name="component" xsi:type="string">Magento_TwoFactorAuth/js/google/auth</item>
+                                <item name="template" xsi:type="string">Magento_TwoFactorAuth/google/configure</item>
+                            </item>
+                        </item>
+                    </argument>
+                </arguments>
+            </block>
+            <block class="Magento\TwoFactorAuth\Block\ConfigureLater" name="configure-later"
+                   template="Magento_TwoFactorAuth::tfa/configure_later.phtml">
+                <arguments>
+                    <argument name="provider" xsi:type="string">google</argument>
+                </arguments>
+            </block>
+        </referenceContainer>
+    </body>
+</page>
diff --git a/TwoFactorAuth/view/adminhtml/layout/tfa_tfa_accessdenied.xml b/TwoFactorAuth/view/adminhtml/layout/tfa_tfa_accessdenied.xml
new file mode 100644
index 00000000..1111bafc
--- /dev/null
+++ b/TwoFactorAuth/view/adminhtml/layout/tfa_tfa_accessdenied.xml
@@ -0,0 +1,17 @@
+<?xml version="1.0"?>
+<!--
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+-->
+<page xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+      xsi:noNamespaceSchemaLocation="urn:magento:framework:View/Layout/etc/page_configuration.xsd">
+    <update handle="admin_login" />
+
+    <body>
+        <referenceContainer name="login.content">
+            <block class="Magento\Backend\Block\Denied" name="content.denied" template="Magento_Backend::admin/access_denied.phtml"/>
+        </referenceContainer>
+    </body>
+</page>
diff --git a/TwoFactorAuth/view/adminhtml/layout/tfa_tfa_configure.xml b/TwoFactorAuth/view/adminhtml/layout/tfa_tfa_configure.xml
new file mode 100644
index 00000000..efe6d105
--- /dev/null
+++ b/TwoFactorAuth/view/adminhtml/layout/tfa_tfa_configure.xml
@@ -0,0 +1,23 @@
+<?xml version="1.0"?>
+<!--
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+-->
+<page xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+      xsi:noNamespaceSchemaLocation="urn:magento:framework:View/Layout/etc/page_configuration.xsd">
+    <update handle="admin_login" />
+    <update handle="formkey"/>
+
+    <head>
+        <css src="Magento_TwoFactorAuth::css/auth.css"/>
+    </head>
+
+    <body>
+        <referenceContainer name="login.content">
+            <block class="Magento\TwoFactorAuth\Block\Configure" name="content"
+                   template="Magento_TwoFactorAuth::tfa/configure.phtml" />
+        </referenceContainer>
+    </body>
+</page>
diff --git a/TwoFactorAuth/view/adminhtml/layout/tfa_tfa_requestconfig.xml b/TwoFactorAuth/view/adminhtml/layout/tfa_tfa_requestconfig.xml
new file mode 100644
index 00000000..d8517a6c
--- /dev/null
+++ b/TwoFactorAuth/view/adminhtml/layout/tfa_tfa_requestconfig.xml
@@ -0,0 +1,18 @@
+<?xml version="1.0"?>
+<!--
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+-->
+<page xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+      xsi:noNamespaceSchemaLocation="urn:magento:framework:View/Layout/etc/page_configuration.xsd">
+    <update handle="admin_login" />
+
+    <body>
+        <referenceContainer name="login.content">
+            <block class="Magento\Backend\Block\Template" name="content"
+                   template="Magento_TwoFactorAuth::tfa/request_config.phtml" />
+        </referenceContainer>
+    </body>
+</page>
diff --git a/TwoFactorAuth/view/adminhtml/layout/tfa_u2f_auth.xml b/TwoFactorAuth/view/adminhtml/layout/tfa_u2f_auth.xml
new file mode 100644
index 00000000..375c9f1e
--- /dev/null
+++ b/TwoFactorAuth/view/adminhtml/layout/tfa_u2f_auth.xml
@@ -0,0 +1,49 @@
+<?xml version="1.0"?>
+<!--
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+-->
+<page xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+      xsi:noNamespaceSchemaLocation="urn:magento:framework:View/Layout/etc/page_configuration.xsd">
+    <update handle="admin_login" />
+
+    <head>
+        <css src="Magento_TwoFactorAuth::css/u2f.css"/>
+        <css src="Magento_TwoFactorAuth::css/auth.css"/>
+    </head>
+
+    <body>
+        <referenceContainer name="login.content">
+            <block class="Magento\TwoFactorAuth\Block\Provider\U2fKey\Auth" name="content"
+                   template="Magento_TwoFactorAuth::tfa/provider/auth.phtml">
+
+                <arguments>
+                    <argument name="jsLayout" xsi:type="array">
+                        <item name="components" xsi:type="array">
+                            <item name="tfa-auth" xsi:type="array">
+                                <item name="component" xsi:type="string">Magento_TwoFactorAuth/js/u2fkey/auth</item>
+                            </item>
+                        </item>
+                    </argument>
+                </arguments>
+
+                <block class="Magento\TwoFactorAuth\Block\ChangeProvider" name="change-provider"
+                       template="Magento_TwoFactorAuth::tfa/change_provider.phtml">
+
+                    <arguments>
+                        <argument name="provider" xsi:type="string">u2fkey</argument>
+                        <argument name="jsLayout" xsi:type="array">
+                            <item name="components" xsi:type="array">
+                                <item name="tfa-change-provider" xsi:type="array">
+                                    <item name="component" xsi:type="string">Magento_TwoFactorAuth/js/change_provider</item>
+                                </item>
+                            </item>
+                        </argument>
+                    </arguments>
+                </block>
+            </block>
+        </referenceContainer>
+    </body>
+</page>
diff --git a/TwoFactorAuth/view/adminhtml/layout/tfa_u2f_configure.xml b/TwoFactorAuth/view/adminhtml/layout/tfa_u2f_configure.xml
new file mode 100644
index 00000000..f20ad606
--- /dev/null
+++ b/TwoFactorAuth/view/adminhtml/layout/tfa_u2f_configure.xml
@@ -0,0 +1,39 @@
+<?xml version="1.0"?>
+<!--
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+-->
+<page xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+      xsi:noNamespaceSchemaLocation="urn:magento:framework:View/Layout/etc/page_configuration.xsd">
+    <update handle="admin_login" />
+
+    <head>
+        <css src="Magento_TwoFactorAuth::css/auth.css"/>
+        <css src="Magento_TwoFactorAuth::css/u2f.css"/>
+    </head>
+
+    <body>
+        <referenceContainer name="login.content">
+            <block class="Magento\TwoFactorAuth\Block\Provider\U2fKey\Configure" name="content"
+                   template="Magento_TwoFactorAuth::tfa/provider/configure.phtml">
+                <arguments>
+                    <argument name="jsLayout" xsi:type="array">
+                        <item name="components" xsi:type="array">
+                            <item name="tfa-configure" xsi:type="array">
+                                <item name="component" xsi:type="string">Magento_TwoFactorAuth/js/u2fkey/configure</item>
+                            </item>
+                        </item>
+                    </argument>
+                </arguments>
+            </block>
+            <block class="Magento\TwoFactorAuth\Block\ConfigureLater" name="configure-later"
+                   template="Magento_TwoFactorAuth::tfa/configure_later.phtml">
+                <arguments>
+                    <argument name="provider" xsi:type="string">u2fkey</argument>
+                </arguments>
+            </block>
+        </referenceContainer>
+    </body>
+</page>
diff --git a/TwoFactorAuth/view/adminhtml/templates/system/config/providers/modal_content_body.phtml b/TwoFactorAuth/view/adminhtml/templates/system/config/providers/modal_content_body.phtml
new file mode 100644
index 00000000..91fc1a52
--- /dev/null
+++ b/TwoFactorAuth/view/adminhtml/templates/system/config/providers/modal_content_body.phtml
@@ -0,0 +1,15 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+
+?>
+<div class="tfa-modal-content-body">
+    <p>
+        <strong><?= $block->escapeHtml(__('All currently active providers will not be available')) ?></strong>
+        <?= $block->escapeHtml(
+            __('which means all admin users will be required to configure an available method before they can login.')
+        ) ?>
+    </p>
+</div>
diff --git a/TwoFactorAuth/view/adminhtml/templates/tfa/change_provider.phtml b/TwoFactorAuth/view/adminhtml/templates/tfa/change_provider.phtml
new file mode 100644
index 00000000..d06fbd8e
--- /dev/null
+++ b/TwoFactorAuth/view/adminhtml/templates/tfa/change_provider.phtml
@@ -0,0 +1,17 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+?>
+<div id="tfa-change-provider-container" data-bind="scope:'tfa-change-provider'">
+    <!-- ko template: getTemplate() --><!-- /ko -->
+</div>
+
+<script type="text/x-magento-init">
+{
+    "#tfa-change-provider-container": {
+        "Magento_Ui/js/core/app": <?php /* @escapeNotVerified */ echo $block->getJsLayout() ?>
+    }
+}
+</script>
diff --git a/TwoFactorAuth/view/adminhtml/templates/tfa/configure.phtml b/TwoFactorAuth/view/adminhtml/templates/tfa/configure.phtml
new file mode 100644
index 00000000..29200c3b
--- /dev/null
+++ b/TwoFactorAuth/view/adminhtml/templates/tfa/configure.phtml
@@ -0,0 +1,40 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+
+/** @var \Magento\TwoFactorAuth\Block\Configure $block */
+
+$list = $block->getProvidersList();
+?>
+<p id="2fa-configure-header">
+    <?= $block->escapeHtml(__('Please select one or more Two-Factor Authorization providers to be used to authorize admin users')); ?>
+</p>
+<div id="2fa-providers-list">
+    <?php if (!$list): ?>
+        <p class="mage-error">
+            <?= $block->escapeHtml(__('No providers are available to select, please configure required 2FA provider settings on the server via CLI')); ?>
+        </p>
+    <?php else: ?>
+        <form class="tfa-configure-providers" method="post" action="<?= $block->getActionUrl() ?>">
+            <ul class="tfa-provider_list">
+                <?php foreach ($list as $providerData): ?>
+                    <li class="tfa-provider">
+                        <input type="checkbox"
+                               name="tfa_selected[<?= $block->escapeHtmlAttr($providerData['code']) ?>]"
+                               class="tfa-checkbox"
+                               id="2fa_checkbox-<?= $block->escapeHtmlAttr($providerData['code']) ?>"/>
+                        <label for="2fa_checkbox-<?= $block->escapeHtmlAttr($providerData['code']) ?>">
+                            <img src="<?= $block->escapeHtmlAttr($providerData['icon']) ?>"/>
+                            <span><?= $block->escapeHtml($providerData['name']) ?></span>
+                        </label>
+                    </li>
+                <?php endforeach; ?>
+            </ul>
+            <br/>
+            <?= $block->getBlockHtml('formkey') ?>
+            <input type="submit" value="<?= $block->escapeHtmlAttr(__('Apply')); ?>" class="action-primary" />
+        </form>
+    <?php endif; ?>
+</div>
diff --git a/TwoFactorAuth/view/adminhtml/templates/tfa/configure_later.phtml b/TwoFactorAuth/view/adminhtml/templates/tfa/configure_later.phtml
new file mode 100644
index 00000000..e9ea5a46
--- /dev/null
+++ b/TwoFactorAuth/view/adminhtml/templates/tfa/configure_later.phtml
@@ -0,0 +1,13 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+?>
+<?php
+/** @var $block Magento\TwoFactorAuth\Block\ConfigureLater */
+/** @var $escaper Magento\Framework\Escaper */
+?>
+<div id="tfa-configure-later-container">
+    <a href="#" data-post="<?=$escaper->escapeHtmlAttr($block->getPostData())?>"><?=__('Skip this configuration until next login.')?></a>
+</div>
diff --git a/TwoFactorAuth/view/adminhtml/templates/tfa/provider/auth.phtml b/TwoFactorAuth/view/adminhtml/templates/tfa/provider/auth.phtml
new file mode 100644
index 00000000..7ddc2c47
--- /dev/null
+++ b/TwoFactorAuth/view/adminhtml/templates/tfa/provider/auth.phtml
@@ -0,0 +1,19 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+?>
+<div id="tfa-auth-container" data-bind="scope:'tfa-auth'">
+    <!-- ko template: getTemplate() --><!-- /ko -->
+</div>
+
+<?php echo $block->getChildHtml('change-provider') ?>
+
+<script type="text/x-magento-init">
+{
+    "#tfa-auth-container": {
+        "Magento_Ui/js/core/app": <?php /* @escapeNotVerified */ echo $block->getJsLayout() ?>
+    }
+}
+</script>
diff --git a/TwoFactorAuth/view/adminhtml/templates/tfa/provider/configure.phtml b/TwoFactorAuth/view/adminhtml/templates/tfa/provider/configure.phtml
new file mode 100644
index 00000000..017cc618
--- /dev/null
+++ b/TwoFactorAuth/view/adminhtml/templates/tfa/provider/configure.phtml
@@ -0,0 +1,17 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+?>
+<div id="tfa-configure-container" data-bind="scope:'tfa-configure'">
+    <!-- ko template: getTemplate() --><!-- /ko -->
+</div>
+
+<script type="text/x-magento-init">
+{
+    "#tfa-configure-container": {
+        "Magento_Ui/js/core/app": <?php /* @escapeNotVerified */ echo $block->getJsLayout() ?>
+    }
+}
+</script>
diff --git a/TwoFactorAuth/view/adminhtml/templates/tfa/request_config.phtml b/TwoFactorAuth/view/adminhtml/templates/tfa/request_config.phtml
new file mode 100644
index 00000000..7a45baec
--- /dev/null
+++ b/TwoFactorAuth/view/adminhtml/templates/tfa/request_config.phtml
@@ -0,0 +1,12 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+
+/** @var \Magento\Backend\Block\Template $block */
+?>
+<div>
+    <p><?= $block->escapeHtml(__('You need to configure Two-Factor Authorization in order to proceed to your store\'s admin area')); ?></p>
+    <p><?= $block->escapeHtml(__('An E-mail was sent to you with further instructions')); ?></p>
+</div>
diff --git a/TwoFactorAuth/view/adminhtml/ui_component/tfa_edit_user_form.xml b/TwoFactorAuth/view/adminhtml/ui_component/tfa_edit_user_form.xml
new file mode 100644
index 00000000..72e9597f
--- /dev/null
+++ b/TwoFactorAuth/view/adminhtml/ui_component/tfa_edit_user_form.xml
@@ -0,0 +1,86 @@
+<?xml version="1.0"?>
+<!--
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+-->
+<form xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+      xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Ui:etc/ui_configuration.xsd">
+
+    <argument name="data" xsi:type="array">
+        <item name="js_config" xsi:type="array">
+            <item name="provider"
+                  xsi:type="string">tfa_edit_user_form.tfa_edit_user_form_data_source
+            </item>
+        </item>
+        <item name="acl" xsi:type="string">Magento_TwoFactorAuth::tfa</item>
+        <item name="template" xsi:type="string">templates/form/collapsible</item>
+        <item name="childrenFromMeta" xsi:type="boolean">true</item>
+    </argument>
+    <settings>
+        <label translate="true">2FA</label>
+        <namespace>tfa_edit_user_form</namespace>
+        <dataScope>data</dataScope>
+        <deps>
+            <dep>tfa_edit_user_form.tfa_edit_user_form_data_source</dep>
+        </deps>
+    </settings>
+
+    <dataSource name="tfa_edit_user_form_data_source">
+        <argument name="data" xsi:type="array">
+            <item name="js_config" xsi:type="array">
+                <item name="component" xsi:type="string">Magento_TwoFactorAuth/js/form/provider</item>
+            </item>
+        </argument>
+        <aclResource>Magento_TwoFactorAuth::tfa</aclResource>
+        <dataProvider class="Magento\TwoFactorAuth\Ui\Component\Form\User\DataProvider"
+                      name="tfa_edit_user_form_data_source">
+            <settings>
+                <primaryFieldName>main_table.user_id</primaryFieldName>
+                <requestFieldName>user_id</requestFieldName>
+            </settings>
+        </dataProvider>
+    </dataSource>
+
+    <fieldset name="base_fieldset">
+        <settings>
+            <label translate="true">2FA</label>
+        </settings>
+
+        <field name="tfa_providers" formElement="input" component="Magento_TwoFactorAuth/js/form/element/providers"
+               template="ui/form/field">
+            <argument name="data" xsi:type="array">
+                <item name="config" xsi:type="array">
+                    <item name="source" xsi:type="string">tfa_edit_user_form_data_source</item>
+                </item>
+            </argument>
+            <settings>
+                <label>Providers selection</label>
+                <visible>true</visible>
+                <dataType>text</dataType>
+                <elementTmpl>Magento_TwoFactorAuth/form/element/providers</elementTmpl>
+                <dataScope>tfa_providers</dataScope>
+            </settings>
+        </field>
+    </fieldset>
+    <fieldset name="reset_fieldset">
+        <settings>
+            <label translate="true">Configuration reset</label>
+        </settings>
+        <field name="tfa_reset_providers" formElement="input"
+               component="Magento_TwoFactorAuth/js/form/element/reset_providers" template="ui/form/field">
+            <argument name="data" xsi:type="array">
+                <item name="config" xsi:type="array">
+                    <item name="source" xsi:type="string">tfa_edit_user_form_data_source</item>
+                </item>
+            </argument>
+            <settings>
+                <visible>true</visible>
+                <label>Reset Providers</label>
+                <dataType>text</dataType>
+                <elementTmpl>Magento_TwoFactorAuth/form/element/reset_providers</elementTmpl>
+            </settings>
+        </field>
+    </fieldset>
+</form>
diff --git a/TwoFactorAuth/view/adminhtml/web/css/auth.css b/TwoFactorAuth/view/adminhtml/web/css/auth.css
new file mode 100644
index 00000000..77e18ee8
--- /dev/null
+++ b/TwoFactorAuth/view/adminhtml/web/css/auth.css
@@ -0,0 +1,107 @@
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+
+.page-wrapper {
+    max-width: 55rem !important;
+}
+
+.tfa-change-provider {
+    margin-bottom: 1em;
+}
+
+.tfa-change-provider-trigger {
+    margin-bottom: 1em;
+    display: block;
+}
+
+.tfa-provider {
+    display: block;
+    background: #f0f0f0;
+    border-top: 1px solid #cccccc;
+    height: 46px;
+    padding-top: 7px;
+    padding-left: 7px;
+    cursor: pointer;
+    color: #333;
+}
+
+.tfa-provider:hover {
+    color: #888;
+}
+
+.tfa-provider::after {
+    clear: both;
+}
+
+.tfa-provider:first-child {
+    border-top: none !important;
+}
+
+.tfa-provider img {
+    width: 32px;
+    margin-right: 1em;
+    float: left;
+}
+
+.tfa-provider span {
+    font-size: 14px;
+    font-weight: bold;
+    line-height: 32px;
+    float: left;
+}
+
+.tfa-change-provider-trigger:hover {
+    background: #f0f0f0;
+}
+
+#tfa-change-provider-container {
+    margin-top: 1em;
+}
+
+.tfa-change-provider-trigger {
+    color: #333333;
+    background: #e0e0e0;
+    text-align: center;
+    padding: 8px;
+    height: 40px;
+}
+
+.tfa-change-provider-trigger img {
+    margin-right: 10px;
+    width: 24px;
+    display: block;
+    float: left;
+}
+
+.tfa-change-provider-trigger span {
+    float: left;
+    display: block;
+    line-height: 24px;
+}
+
+.tfa-change-provider-trigger::after {
+    clear: both;
+}
+
+.tfa-waitbox {
+    height: 110px;
+    text-align: center;
+    background: #f5f5f5;
+    padding: 1.5em;
+}
+
+.tfa-waitbox img {
+    width: 64px;
+}
+
+.tfa-waitbox .spinner {
+    margin-left: -20px;
+}
+
+.tfa-provider .tfa-checkbox {
+    width: 32px;
+    margin-right: 1em;
+    float: left;
+}
diff --git a/TwoFactorAuth/view/adminhtml/web/css/authy.css b/TwoFactorAuth/view/adminhtml/web/css/authy.css
new file mode 100644
index 00000000..22f3cf12
--- /dev/null
+++ b/TwoFactorAuth/view/adminhtml/web/css/authy.css
@@ -0,0 +1,36 @@
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+
+.tfa-authy-actions-list button span {
+    display: block;
+}
+
+.tfa-authy-actions-list button {
+    display: block;
+    width: 100%;
+    margin-bottom: .8em !important;
+}
+
+.tfa-authy-switch-method {
+    height: 2em;
+    line-height: 2em;
+}
+
+.tfa-authy-switch-method::after {
+    clear: both;
+}
+
+.tfa-authy-one-touch,
+.tfa-authy-login {
+    height: 115px;
+    text-align: center;
+    background: #f0f0f0;
+    padding: 1em;
+}
+
+.tfa-authy-one-touch img,
+.tfa-authy-login img {
+    width: 64px;
+}
diff --git a/TwoFactorAuth/view/adminhtml/web/css/duo.css b/TwoFactorAuth/view/adminhtml/web/css/duo.css
new file mode 100644
index 00000000..e59eac41
--- /dev/null
+++ b/TwoFactorAuth/view/adminhtml/web/css/duo.css
@@ -0,0 +1,18 @@
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+
+#duo_iframe {
+    width: 100%;
+    min-width: 304px;
+    max-width: 620px;
+    height: 330px;
+    background: transparent;
+    border: 0;
+    margin-bottom: 1em;
+}
+
+.page-layout-admin-login .page-wrapper {
+    max-width: 50rem;
+}
diff --git a/TwoFactorAuth/view/adminhtml/web/css/google.css b/TwoFactorAuth/view/adminhtml/web/css/google.css
new file mode 100644
index 00000000..8dcfc278
--- /dev/null
+++ b/TwoFactorAuth/view/adminhtml/web/css/google.css
@@ -0,0 +1,17 @@
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+
+.tfa-google-qr {
+    display: block;
+    margin: 0  auto 3em auto;
+    width: 300px;
+    height: 300px;
+}
+
+.tfa-google-secure-code {
+    word-wrap: break-word;
+    border: 1px solid #cccccc;
+    padding: 7px;
+}
diff --git a/TwoFactorAuth/view/adminhtml/web/css/tfa.css b/TwoFactorAuth/view/adminhtml/web/css/tfa.css
new file mode 100644
index 00000000..b2070e76
--- /dev/null
+++ b/TwoFactorAuth/view/adminhtml/web/css/tfa.css
@@ -0,0 +1,18 @@
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+
+.tfa-forced-providers ul {
+    margin-left: 3em;
+}
+
+.tfa-reset-providers button {
+    width: 250px;
+    margin-bottom: .4em;
+    display: block;
+}
+
+.tfa-provider {
+    margin-bottom: .2em;
+}
diff --git a/TwoFactorAuth/view/adminhtml/web/css/u2f.css b/TwoFactorAuth/view/adminhtml/web/css/u2f.css
new file mode 100644
index 00000000..97eee42d
--- /dev/null
+++ b/TwoFactorAuth/view/adminhtml/web/css/u2f.css
@@ -0,0 +1,14 @@
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+
+fieldset {
+    text-align: center;
+}
+
+.tfa-u2f-touch-key,
+.tfa-u2f-try-again {
+    margin-bottom: 1em;
+}
+
diff --git a/TwoFactorAuth/view/adminhtml/web/images/change_provider.png b/TwoFactorAuth/view/adminhtml/web/images/change_provider.png
new file mode 100644
index 00000000..2d9358d2
Binary files /dev/null and b/TwoFactorAuth/view/adminhtml/web/images/change_provider.png differ
diff --git a/TwoFactorAuth/view/adminhtml/web/images/providers/authy.png b/TwoFactorAuth/view/adminhtml/web/images/providers/authy.png
new file mode 100644
index 00000000..e730c363
Binary files /dev/null and b/TwoFactorAuth/view/adminhtml/web/images/providers/authy.png differ
diff --git a/TwoFactorAuth/view/adminhtml/web/images/providers/duo_security.png b/TwoFactorAuth/view/adminhtml/web/images/providers/duo_security.png
new file mode 100644
index 00000000..090b2bb3
Binary files /dev/null and b/TwoFactorAuth/view/adminhtml/web/images/providers/duo_security.png differ
diff --git a/TwoFactorAuth/view/adminhtml/web/images/providers/google.png b/TwoFactorAuth/view/adminhtml/web/images/providers/google.png
new file mode 100644
index 00000000..d9711200
Binary files /dev/null and b/TwoFactorAuth/view/adminhtml/web/images/providers/google.png differ
diff --git a/TwoFactorAuth/view/adminhtml/web/images/providers/u2fkey.png b/TwoFactorAuth/view/adminhtml/web/images/providers/u2fkey.png
new file mode 100644
index 00000000..d9849771
Binary files /dev/null and b/TwoFactorAuth/view/adminhtml/web/images/providers/u2fkey.png differ
diff --git a/TwoFactorAuth/view/adminhtml/web/images/u2f/touch.png b/TwoFactorAuth/view/adminhtml/web/images/u2f/touch.png
new file mode 100644
index 00000000..a83e15f1
Binary files /dev/null and b/TwoFactorAuth/view/adminhtml/web/images/u2f/touch.png differ
diff --git a/TwoFactorAuth/view/adminhtml/web/js/authy/auth.js b/TwoFactorAuth/view/adminhtml/web/js/authy/auth.js
new file mode 100644
index 00000000..5048adc0
--- /dev/null
+++ b/TwoFactorAuth/view/adminhtml/web/js/authy/auth.js
@@ -0,0 +1,218 @@
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+
+define([
+    'jquery',
+    'ko',
+    'uiComponent',
+    'Magento_TwoFactorAuth/js/error',
+    'mage/translate'
+], function ($, ko, Component, error) {
+    'use strict';
+
+    return Component.extend({
+        selectedMethod: ko.observable(''),
+        waitingText: ko.observable(''),
+        success: ko.observable(false),
+        tokenCode: ko.observable(''),
+
+        defaults: {
+            template: 'Magento_TwoFactorAuth/authy/auth'
+        },
+
+        waitForOneTouchApprovalTimeout: 0,
+
+        postUrl: '',
+        tokenRequestUrl: '',
+        oneTouchUrl: '',
+        verifyOneTouchUrl: '',
+
+        /**
+         * Get auth post URL
+         * @returns {String}
+         */
+        getPostUrl: function () {
+            return this.postUrl;
+        },
+
+        /**
+         * Get token request URL
+         * @returns {String}
+         */
+        getTokenRequestUrl: function () {
+            return this.tokenRequestUrl;
+        },
+
+        /**
+         * Get one touch request URL
+         * @returns {String}
+         */
+        getOneTouchUrl: function () {
+            return this.oneTouchUrl;
+        },
+
+        /**
+         * Get one touch verification URL
+         * @returns {String}
+         */
+        getVerifyOneTouchUrl: function () {
+            return this.verifyOneTouchUrl;
+        },
+
+        /**
+         * Get success URL
+         * @returns {String}
+         */
+        getSuccessUrl: function () {
+            return this.successUrl;
+        },
+
+        /**
+         * Go to login page
+         */
+        login: function () {
+            this.success(true);
+            self.location.href = this.getSuccessUrl();
+        },
+
+        /**
+         * Stop onetouch approval background approval
+         */
+        stopWaitingOnetouchApproval: function () {
+            if (this.waitForOneTouchApprovalTimeout) {
+                window.clearTimeout(this.waitForOneTouchApprovalTimeout);
+                this.waitForOneTouchApprovalTimeout = 0;
+            }
+        },
+
+        /**
+         * Switch to authy code validation
+         * @param {String} via
+         */
+        runSendCode: function (via) {
+            var me = this;
+
+            this.selectedMethod('code');
+
+            if (via !== 'token') {
+                $.getJSON(
+                    this.getTokenRequestUrl() + '?via=' +
+                    via
+                )
+                    .fail(function () {
+                        error.display('There was an error trying to contact Authy services');
+                        me.switchAnotherMethod();
+                    });
+            }
+        },
+
+        /**
+         * Switch to authy token code validation
+         */
+        runSendCodeToken: function () {
+            this.runSendCode('token');
+        },
+
+        /**
+         * Switch to authy sms code validation
+         */
+        runSendCodeSms: function () {
+            this.runSendCode('sms');
+        },
+
+        /**
+         * Switch to authy call code validation
+         */
+        runSendCodeCall: function () {
+            this.runSendCode('call');
+        },
+
+        /**
+         * Switch to one touch validation
+         */
+        runOneTouch: function () {
+            var me = this;
+
+            this.selectedMethod('onetouch');
+            this.waitingText('Sending push notification...');
+            this.success(false);
+
+            this.stopWaitingOnetouchApproval();
+
+            $.getJSON(this.getOneTouchUrl())
+                .done(function () {
+                    me.waitForOneTouchApproval();
+                })
+                .fail(function () {
+                    error.display('There was an error trying to contact Authy services');
+                    me.switchAnotherMethod();
+                });
+        },
+
+        /**
+         * Start background one touch approval check
+         */
+        waitForOneTouchApproval: function () {
+            var me = this;
+
+            this.waitingText('Waiting for approval...');
+
+            $.getJSON(this.getVerifyOneTouchUrl())
+                .done(function (res) {
+                    if (res.status === 'retry') {
+                        me.waitForOneTouchApprovalTimeout = window.setTimeout(function () {
+                            me.waitForOneTouchApproval();
+                        }, 1000);
+                    } else if (res.status === 'expired') {
+                        error.display($.mage.__('Your request has been expired'));
+                        me.switchAnotherMethod();
+                    } else if (res.status === 'denied') {
+                        error.display($.mage.__('Your request has been rejected'));
+                        me.switchAnotherMethod();
+                    } else if (res.status === 'approved') {
+                        me.login();
+                    }
+                })
+                .fail(function () {
+                    error.display('There was an error trying to contact Authy services');
+                    this.switchAnotherMethod();
+                });
+        },
+
+        /**
+         * Switch back to method selection
+         */
+        switchAnotherMethod: function () {
+            this.selectedMethod('');
+            this.waitingText('');
+            this.success(false);
+        },
+
+        /**
+         * Verify authy code
+         */
+        verifyCode: function () {
+            var me = this;
+
+            this.waitingText('Please wait...');
+
+            $.post(this.getPostUrl(), {
+                'tfa_code': this.tokenCode
+            })
+                .done(function (res) {
+                    if (res.success) {
+                        me.login();
+                    } else {
+                        error.display(res.message);
+                        me.waitingText('');
+                        me.tokenCode('');
+                    }
+                })
+                .fail(function () {
+                    error.display('There was an internal error trying to verify your code');
+                });
+        }
+    });
+});
diff --git a/TwoFactorAuth/view/adminhtml/web/js/authy/configure.js b/TwoFactorAuth/view/adminhtml/web/js/authy/configure.js
new file mode 100644
index 00000000..04fe4c9b
--- /dev/null
+++ b/TwoFactorAuth/view/adminhtml/web/js/authy/configure.js
@@ -0,0 +1,19 @@
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+
+define([
+    'ko',
+    'uiComponent',
+    'Magento_TwoFactorAuth/js/authy/configure/registry'
+], function (ko, Component, registry) {
+    'use strict';
+
+    return Component.extend({
+        currentStep: registry.currentStep,
+        defaults: {
+            template: 'Magento_TwoFactorAuth/authy/configure'
+        }
+    });
+});
diff --git a/TwoFactorAuth/view/adminhtml/web/js/authy/configure/register.js b/TwoFactorAuth/view/adminhtml/web/js/authy/configure/register.js
new file mode 100644
index 00000000..a40f6142
--- /dev/null
+++ b/TwoFactorAuth/view/adminhtml/web/js/authy/configure/register.js
@@ -0,0 +1,85 @@
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+
+define([
+    'jquery',
+    'ko',
+    'uiComponent',
+    'Magento_TwoFactorAuth/js/error',
+    'Magento_TwoFactorAuth/js/authy/configure/registry',
+    'mage/translate'
+], function ($, ko, Component, error, registry) {
+    'use strict';
+
+    return Component.extend({
+        configurePostUrl: '',
+        countries: [],
+
+        country: ko.observable(''),
+        phone: ko.observable(''),
+        method: ko.observable(''),
+
+        waitText: ko.observable(''),
+
+        defaults: {
+            template: 'Magento_TwoFactorAuth/authy/configure/register'
+        },
+
+        /**
+         * Get configure POST url
+         * @returns {String}
+         */
+        getConfigurePostUrl: function () {
+            return this.configurePostUrl;
+        },
+
+        /**
+         * Get a list of available countries
+         * @returns {Array}
+         */
+        getCountries: function () {
+            return this.countries;
+        },
+
+        /**
+         * Go to next step
+         */
+        nextStep: function () {
+            registry.currentStep('verify');
+            window.setTimeout(function () {
+                registry.currentStep('register');
+            }, registry.secondsToExpire() * 1000);
+        },
+
+        /**
+         * Start Authy registration procedure
+         */
+        doRegister: function () {
+            var me = this;
+
+            this.waitText('Please wait...');
+            $.post(this.getConfigurePostUrl(), {
+                'tfa_country': this.country(),
+                'tfa_phone': this.phone(),
+                'tfa_method': this.method()
+
+            })
+                .done(function (res) {
+                    if (res.success) {
+                        registry.messageText(res.message);
+                        registry.secondsToExpire(res['seconds_to_expire']);
+                        me.nextStep();
+                    } else {
+                        error.display(res.message);
+                    }
+                    me.waitText('');
+                })
+                .fail(function () {
+                    error.display('There was an internal error trying to verify your code');
+                    me.waitText('');
+                });
+        }
+    });
+});
diff --git a/TwoFactorAuth/view/adminhtml/web/js/authy/configure/registry.js b/TwoFactorAuth/view/adminhtml/web/js/authy/configure/registry.js
new file mode 100644
index 00000000..dcf101a8
--- /dev/null
+++ b/TwoFactorAuth/view/adminhtml/web/js/authy/configure/registry.js
@@ -0,0 +1,16 @@
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+
+define([
+    'ko'
+], function (ko) {
+    'use strict';
+
+    return {
+        currentStep: ko.observable('register'),
+        messageText: ko.observable(''),
+        secondsToExpire: ko.observable(0)
+    };
+});
diff --git a/TwoFactorAuth/view/adminhtml/web/js/authy/configure/verify.js b/TwoFactorAuth/view/adminhtml/web/js/authy/configure/verify.js
new file mode 100644
index 00000000..95be978d
--- /dev/null
+++ b/TwoFactorAuth/view/adminhtml/web/js/authy/configure/verify.js
@@ -0,0 +1,75 @@
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+
+define([
+    'jquery',
+    'ko',
+    'uiComponent',
+    'Magento_TwoFactorAuth/js/error',
+    'Magento_TwoFactorAuth/js/authy/configure/registry',
+    'mage/translate'
+], function ($, ko, Component, error, registry) {
+    'use strict';
+
+    return Component.extend({
+        verifyCode: ko.observable(''),
+        messageText: registry.messageText,
+        waitText: ko.observable(''),
+
+        verifyPostUrl: '',
+        successUrl: '',
+
+        defaults: {
+            template: 'Magento_TwoFactorAuth/authy/configure/verify'
+        },
+
+        /**
+         * Get verification post URL
+         * @returns {String}
+         */
+        getVerifyPostUrl: function () {
+            return this.verifyPostUrl;
+        },
+
+        /**
+         * Go to next step
+         */
+        nextStep: function () {
+            registry.currentStep('login');
+            self.location.href = this.successUrl;
+        },
+
+        /**
+         * Verify auth code
+         */
+        doVerify: function () {
+            var me = this;
+
+            this.waitText('Please wait...');
+            $.post(this.getVerifyPostUrl(), {
+                'tfa_verify': this.verifyCode()
+            })
+                .done(function (res) {
+                    if (res.success) {
+                        me.nextStep();
+                    } else {
+                        error.display(res.message);
+                    }
+                    me.waitText('');
+                })
+                .fail(function () {
+                    error.display('There was an internal error trying to verify your code');
+                    me.waitText('');
+                });
+        },
+
+        /**
+         * Go to previous step to change phone number
+         */
+        changePhoneNumber: function () {
+            registry.currentStep('register');
+        }
+    });
+});
diff --git a/TwoFactorAuth/view/adminhtml/web/js/change_provider.js b/TwoFactorAuth/view/adminhtml/web/js/change_provider.js
new file mode 100644
index 00000000..431ecc47
--- /dev/null
+++ b/TwoFactorAuth/view/adminhtml/web/js/change_provider.js
@@ -0,0 +1,45 @@
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+
+define([
+    'uiComponent',
+    'ko'
+], function (Component, ko) {
+    'use strict';
+
+    return Component.extend({
+        showChangeMethod: ko.observable(false),
+
+        providers: [],
+        switchIcon: '',
+
+        defaults: {
+            template: 'Magento_TwoFactorAuth/change_provider'
+        },
+
+        /**
+         * Get switch icon URL
+         * @returns {String}
+         */
+        getSwitchIconUrl: function () {
+            return this.switchIcon;
+        },
+
+        /**
+         * Show available alternative 2FA providers
+         */
+        displayChangeMethod: function () {
+            this.showChangeMethod(true);
+        },
+
+        /**
+         * Return a list of alternative providers
+         * @returns {Array}
+         */
+        getProviders: function () {
+            return this.providers;
+        }
+    });
+});
diff --git a/TwoFactorAuth/view/adminhtml/web/js/duo/api.js b/TwoFactorAuth/view/adminhtml/web/js/duo/api.js
new file mode 100644
index 00000000..27cf3d0f
--- /dev/null
+++ b/TwoFactorAuth/view/adminhtml/web/js/duo/api.js
@@ -0,0 +1,439 @@
+/**
+ * Duo Web SDK v2
+ * Copyright 2017, Duo Security
+ */
+
+/* eslint-disable */
+// jscs:disable
+
+(function (root, factory) {
+/* eslint-disable */
+if (typeof define === 'function' && define.amd) {
+    // AMD. Register as an anonymous module.
+    define([], factory);
+} else if (typeof module === 'object' && module.exports) {
+    // Node. Does not work with strict CommonJS, but
+    // only CommonJS-like environments that support module.exports,
+    // like Node.
+    module.exports = factory();
+} else {
+    // Browser globals (root is window)
+    var Duo = factory();
+    // If the Javascript was loaded via a script tag, attempt to autoload
+    // the frame.
+
+    Duo._onReady(Duo.init);
+
+    // Attach Duo to the `window` object
+    root.Duo = Duo;
+}
+}(this, function () {
+    var DUO_MESSAGE_FORMAT = /^(?:AUTH|ENROLL)+\|[A-Za-z0-9\+\/=]+\|[A-Za-z0-9\+\/=]+$/;
+    var DUO_ERROR_FORMAT = /^ERR\|[\w\s\.\(\)]+$/;
+    var DUO_OPEN_WINDOW_FORMAT = /^DUO_OPEN_WINDOW\|/;
+    var VALID_OPEN_WINDOW_DOMAINS = [
+      'duo.com',
+      'duosecurity.com',
+      'duomobile.s3-us-west-1.amazonaws.com'
+    ];
+
+    var iframeId = 'duo_iframe',
+      postAction = '',
+      postArgument = 'sig_response',
+      host,
+      sigRequest,
+      duoSig,
+      appSig,
+      iframe,
+      submitCallback;
+
+    function throwError(message, url) {
+        throw new Error(
+          'Duo Web SDK error: ' + message +
+          (url ? '\n' + 'See ' + url + ' for more information' : '')
+        );
+    }
+
+    function hyphenize(str) {
+        return str.replace(/([a-z])([A-Z])/, '$1-$2').toLowerCase();
+    }
+
+    // cross-browser data attributes
+    function getDataAttribute(element, name) {
+        if ('dataset' in element) {
+            return element.dataset[name];
+        }
+
+        return element.getAttribute('data-' + hyphenize(name));
+
+    }
+
+    // cross-browser event binding/unbinding
+    function on(context, event, fallbackEvent, callback) {
+        if ('addEventListener' in window) {
+            context.addEventListener(event, callback, false);
+        } else {
+            context.attachEvent(fallbackEvent, callback);
+        }
+    }
+
+    function off(context, event, fallbackEvent, callback) {
+        if ('removeEventListener' in window) {
+            context.removeEventListener(event, callback, false);
+        } else {
+            context.detachEvent(fallbackEvent, callback);
+        }
+    }
+
+    function onReady(callback) {
+        on(document, 'DOMContentLoaded', 'onreadystatechange', callback);
+    }
+
+    function offReady(callback) {
+        off(document, 'DOMContentLoaded', 'onreadystatechange', callback);
+    }
+
+    function onMessage(callback) {
+        on(window, 'message', 'onmessage', callback);
+    }
+
+    function offMessage(callback) {
+        off(window, 'message', 'onmessage', callback);
+    }
+
+    /**
+     * Parse the sig_request parameter, throwing errors if the token contains
+     * a server error or if the token is invalid.
+     *
+     * @param {String} sig Request token
+     */
+    function parseSigRequest(sig) {
+        if (!sig) {
+            // nothing to do
+            return;
+        }
+
+        // see if the token contains an error, throwing it if it does
+        if (sig.indexOf('ERR|') === 0) {
+            throwError(sig.split('|')[1]);
+        }
+
+        // validate the token
+        if (sig.indexOf(':') === -1 || sig.split(':').length !== 2) {
+            throwError(
+              'Duo was given a bad token.  This might indicate a configuration ' +
+              'problem with one of Duo\'s client libraries.',
+              'https://www.duosecurity.com/docs/duoweb#first-steps'
+            );
+        }
+
+        var sigParts = sig.split(':');
+
+        // hang on to the token, and the parsed duo and app sigs
+        sigRequest = sig;
+        duoSig = sigParts[0];
+        appSig = sigParts[1];
+
+        return {
+            sigRequest: sig,
+            duoSig: sigParts[0],
+            appSig: sigParts[1]
+        };
+    }
+
+    /**
+     * This function is set up to run when the DOM is ready, if the iframe was
+     * not available during `init`.
+     */
+    function onDOMReady() {
+        iframe = document.getElementById(iframeId);
+
+        if (!iframe) {
+            throw new Error(
+              'This page does not contain an iframe for Duo to use.' +
+              'Add an element like <iframe id="duo_iframe"></iframe> ' +
+              'to this page.  ' +
+              'See https://www.duosecurity.com/docs/duoweb#3.-show-the-iframe ' +
+              'for more information.'
+            );
+        }
+
+        // we've got an iframe, away we go!
+        ready();
+
+        // always clean up after yourself
+        offReady(onDOMReady);
+    }
+
+    /**
+     * Validate that a MessageEvent came from the Duo service, and that it
+     * is a properly formatted payload.
+     *
+     * The Google Chrome sign-in page injects some JS into pages that also
+     * make use of postMessage, so we need to do additional validation above
+     * and beyond the origin.
+     *
+     * @param {MessageEvent} event Message received via postMessage
+     */
+    function isDuoMessage(event) {
+        return Boolean(
+          event.origin === 'https://' + host &&
+          typeof event.data === 'string' &&
+          (
+            event.data.match(DUO_MESSAGE_FORMAT) ||
+            event.data.match(DUO_ERROR_FORMAT) ||
+            event.data.match(DUO_OPEN_WINDOW_FORMAT)
+          )
+        );
+    }
+
+    /**
+     * Validate the request token and prepare for the iframe to become ready.
+     *
+     * All options below can be passed into an options hash to `Duo.init`, or
+     * specified on the iframe using `data-` attributes.
+     *
+     * Options specified using the options hash will take precedence over
+     * `data-` attributes.
+     *
+     * Example using options hash:
+     * ```javascript
+     * Duo.init({
+       *     iframe: "some_other_id",
+       *     host: "api-main.duo.test",
+       *     sig_request: "...",
+       *     post_action: "/auth",
+       *     post_argument: "resp"
+       * });
+     * ```
+     *
+     * Example using `data-` attributes:
+     * ```
+     * <iframe id="duo_iframe"
+     *         data-host="api-main.duo.test"
+     *         data-sig-request="..."
+     *         data-post-action="/auth"
+     *         data-post-argument="resp"
+     *         >
+     * </iframe>
+     * ```
+     *
+     * @param {Object} options
+     * @param {String} options.iframe                         The iframe, or id of an iframe to set up
+     * @param {String} options.host                           Hostname
+     * @param {String} options.sig_request                    Request token
+     * @param {String} [options.post_action='']               URL to POST back to after successful auth
+     * @param {String} [options.post_argument='sig_response'] Parameter name to use for response token
+     * @param {Function} [options.submit_callback]            If provided, duo will not submit the form instead execute
+     *                                                        the callback function with reference to the "duo_form" form object
+     *                                                        submit_callback can be used to prevent the webpage from reloading.
+     */
+    function init(options) {
+        if (options) {
+            if (options.host) {
+                host = options.host;
+            }
+
+            if (options.sig_request) {
+                parseSigRequest(options.sig_request);
+            }
+
+            if (options.post_action) {
+                postAction = options.post_action;
+            }
+
+            if (options.post_argument) {
+                postArgument = options.post_argument;
+            }
+
+            if (options.iframe) {
+                if (options.iframe.tagName) {
+                    iframe = options.iframe;
+                } else if (typeof options.iframe === 'string') {
+                    iframeId = options.iframe;
+                }
+            }
+
+            if (typeof options.submit_callback === 'function') {
+                submitCallback = options.submit_callback;
+            }
+        }
+
+        // if we were given an iframe, no need to wait for the rest of the DOM
+        if (iframe) {
+            ready();
+        } else {
+            // try to find the iframe in the DOM
+            iframe = document.getElementById(iframeId);
+
+            // iframe is in the DOM, away we go!
+            if (iframe) {
+                ready();
+            } else {
+                // wait until the DOM is ready, then try again
+                onReady(onDOMReady);
+            }
+        }
+
+        // always clean up after yourself!
+        offReady(init);
+    }
+
+    /**
+     * This function is called when a message was received from another domain
+     * using the `postMessage` API.  Check that the event came from the Duo
+     * service domain, and that the message is a properly formatted payload,
+     * then perform the post back to the primary service.
+     *
+     * @param event Event object (contains origin and data)
+     */
+    function onReceivedMessage(event) {
+        if (isDuoMessage(event)) {
+            if (event.data.match(DUO_OPEN_WINDOW_FORMAT)) {
+                var url = event.data.substring('DUO_OPEN_WINDOW|'.length);
+
+                if (isValidUrlToOpen(url)) {
+                    // Open the URL that comes after the DUO_WINDOW_OPEN token.
+                    window.open(url, '_self');
+                }
+            } else {
+                // the event came from duo, do the post back
+                doPostBack(event.data);
+
+                // always clean up after yourself!
+                offMessage(onReceivedMessage);
+            }
+        }
+    }
+
+    /**
+     * Validate that this passed in URL is one that we will actually allow to
+     * be opened.
+     * @param url String URL that the message poster wants to open
+     * @returns {boolean} true if we allow this url to be opened in the window
+     */
+    function isValidUrlToOpen(url) {
+        if (!url) {
+            return false;
+        }
+
+        var parser = document.createElement('a');
+
+        parser.href = url;
+
+        if (parser.protocol === 'duotrustedendpoints:') {
+            return true;
+        } else if (parser.protocol !== 'https:') {
+            return false;
+        }
+
+        for (var i = 0; i < VALID_OPEN_WINDOW_DOMAINS.length; i++) {
+            if (parser.hostname.endsWith('.' + VALID_OPEN_WINDOW_DOMAINS[i]) ||
+              parser.hostname === VALID_OPEN_WINDOW_DOMAINS[i]) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    /**
+     * Point the iframe at Duo, then wait for it to postMessage back to us.
+     */
+    function ready() {
+        if (!host) {
+            host = getDataAttribute(iframe, 'host');
+
+            if (!host) {
+                throwError(
+                  'No API hostname is given for Duo to use.  Be sure to pass ' +
+                  'a `host` parameter to Duo.init, or through the `data-host` ' +
+                  'attribute on the iframe element.',
+                  'https://www.duosecurity.com/docs/duoweb#3.-show-the-iframe'
+                );
+            }
+        }
+
+        if (!duoSig || !appSig) {
+            parseSigRequest(getDataAttribute(iframe, 'sigRequest'));
+
+            if (!duoSig || !appSig) {
+                throwError(
+                  'No valid signed request is given.  Be sure to give the ' +
+                  '`sig_request` parameter to Duo.init, or use the ' +
+                  '`data-sig-request` attribute on the iframe element.',
+                  'https://www.duosecurity.com/docs/duoweb#3.-show-the-iframe'
+                );
+            }
+        }
+
+        // if postAction/Argument are defaults, see if they are specified
+        // as data attributes on the iframe
+        if (postAction === '') {
+            postAction = getDataAttribute(iframe, 'postAction') || postAction;
+        }
+
+        if (postArgument === 'sig_response') {
+            postArgument = getDataAttribute(iframe, 'postArgument') || postArgument;
+        }
+
+        // point the iframe at Duo
+        iframe.src = [
+          'https://', host, '/frame/web/v1/auth?tx=', duoSig,
+          '&parent=', encodeURIComponent(document.location.href),
+          '&v=2.6'
+        ].join('');
+
+        // listen for the 'message' event
+        onMessage(onReceivedMessage);
+    }
+
+    /**
+     * We received a postMessage from Duo.  POST back to the primary service
+     * with the response token, and any additional user-supplied parameters
+     * given in form#duo_form.
+     */
+    function doPostBack(response) {
+        // create a hidden input to contain the response token
+        var input = document.createElement('input');
+
+        input.type = 'hidden';
+        input.name = postArgument;
+        input.value = response + ':' + appSig;
+
+        // user may supply their own form with additional inputs
+        var form = document.getElementById('duo_form');
+
+        // if the form doesn't exist, create one
+        if (!form) {
+            form = document.createElement('form');
+
+            // insert the new form after the iframe
+            iframe.parentElement.insertBefore(form, iframe.nextSibling);
+        }
+
+        // make sure we are actually posting to the right place
+        form.method = 'POST';
+        form.action = postAction;
+
+        // add the response token input to the form
+        form.appendChild(input);
+
+        // away we go!
+        if (typeof submitCallback === 'function') {
+            submitCallback.call(null, form);
+        } else {
+            form.submit();
+        }
+    }
+
+    return {
+        init: init,
+        _onReady: onReady,
+        _parseSigRequest: parseSigRequest,
+        _isDuoMessage: isDuoMessage,
+        _doPostBack: doPostBack
+    };
+}));
+
+/* eslint-enable */
diff --git a/TwoFactorAuth/view/adminhtml/web/js/duo/auth.js b/TwoFactorAuth/view/adminhtml/web/js/duo/auth.js
new file mode 100644
index 00000000..c94de8b9
--- /dev/null
+++ b/TwoFactorAuth/view/adminhtml/web/js/duo/auth.js
@@ -0,0 +1,58 @@
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+
+define([
+    'ko',
+    'uiComponent',
+    'Magento_TwoFactorAuth/js/duo/api'
+], function (ko, Component, duo) {
+    'use strict';
+
+    return Component.extend({
+        currentStep: ko.observable('register'),
+
+        defaults: {
+            template: 'Magento_TwoFactorAuth/duo/auth'
+        },
+
+        signature: '',
+        apiHost: '',
+        postUrl: '',
+        authenticateData: {},
+
+        /**
+         * Start waiting loop
+         */
+        onAfterRender: function () {
+            window.setTimeout(function () {
+                duo.init();
+            }, 100);
+        },
+
+        /**
+         * Get POST URL
+         * @returns {String}
+         */
+        getPostUrl: function () {
+            return this.postUrl;
+        },
+
+        /**
+         * Get signature
+         * @returns {String}
+         */
+        getSignature: function () {
+            return this.signature;
+        },
+
+        /**
+         * Get API host
+         * @returns {String}
+         */
+        getApiHost: function () {
+            return this.apiHost;
+        }
+    });
+});
diff --git a/TwoFactorAuth/view/adminhtml/web/js/error.js b/TwoFactorAuth/view/adminhtml/web/js/error.js
new file mode 100644
index 00000000..3708cf6f
--- /dev/null
+++ b/TwoFactorAuth/view/adminhtml/web/js/error.js
@@ -0,0 +1,25 @@
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+
+define([
+    'jquery',
+    'Magento_Ui/js/modal/alert',
+    'mage/translate'
+], function ($, alert) {
+    'use strict';
+
+    return {
+        /**
+         * Display an error message
+         * @param {String} message
+         */
+        display: function (message) {
+            alert({
+                title: $.mage.__('Error'),
+                content: message
+            });
+        }
+    };
+});
diff --git a/TwoFactorAuth/view/adminhtml/web/js/form/element/providers.js b/TwoFactorAuth/view/adminhtml/web/js/form/element/providers.js
new file mode 100644
index 00000000..207c3fd1
--- /dev/null
+++ b/TwoFactorAuth/view/adminhtml/web/js/form/element/providers.js
@@ -0,0 +1,45 @@
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+
+define(['Magento_Ui/js/form/element/abstract'], function (Abstract) {
+    'use strict';
+
+    return Abstract.extend({
+        /**
+         * Get a list of forced providers
+         * @returns {Array}
+         */
+        getForcedProviders: function () {
+            //jscs:disable requireCamelCaseOrUpperCaseIdentifiers
+            return this.forced_providers;
+        },
+
+        /**
+         * Get a list of enabled providers
+         * @returns {Array}
+         */
+        getEnabledProviders: function () {
+            //jscs:disable requireCamelCaseOrUpperCaseIdentifiers
+            return this.enabled_providers;
+        },
+
+        /**
+         * Return true if a provider is selected
+         * @param {String} provider
+         * @returns {Boolean}
+         */
+        isSelected: function (provider) {
+            var i, providers = this.value();
+
+            for (i = 0; i < providers.length; i++) {
+                if (providers[i] === provider) {
+                    return true;
+                }
+            }
+
+            return false;
+        }
+    });
+});
diff --git a/TwoFactorAuth/view/adminhtml/web/js/form/element/reset_providers.js b/TwoFactorAuth/view/adminhtml/web/js/form/element/reset_providers.js
new file mode 100644
index 00000000..0feacc76
--- /dev/null
+++ b/TwoFactorAuth/view/adminhtml/web/js/form/element/reset_providers.js
@@ -0,0 +1,37 @@
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+
+define([
+  'Magento_Ui/js/form/element/abstract',
+  'Magento_Ui/js/modal/confirm'
+], function (Abstract, confirm) {
+    'use strict';
+
+    return Abstract.extend({
+        /**
+         * Get a list of providers with reset option
+         * @returns {Array}
+         */
+        getResetProviders: function () {
+            return this.source.data['reset_providers'] ? this.source.data['reset_providers'] : [];
+        },
+
+        /**
+         * Reset a provider
+         * @param {Object} item
+         */
+        resetProvider: function (item) {
+            confirm({
+                title: 'Confirm',
+                content: 'Are you sure you want to reset ' + item.label + ' provider?',
+                actions: {
+                    confirm: function () { // jscs:ignore jsDoc
+                        self.location.href = item.url;
+                    }
+                }
+            });
+        }
+    });
+});
diff --git a/TwoFactorAuth/view/adminhtml/web/js/form/provider.js b/TwoFactorAuth/view/adminhtml/web/js/form/provider.js
new file mode 100644
index 00000000..ad74c487
--- /dev/null
+++ b/TwoFactorAuth/view/adminhtml/web/js/form/provider.js
@@ -0,0 +1,21 @@
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+
+define([
+    'Magento_Ui/js/form/provider'
+], function (Provider) {
+    'use strict';
+
+    return Provider.extend({
+        /**
+         * @see Magento_Ui/js/form/provider
+         * @returns {Element}
+         */
+        save: function () {
+            // Disable independent save (we have a parent form with own validation)
+            return this;
+        }
+    });
+});
diff --git a/TwoFactorAuth/view/adminhtml/web/js/google/auth.js b/TwoFactorAuth/view/adminhtml/web/js/google/auth.js
new file mode 100644
index 00000000..f97447a6
--- /dev/null
+++ b/TwoFactorAuth/view/adminhtml/web/js/google/auth.js
@@ -0,0 +1,85 @@
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+
+define([
+    'jquery',
+    'ko',
+    'uiComponent',
+    'Magento_TwoFactorAuth/js/error',
+], function ($, ko, Component, error) {
+    'use strict';
+
+    return Component.extend({
+        currentStep: ko.observable('register'),
+        waitText: ko.observable(''),
+        verifyCode: ko.observable(''),
+        defaults: {
+            template: 'Magento_TwoFactorAuth/google/auth'
+        },
+
+        qrCodeUrl: '',
+        postUrl: '',
+        successUrl: '',
+        secretCode: '',
+
+        /**
+         * Get QR code URL
+         * @returns {String}
+         */
+        getQrCodeUrl: function () {
+            return this.qrCodeUrl;
+        },
+
+        /**
+         * Get POST URL
+         * @returns {String}
+         */
+        getPostUrl: function () {
+            return this.postUrl;
+        },
+
+        /**
+         * Get plain Secret Code
+         * @returns {String}
+         * @author Konrad Skrzynski <konrad.skrzynski@accenture.com>
+         */
+        getSecretCode: function () {
+            return this.secretCode;
+        },
+
+        /**
+         * Go to next step
+         */
+        nextStep: function () {
+            this.currentStep('login');
+            self.location.href = this.successUrl;
+        },
+
+        /**
+         * Verify auth code
+         */
+        doVerify: function () {
+            var me = this;
+
+            this.waitText('Please wait...');
+            $.post(this.getPostUrl(), {
+                'tfa_code': this.verifyCode()
+            })
+                .done(function (res) {
+                    if (res.success) {
+                        me.nextStep();
+                    } else {
+                        error.display(res.message);
+                        me.verifyCode('');
+                    }
+                    me.waitText('');
+                })
+                .fail(function () {
+                    error.display('There was an internal error trying to verify your code');
+                    me.waitText('');
+                });
+        }
+    });
+});
diff --git a/TwoFactorAuth/view/adminhtml/web/js/system/config/providers.js b/TwoFactorAuth/view/adminhtml/web/js/system/config/providers.js
new file mode 100644
index 00000000..de9a4246
--- /dev/null
+++ b/TwoFactorAuth/view/adminhtml/web/js/system/config/providers.js
@@ -0,0 +1,64 @@
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+
+define([
+    'jquery',
+    'mage/translate',
+    'Magento_Ui/js/modal/confirm',
+    'domReady!'
+], function ($, $t, confirm) {
+    'use strict';
+
+    return function (config, element) {
+
+        var $element = $(element),
+            initialValue = $element.val();
+
+        element.on('blur', function () {
+            var currentValue = $element.val();
+
+            if (currentValue && currentValue.some(function (item) {
+                return initialValue.indexOf(item) !== -1;
+            })) {
+                return;
+            }
+
+            confirm({
+                title: config.modalTitleText,
+                content: config.modalContentBody,
+                buttons: [{
+                    text: $t('Cancel'),
+                    class: 'action-secondary action-dismiss',
+
+                    /**
+                     * Close modal and trigger 'cancel' action on click
+                     */
+                    click: function (event) {
+                        this.closeModal(event);
+                    }
+                }, {
+                    text: $t('Confirm'),
+                    class: 'action-primary action-accept',
+
+                    /**
+                     * Close modal and trigger 'confirm' action on click
+                     */
+                    click: function (event) {
+                        this.closeModal(event, true);
+                    }
+                }],
+                actions: {
+
+                    /**
+                     * Revert back to original Enabled setting
+                     */
+                    cancel: function () {
+                        $element.val(initialValue);
+                    }
+                }
+            });
+        });
+    };
+});
diff --git a/TwoFactorAuth/view/adminhtml/web/js/u2fkey/auth.js b/TwoFactorAuth/view/adminhtml/web/js/u2fkey/auth.js
new file mode 100644
index 00000000..713b488f
--- /dev/null
+++ b/TwoFactorAuth/view/adminhtml/web/js/u2fkey/auth.js
@@ -0,0 +1,163 @@
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+
+define([
+    'jquery',
+    'ko',
+    'uiComponent',
+    'Magento_TwoFactorAuth/js/error',
+    'Magento_TwoFactorAuth/js/u2fkey/utils',
+    'mage/translate'
+], function ($, ko, Component, error, utils, $t) {
+    'use strict';
+
+    return Component.extend({
+        currentStep: ko.observable('register'),
+
+        defaults: {
+            template: 'Magento_TwoFactorAuth/u2fkey/auth',
+            idle: ko.observable(true),
+            loading: ko.observable(false)
+        },
+
+        postUrl: '',
+        successUrl: '',
+        touchImageUrl: '',
+        authenticateData: {},
+
+        /**
+         * @inheritdoc
+         */
+        initConfig: function (config) {
+            this._super(config);
+            this.authenticateData.credentialRequestOptions.challenge = new Uint8Array(
+                this.authenticateData.credentialRequestOptions.challenge
+            );
+
+            this.authenticateData.credentialRequestOptions.allowCredentials =
+                this.authenticateData.credentialRequestOptions.allowCredentials.map(function (credential) {
+                    credential.id = new Uint8Array(credential.id);
+
+                    return credential;
+                });
+
+            return this;
+        },
+
+        /**
+         * Start waiting loop
+         */
+        onAfterRender: function () {
+            this.waitForTouch();
+        },
+
+        /**
+         * Get touch image URL
+         * @returns {String}
+         */
+        getTouchImageUrl: function () {
+            return this.touchImageUrl;
+        },
+
+        /**
+         * Get POST URL
+         * @returns {String}
+         */
+        getPostUrl: function () {
+            return this.postUrl;
+        },
+
+        /**
+         * Get success URL
+         * @returns {String}
+         */
+        getSuccessUrl: function () {
+            return this.successUrl;
+        },
+
+        /**
+         * Wait for key touch
+         */
+        waitForTouch: function () {
+            this.idle(false);
+            navigator.credentials.get({
+                publicKey: this.authenticateData.credentialRequestOptions
+            })
+            .then(this._onCredentialSuccess.bind(this))
+            .catch(this._onCredentialError.bind(this));
+        },
+
+        /**
+         * Handle WebAuthn success
+         *
+         * @param {Object} credentialData
+         * @returns void
+         * @private
+         */
+        _onCredentialSuccess: function (credentialData) {
+            utils.asyncUint8ArrayToUtf8String(
+                new Uint8Array(credentialData.response.clientDataJSON),
+                function (clientDataJSON) {
+                    credentialData.clientDataUtf8JSON = clientDataJSON;
+                    credentialData.clientData = JSON.parse(clientDataJSON);
+                    this._processCredentialData(credentialData);
+                }.bind(this)
+            );
+        },
+
+        /**
+         * Validate and submit response from u2f key
+         *
+         * @param {Object} credentialData
+         * @private
+         */
+        _processCredentialData: function (credentialData) {
+            this.loading(true);
+            $.post(this.getPostUrl(), {
+                publicKeyCredential: {
+                    type: credentialData.type,
+                    id: utils.arrayBufferToBase64(credentialData.rawId),
+                    response: {
+                        authenticatorData: utils.arrayBufferToBase64(credentialData.response.authenticatorData),
+                        clientData: credentialData.clientData,
+                        clientDataJSON: credentialData.clientDataUtf8JSON,
+                        signature: utils.arrayBufferToBase64(credentialData.response.signature)
+                    }
+                }
+            })
+            .done(function (res) {
+                this.loading(false);
+
+                if (res.success) {
+                    this.currentStep('login');
+                    self.location.href = this.getSuccessUrl();
+                } else {
+                    error.display($t('Invalid key or key is not registered.'));
+                    this.idle(true);
+                }
+            }.bind(this))
+            .fail(function () {
+                error.display($t('Invalid key or key is not registered.'));
+                this.loading(false);
+                this.idle(true);
+            }.bind(this));
+        },
+
+        /**
+         * Handle WebAuthn failure
+         *
+         * @param {Object} u2fError
+         * @return void
+         * @private
+         */
+        _onCredentialError: function (u2fError) {
+            this.idle(true);
+
+            if (['AbortError', 'NS_ERROR_ABORT', 'NotAllowedError'].indexOf(u2fError.name) === -1) {
+                error.display($t('Unable to register your device'));
+            }
+        }
+    });
+});
diff --git a/TwoFactorAuth/view/adminhtml/web/js/u2fkey/configure.js b/TwoFactorAuth/view/adminhtml/web/js/u2fkey/configure.js
new file mode 100644
index 00000000..46498652
--- /dev/null
+++ b/TwoFactorAuth/view/adminhtml/web/js/u2fkey/configure.js
@@ -0,0 +1,155 @@
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+
+define([
+    'jquery',
+    'ko',
+    'uiComponent',
+    'Magento_TwoFactorAuth/js/error',
+    'Magento_TwoFactorAuth/js/u2fkey/utils',
+    'mage/translate'
+], function ($, ko, Component, error, utils, $t) {
+    'use strict';
+
+    return Component.extend({
+        currentStep: ko.observable('register'),
+
+        defaults: {
+            template: 'Magento_TwoFactorAuth/u2fkey/configure',
+            idle: ko.observable(true),
+            loading: ko.observable(false)
+        },
+
+        postUrl: '',
+        successUrl: '',
+        touchImageUrl: '',
+        registerData: {},
+
+        /**
+         * @inheritdoc
+         */
+        initConfig: function (config) {
+            this._super(config);
+            this.registerData.publicKey.challenge = new Uint8Array(this.registerData.publicKey.challenge);
+            this.registerData.publicKey.user.id = new Uint8Array(this.registerData.publicKey.user.id);
+
+            return this;
+        },
+
+        /**
+         * Start waiting loop
+         */
+        onAfterRender: function () {
+            this.waitForTouch();
+        },
+
+        /**
+         * Get touch image URL
+         *
+         * @returns {String}
+         */
+        getTouchImageUrl: function () {
+            return this.touchImageUrl;
+        },
+
+        /**
+         * Get POST URL
+         *
+         * @returns {String}
+         */
+        getPostUrl: function () {
+            return this.postUrl;
+        },
+
+        /**
+         * Get success URL
+         * @returns {String}
+         */
+        getSuccessUrl: function () {
+            return this.successUrl;
+        },
+
+        /**
+         * Wait for key touch
+         */
+        waitForTouch: function () {
+            this.idle(false);
+            navigator.credentials.create({
+                publicKey: this.registerData.publicKey
+            })
+            .then(this._onCredentialSuccess.bind(this))
+            .catch(this._onCredentialError.bind(this));
+        },
+
+        /**
+         * Handle WebAuthn success
+         *
+         * @param {Object} credentialData
+         * @returns void
+         * @private
+         */
+        _onCredentialSuccess: function (credentialData) {
+            utils.asyncUint8ArrayToUtf8String(
+                new Uint8Array(credentialData.response.clientDataJSON),
+                function (clientDataJSON) {
+                    credentialData.clientData = JSON.parse(clientDataJSON);
+                    this._processCredentialData(credentialData);
+                }.bind(this)
+            );
+        },
+
+        /**
+         * Validate and submit response from u2f key
+         *
+         * @param {Object} credentialData
+         * @private
+         */
+        _processCredentialData: function (credentialData) {
+            this.loading(true);
+            $.post(this.getPostUrl(), {
+                publicKeyCredential: {
+                    id: utils.arrayBufferToBase64(credentialData.rawId),
+                    response: {
+                        clientData: credentialData.clientData,
+                        attestationObject: utils.arrayBufferToBase64(
+                            credentialData.response.attestationObject
+                        )
+                    }
+                }
+            })
+            .done(function (res) {
+                this.loading(false);
+
+                if (res.success) {
+                    this.currentStep('login');
+                    self.location.href = this.getSuccessUrl();
+                } else {
+                    error.display($t('There was an error processing your key.'));
+                    this.idle(true);
+                }
+            }.bind(this))
+            .fail(function () {
+                error.display($t('Unable to register your device'));
+                this.loading(false);
+                this.idle(true);
+            }.bind(this));
+        },
+
+        /**
+         * Handle WebAuthn failure
+         *
+         * @param {Object} u2fError
+         * @return void
+         * @private
+         */
+        _onCredentialError: function (u2fError) {
+            this.idle(true);
+
+            if (['AbortError', 'NS_ERROR_ABORT', 'NotAllowedError'].indexOf(u2fError.name) === -1) {
+                error.display($t('Unable to register your device'));
+            }
+        }
+    });
+});
diff --git a/TwoFactorAuth/view/adminhtml/web/js/u2fkey/utils.js b/TwoFactorAuth/view/adminhtml/web/js/u2fkey/utils.js
new file mode 100644
index 00000000..f09bdd61
--- /dev/null
+++ b/TwoFactorAuth/view/adminhtml/web/js/u2fkey/utils.js
@@ -0,0 +1,65 @@
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+
+define([], function () {
+    'use strict';
+
+    return {
+        /**
+         * Constructor
+         *
+         * @returns {self}
+         * @constructor
+         */
+        'Magento_TwoFactorAuth/js/u2fkey/utils': function () {
+            return this;
+        },
+
+        /**
+         * Convert an array buffer to base64
+         *
+         * @param {ArrayBuffer} buffer
+         * @returns {String}
+         * @private
+         */
+        arrayBufferToBase64: function (buffer) {
+            var binary = '',
+                bytes = new Uint8Array(buffer),
+                len = bytes.byteLength,
+                i = 0;
+
+            for (i = 0; i < len; i++) {
+                binary += String.fromCharCode(bytes[i]);
+            }
+
+            return window.btoa(binary)
+                .replace(/\-/g, '+')
+                .replace(/_/g, '/');
+        },
+
+        /**
+         * Convert a Uint8Array to a UTF-8 string using cross-browser safe methods
+         *
+         * @param {Uint8Array} uint8array
+         * @param {Function} callback
+         * @private
+         */
+        asyncUint8ArrayToUtf8String: function (uint8array, callback) {
+            var blob = new Blob([uint8array]),
+                fileReader = new FileReader();
+
+            /**
+             * Handle loaded
+             *
+             * @param {Event} e
+             */
+            fileReader.onload = function (e) {
+                callback(e.target.result);
+            };
+
+            fileReader.readAsText(blob);
+        }
+    };
+});
diff --git a/TwoFactorAuth/view/adminhtml/web/template/authy/auth.html b/TwoFactorAuth/view/adminhtml/web/template/authy/auth.html
new file mode 100644
index 00000000..9b9a0029
--- /dev/null
+++ b/TwoFactorAuth/view/adminhtml/web/template/authy/auth.html
@@ -0,0 +1,94 @@
+<!--
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+-->
+<form autocomplete="off">
+    <fieldset class="admin__fieldset">
+        <legend class="admin__legend"><span data-bind='i18n: "2FA - Authy Auth"'></span></legend>
+        <br/>
+
+        <div visible='selectedMethod() === ""' class="tfa-authy-actions-list">
+            <h3 data-bind='i18n: "Verification methods:"'></h3>
+
+            <button
+                    click="runOneTouch"
+                    type="button"
+                    class="action-primary">
+                <span data-bind='i18n: "Use one touch"'></span>
+            </button>
+
+            <button
+                    click="runSendCodeToken"
+                    type="button"
+                    class="action-primary">
+                <span data-bind='i18n: "Use authy token"'></span>
+            </button>
+
+            <br/>
+            <h3 data-bind='i18n: "Emergency methods:"'></h3>
+
+            <button
+                    click="runSendCodeSms"
+                    type="button"
+                    class="action-default">
+                <span data-bind='i18n: "Send me a code via SMS"'></span>
+            </button>
+
+            <button
+                    click="runSendCodeCall"
+                    type="button"
+                    class="action-choose">
+                <span data-bind='i18n: "Send me a code via phone call"'></span>
+            </button>
+        </div>
+
+        <div class="tfa-waitbox" visible='(selectedMethod() === "onetouch") && !success()'>
+            <div data-role="spinner">
+                <div class="spinner">
+                    <span/><span/><span/><span/><span/><span/><span/><span/>
+                </div>
+            </div>
+            <div data-bind='i18n: waitingText'></div>
+        </div>
+
+        <div visible='success()' class="tfa-waitbox">
+            <div data-role="spinner">
+                <div class="spinner">
+                    <span/><span/><span/><span/><span/><span/><span/><span/>
+                </div>
+            </div>
+            <div data-bind='i18n: "Redirecting to Magento Admin Panel..."'></div>
+        </div>
+
+        <div class="admin__field _required field-tfa_code tfa-authy-request-code"
+             visible='(selectedMethod() === "code") && !success()'>
+            <label for="tfa_code" class="admin__field-label"><span data-bind='i18n: "Code"'></span></label>
+            <div class="admin__field-control">
+                <input
+                        id="tfa_code"
+                        class="admin__control-text"
+                        type="text"
+                        data-bind='{value: tokenCode, enable: !waitingText()}'
+                        placeholder="Your code" />
+            </div>
+        </div>
+
+        <div class="form-actions tfa-authy-request-code" visible='(selectedMethod() === "code") && !success()'>
+            <div class="actions">
+                <button
+                        enable="!waitingText()"
+                        click="verifyCode"
+                        class="action-login action-primary">
+                    <span data-bind='i18n: waitingText() ? waitingText() : "Confirm"'></span>
+                </button>
+            </div>
+        </div>
+
+        <div class="tfa-authy-switch-method">
+            <a visible='(selectedMethod() !== "") && !success()' href="#"
+               click="switchAnotherMethod" data-bind='i18n: "Switch to another Authy method"'></a>
+        </div>
+    </fieldset>
+</form>
diff --git a/TwoFactorAuth/view/adminhtml/web/template/authy/configure.html b/TwoFactorAuth/view/adminhtml/web/template/authy/configure.html
new file mode 100644
index 00000000..1d490150
--- /dev/null
+++ b/TwoFactorAuth/view/adminhtml/web/template/authy/configure.html
@@ -0,0 +1,26 @@
+<!--
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+-->
+<div>
+    <div visible='currentStep() === "register"'>
+        <!-- ko foreach: getRegion('step-register') -->
+        <!-- ko template: getTemplate() --><!-- /ko -->
+        <!--/ko-->
+    </div>
+    <div visible='currentStep() === "verify"'>
+        <!-- ko foreach: getRegion('step-verify') -->
+        <!-- ko template: getTemplate() --><!-- /ko -->
+        <!--/ko-->
+    </div>
+    <div visible='currentStep() === "login"' class="tfa-waitbox">
+        <div data-role="spinner">
+            <div class="spinner">
+                <span/><span/><span/><span/><span/><span/><span/><span/>
+            </div>
+        </div>
+        <div data-bind='i18n: "Redirecting to Magento Admin Panel..."'></div>
+    </div>
+</div>
diff --git a/TwoFactorAuth/view/adminhtml/web/template/authy/configure/register.html b/TwoFactorAuth/view/adminhtml/web/template/authy/configure/register.html
new file mode 100644
index 00000000..aaa9bd81
--- /dev/null
+++ b/TwoFactorAuth/view/adminhtml/web/template/authy/configure/register.html
@@ -0,0 +1,76 @@
+<!--
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+-->
+<div>
+    <form autocomplete="off">
+        <fieldset class="admin__fieldset">
+            <legend class="admin__legend">
+                <span data-bind='i18n: "2FA - Authy"'></span>
+            </legend><br/>
+
+            <h3 data-bind='i18n: "Please register yourself to Authy"'></h3>
+
+            <div class="admin__field _required field-tfa_phone_prefix">
+                <label for="tfa_authy_country" class="admin__field-label">
+                    <span data-bind='i18n: "Country"'></span>
+                </label>
+                <div class="admin__field-control">
+                    <select
+                            enable="!waitText()"
+                            id="tfa_authy_country"
+                            class="admin__control-select"
+                            data-bind="value: country, foreach: getCountries()">
+
+                        <option data-bind="value: dial_code, text: name"></option>
+                    </select>
+                </div>
+            </div>
+
+            <div class="admin__field _required field-tfa_phone">
+                <label for="tfa_authy_phone" class="admin__field-label">
+                    <span data-bind='i18n: "Phone number"'></span>
+                </label>
+                <div class="admin__field-control">
+                    <input
+                            data-bind='value: phone, enable: !waitText()'
+                            id="tfa_authy_phone"
+                            class="admin__control-text"
+                            type="text"
+                            autofocus
+                            placeholder="Phone number"/>
+                </div>
+            </div>
+
+            <div class="admin__field _required field-tfa_method">
+                <label for="tfa_authy_phone_action" class="admin__field-label">
+                    <span data-bind='i18n: "Verification method"'></span>
+                </label>
+                <div class="admin__field-control">
+                    <select
+                            enable="!waitText()"
+                            data-bind='value: method'
+                            id="tfa_authy_phone_action"
+                            class="admin__control-select">
+
+                        <option value="sms" selected data-bind='i18n: "Send me an SMS"'></option>
+                        <option value="call" data-bind='i18n: "Call me"'></option>
+                    </select>
+                </div>
+            </div>
+
+            <div class="form-actions">
+                <div class="actions">
+                    <button
+                            enable="!waitText()"
+                            click="doRegister"
+                            class="action-login action-primary">
+                        <span data-bind='i18n: waitText() ? waitText() : "Continue"'></span>
+                    </button>
+                </div>
+            </div>
+        </fieldset>
+    </form>
+</div>
diff --git a/TwoFactorAuth/view/adminhtml/web/template/authy/configure/verify.html b/TwoFactorAuth/view/adminhtml/web/template/authy/configure/verify.html
new file mode 100644
index 00000000..eaaef771
--- /dev/null
+++ b/TwoFactorAuth/view/adminhtml/web/template/authy/configure/verify.html
@@ -0,0 +1,43 @@
+<!--
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+-->
+<form autocomplete="off">
+    <fieldset class="admin__fieldset">
+        <legend class="admin__legend">
+            <span data-bind='i18n: "2FA - Authy"'></span>
+        </legend><br/>
+        <p>
+            <strong data-bind='i18n: messageText()'></strong><br />
+            <a href="#" click="changePhoneNumber" data-bind='i18n: "Click here to change your phone number"'></a>
+        </p><br />
+
+        <div class="admin__field _required field-tfa_verify">
+            <label for="tfa_authy_verify" class="admin__field-label">
+                <span data-bind='i18n: "Verification code"'></span>
+            </label>
+            <div class="admin__field-control">
+                <input
+                        data-bind='value: verifyCode, enable: !waitText()'
+                        id="tfa_authy_verify"
+                        class="admin__control-text"
+                        type="text"
+                        autofocus
+                        placeholder="Verification code"/>
+            </div>
+        </div>
+
+        <div class="form-actions">
+            <div class="actions">
+                <button
+                        click="doVerify"
+                        enable="!waitText()"
+                        class="action-login action-primary">
+                    <span data-bind='i18n: waitText() ? waitText() : "Verify"'></span>
+                </button>
+            </div>
+        </div>
+    </fieldset>
+</form>
diff --git a/TwoFactorAuth/view/adminhtml/web/template/change_provider.html b/TwoFactorAuth/view/adminhtml/web/template/change_provider.html
new file mode 100644
index 00000000..27ef96af
--- /dev/null
+++ b/TwoFactorAuth/view/adminhtml/web/template/change_provider.html
@@ -0,0 +1,23 @@
+<!--
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+-->
+<div visible="getProviders().length > 0">
+    <a visible='!showChangeMethod()' href="#" class="tfa-change-provider-trigger" click="displayChangeMethod">
+        <img attr='src: getSwitchIconUrl()' />
+        <span data-bind='i18n: "Select a different 2FA provider"'></span>
+    </a>
+
+    <div visible='showChangeMethod()' class="tfa-change-provider">
+        <h3 data-bind='i18n: "Select a different 2FA provider"'></h3>
+
+        <div class="tfa-provider_list" data-bind="foreach: getProviders()">
+            <a class="tfa-provider" attr='href: auth'>
+                <img attr='src: icon' />
+                <span data-bind='text: name'></span>
+            </a>
+        </div>
+    </div>
+</div>
diff --git a/TwoFactorAuth/view/adminhtml/web/template/duo/auth.html b/TwoFactorAuth/view/adminhtml/web/template/duo/auth.html
new file mode 100644
index 00000000..b9a529bf
--- /dev/null
+++ b/TwoFactorAuth/view/adminhtml/web/template/duo/auth.html
@@ -0,0 +1,23 @@
+<!--
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+ -->
+<div>
+    <form>
+        <fieldset class="admin__fieldset">
+            <legend class="admin__legend"><span translate="'2FA - Duo Security'"></span></legend>
+            <br/>
+
+            <iframe id="duo_iframe"
+                    data-bind="afterRender: onAfterRender"
+                    attr="{
+                        'data-host': getApiHost(),
+                        'data-sig-request': getSignature(),
+                        'data-post-action': getPostUrl()
+                    }"
+            ></iframe>
+        </fieldset>
+    </form>
+</div>
diff --git a/TwoFactorAuth/view/adminhtml/web/template/form/element/providers.html b/TwoFactorAuth/view/adminhtml/web/template/form/element/providers.html
new file mode 100644
index 00000000..180e14c5
--- /dev/null
+++ b/TwoFactorAuth/view/adminhtml/web/template/form/element/providers.html
@@ -0,0 +1,32 @@
+<!--
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+-->
+<!-- ko if: getForcedProviders().length -->
+<div class="tfa-forced-providers">
+    <strong><!-- ko i18n: "Providers defined by admin:" --><!-- /ko --></strong><br />
+    <br />
+    <ul data-bind="foreach: getForcedProviders()">
+        <li><span data-bind="text: $data"></span></li>
+    </ul>
+</div>
+<!-- /ko -->
+<!-- ko if: !getForcedProviders().length -->
+<input type="hidden" data-bind="attr: { name: inputName + '[]' }" value="" />
+
+<div data-bind="foreach: getEnabledProviders()">
+    <div class="tfa-provider">
+        <input type="checkbox" data-bind="
+            attr: {
+                id: 'reset_' + $data.value,
+                value: $data.value,
+                name: $parent.inputName + '[]',
+            },
+            checked: $parent.isSelected($data.value)
+        " />
+        <label data-bind="attr: {for: 'reset_' + $data.value}, text: $data.label"></label>
+    </div>
+</div>
+<!-- /ko -->
diff --git a/TwoFactorAuth/view/adminhtml/web/template/form/element/reset_providers.html b/TwoFactorAuth/view/adminhtml/web/template/form/element/reset_providers.html
new file mode 100644
index 00000000..94bbe574
--- /dev/null
+++ b/TwoFactorAuth/view/adminhtml/web/template/form/element/reset_providers.html
@@ -0,0 +1,19 @@
+<!--
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+-->
+<!-- ko if: getResetProviders().length -->
+<div class="tfa-reset-providers">
+    <div data-bind="foreach: getResetProviders()">
+        <button type="button" class="primary action-remove" data-bind="
+            text: $data.label,
+            click: $parent.resetProvider
+        "></button>
+    </div>
+</div>
+<!-- /ko -->
+<!-- ko if: !getResetProviders().length -->
+<!-- ko i18n: "Not available" --><!-- /ko -->
+<!-- /ko -->
diff --git a/TwoFactorAuth/view/adminhtml/web/template/google/auth.html b/TwoFactorAuth/view/adminhtml/web/template/google/auth.html
new file mode 100644
index 00000000..796bc3bf
--- /dev/null
+++ b/TwoFactorAuth/view/adminhtml/web/template/google/auth.html
@@ -0,0 +1,51 @@
+<!--
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+-->
+<div>
+    <div visible='currentStep() === "register"'>
+        <form method="post">
+            <fieldset class="admin__fieldset">
+                <legend class="admin__legend">
+                    <span data-bind='i18n: "2FA - Google Auth"'></span>
+                </legend><br/>
+
+                <div class="admin__field _required field-tfa_code">
+                    <label for="tfa_code" class="admin__field-label">
+                        <span data-bind='i18n: "Authenticator code"'></span>
+                    </label>
+                    <div class="admin__field-control">
+                        <input
+                                data-bind="value: verifyCode, enable: !waitText()"
+                                id="tfa_code"
+                                class="admin__control-text"
+                                type="text"
+                                autofocus
+                                placeholder="Your code'"/>
+                    </div>
+                </div>
+
+                <div class="form-actions">
+                    <div class="actions">
+                        <button
+                                enable="!waitText()"
+                                click="doVerify"
+                                class="action-login action-primary">
+                            <span data-bind='i18n: waitText() ? waitText() : "Confirm"'></span>
+                        </button>
+                    </div>
+                </div>
+            </fieldset>
+        </form>
+    </div>
+    <div visible='currentStep() === "login"' class="tfa-waitbox">
+        <div data-role="spinner">
+            <div class="spinner">
+                <span/><span/><span/><span/><span/><span/><span/><span/>
+            </div>
+        </div>
+        <div data-bind='i18n: "Redirecting to Magento Admin Panel..."'></div>
+    </div>
+</div>
diff --git a/TwoFactorAuth/view/adminhtml/web/template/google/configure.html b/TwoFactorAuth/view/adminhtml/web/template/google/configure.html
new file mode 100644
index 00000000..759e26be
--- /dev/null
+++ b/TwoFactorAuth/view/adminhtml/web/template/google/configure.html
@@ -0,0 +1,57 @@
+<!--
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+-->
+<div>
+    <div visible='currentStep() === "register"'>
+        <form method="post">
+            <fieldset class="admin__fieldset">
+                <legend class="admin__legend">
+                    <span data-bind='i18n: "2FA - Google Auth"'></span>
+                </legend><br/>
+
+                <img class="tfa-google-qr" attr='src: getQrCodeUrl()' />
+
+                <p class="tfa-google-secure-code" data-bind='i18n: getSecretCode()'></p>
+
+                <p data-bind='i18n: "Scan or copy&amp;paste this code with your authenticator app and insert your code to confirm."'></p>
+
+                <div class="admin__field _required field-tfa_code">
+                    <label for="tfa_code" class="admin__field-label">
+                        <span data-bind='i18n: "Authenticator code"'></span>
+                    </label>
+                    <div class="admin__field-control">
+                        <input
+                                data-bind="value: verifyCode, enable: !waitText()"
+                                id="tfa_code"
+                                class="admin__control-text"
+                                type="text"
+                                autofocus
+                                placeholder="Your code'"/>
+                    </div>
+                </div>
+
+                <div class="form-actions">
+                    <div class="actions">
+                        <button
+                                enable="!waitText()"
+                                click="doVerify"
+                                class="action-login action-primary">
+                            <span data-bind='i18n: waitText() ? waitText() : "Confirm"'></span>
+                        </button>
+                    </div>
+                </div>
+            </fieldset>
+        </form>
+    </div>
+    <div visible='currentStep() === "login"' class="tfa-waitbox">
+        <div data-role="spinner">
+            <div class="spinner">
+                <span/><span/><span/><span/><span/><span/><span/><span/>
+            </div>
+        </div>
+        <div data-bind='i18n: "Redirecting to Magento Admin Panel..."'></div>
+    </div>
+</div>
diff --git a/TwoFactorAuth/view/adminhtml/web/template/u2fkey/auth.html b/TwoFactorAuth/view/adminhtml/web/template/u2fkey/auth.html
new file mode 100644
index 00000000..86b46b66
--- /dev/null
+++ b/TwoFactorAuth/view/adminhtml/web/template/u2fkey/auth.html
@@ -0,0 +1,38 @@
+<!--
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+-->
+<div afterRender="onAfterRender">
+    <div visible='currentStep() === "register"'>
+        <fieldset class="admin__fieldset">
+            <legend class="admin__legend">
+                <span translate="'2FA - U2F key verification'"></span>
+            </legend><br/>
+            <div class="tfa-u2f-touch-key">
+                <h3 translate="'Plug in your U2F key and follow instructions'"></h3>
+                <div visible="$data.idle" class="tfa-u2f-try-again">
+                    <a href="javascript:void(0)" click="waitForTouch" translate="'Try again'"></a>
+                </div>
+                <img attr='src: getTouchImageUrl()' />
+            </div>
+        </fieldset>
+    </div>
+    <div visible='currentStep() === "login"' class="tfa-waitbox">
+        <div data-role="spinner">
+            <div class="spinner">
+                <span/><span/><span/><span/><span/><span/><span/><span/>
+            </div>
+        </div>
+        <div translate="'Redirecting to Magento Admin Panel...'"></div>
+    </div>
+    <div visible='$data.loading' class="tfa-waitbox">
+        <div data-role="spinner">
+            <div class="spinner">
+                <span/><span/><span/><span/><span/><span/><span/><span/>
+            </div>
+        </div>
+        <div translate="'Loading...'"></div>
+    </div>
+</div>
diff --git a/TwoFactorAuth/view/adminhtml/web/template/u2fkey/configure.html b/TwoFactorAuth/view/adminhtml/web/template/u2fkey/configure.html
new file mode 100644
index 00000000..00f5bc40
--- /dev/null
+++ b/TwoFactorAuth/view/adminhtml/web/template/u2fkey/configure.html
@@ -0,0 +1,38 @@
+<!--
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+-->
+<div afterRender="onAfterRender">
+    <div visible='currentStep() === "register"'>
+        <fieldset class="admin__fieldset">
+            <legend class="admin__legend">
+                <span translate="'2FA - U2F key device registration'"></span>
+            </legend><br/>
+            <div id="u2f-touch-key">
+                <h3 translate="'Plug in your U2F key and follow instructions'"></h3>
+                <div visible="$data.idle" class="tfa-u2f-try-again">
+                    <a href="javascript:void(0)" click="waitForTouch" translate="'Try again'"></a>
+                </div>
+                <img attr='src: getTouchImageUrl()' />
+            </div>
+        </fieldset>
+    </div>
+    <div visible='currentStep() === "login"' class="tfa-waitbox">
+        <div data-role="spinner">
+            <div class="spinner">
+                <span/><span/><span/><span/><span/><span/><span/><span/>
+            </div>
+        </div>
+        <div translate="'Redirecting to Magento Admin Panel...'"></div>
+    </div>
+    <div visible='$data.loading' class="tfa-waitbox">
+        <div data-role="spinner">
+            <div class="spinner">
+                <span/><span/><span/><span/><span/><span/><span/><span/>
+            </div>
+        </div>
+        <div translate="'Loading...'"></div>
+    </div>
+</div>