# Clarification on TOTP MFA Enforcement Behavior During New Identity Enrollment **URL:** \ **Category:** Support\ **Created:** [October 16, 2025, 5:00am UTC](https://openziti.discourse.group/t/clarification-on-totp-mfa-enforcement-behavior-during-new-identity-enrollment/5236 "2025-10-16T05:00:29Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![anshjoshi](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/anshjoshi/32/3841_2.png) [@anshjoshi](https://openziti.discourse.group/u/anshjoshi)\ **Post date:** [October 16, 2025, 5:00am UTC](https://openziti.discourse.group/t/clarification-on-totp-mfa-enforcement-behavior-during-new-identity-enrollment/5236/1 "2025-10-16T05:00:29Z")
I’ve been testing MFA (TOTP) integration in my OpenZiti deployment and noticed some confusing behavior when enforcing TOTP in the default authentication policy. Currently, I can manually enable MFA for each identity, which works fine—but with around 100–200 users, managing MFA individually becomes impractical. To streamline this, I tried enabling **TOTP MFA enforcement** in the **default authentication policy** so that new identities are automatically required to use MFA during enrollment. However, when a new user enrolls, the **Ziti Desktop Edge client skips the QR code or secret key display step** and **directly prompts for a TOTP code**. At that point, the user has no prior secret or authenticator app configured, so they’re effectively stuck. Could you please clarify whether this is - The **intended behavior** (by design), - A **known issue or bug** , or - Is there any **recommended workaround** to enforce MFA automatically but still allow users to see the QR code for initial setup? - Also I dont see any option to implement MFA for Ziti mobile client The goal is to have new users automatically prompted to set up MFA during their first enrollment—without needing per-user manual intervention. ---
**Author:** ![anshjoshi](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/anshjoshi/32/3841_2.png) [@anshjoshi](https://openziti.discourse.group/u/anshjoshi)\ **Post date:** [October 17, 2025, 9:19am UTC](https://openziti.discourse.group/t/clarification-on-totp-mfa-enforcement-behavior-during-new-identity-enrollment/5236/2 "2025-10-17T09:19:02Z")
Just need to know that, If it is intended to work like that and any workarounds to enforce MFA while enrolling. @TheLumberjack ---
**Author:** ![anshjoshi](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/anshjoshi/32/3841_2.png) [@anshjoshi](https://openziti.discourse.group/u/anshjoshi)\ **Post date:** [October 18, 2025, 8:02am UTC](https://openziti.discourse.group/t/clarification-on-totp-mfa-enforcement-behavior-during-new-identity-enrollment/5236/3 "2025-10-18T08:02:29Z")
![tinywow_openziti totp issue_85263535](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/8/8f481b8bc2b35f66a3ee8485e675d6673bdf27fa.webp) This video is reference for how I force enable MFA for everyone using default config, and while I Enroll, It directly asks for TOTP code not the usual **AUTHENTICATOR** setup ---
**Author:** ![scareything](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/scareything/32/106_2.png) [@scareything](https://openziti.discourse.group/u/scareything)\ **Post date:** [October 18, 2025, 10:44am UTC](https://openziti.discourse.group/t/clarification-on-totp-mfa-enforcement-behavior-during-new-identity-enrollment/5236/4 "2025-10-18T10:44:38Z")
Hi and thanks for letting us know about this. It definitely sounds like a bug in the macOS client. I’ll look into it early this week. edit: your screen shots show the windows client, not macOS. Regardless, we’ll look into it. ---
**Author:** ![anshjoshi](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/anshjoshi/32/3841_2.png) [@anshjoshi](https://openziti.discourse.group/u/anshjoshi)\ **Post date:** [October 18, 2025, 6:18pm UTC](https://openziti.discourse.group/t/clarification-on-totp-mfa-enforcement-behavior-during-new-identity-enrollment/5236/5 "2025-10-18T18:18:35Z")
Thanks for the reply @scareything , lemme know if some progress happens regarding this, I'll appreciate it. I also want to ask regarding, Ziti mobile client MFA? Bcs I can't find the option to enable it or is it a upcoming feature. ---
**Author:** ![anshjoshi](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/anshjoshi/32/3841_2.png) [@anshjoshi](https://openziti.discourse.group/u/anshjoshi)\ **Post date:** [November 6, 2025, 7:39am UTC](https://openziti.discourse.group/t/clarification-on-totp-mfa-enforcement-behavior-during-new-identity-enrollment/5236/6 "2025-11-06T07:39:37Z")
any updates on this?? ---
**Author:** ![anshjoshi](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/anshjoshi/32/3841_2.png) [@anshjoshi](https://openziti.discourse.group/u/anshjoshi)\ **Post date:** [January 1, 2026, 6:42am UTC](https://openziti.discourse.group/t/clarification-on-totp-mfa-enforcement-behavior-during-new-identity-enrollment/5236/7 "2026-01-01T06:42:12Z")
Hello, I am still facing the issue, any updates on this?