# MFA Posture check questions **URL:** \ **Category:** Ziti Desktop Edge for Windows\ **Created:** [February 5, 2023, 2:27am UTC](https://openziti.discourse.group/t/mfa-posture-check-questions/1050 "2023-02-05T02:27:00Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![gooseleggs](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/gooseleggs/32/450_2.png) [@gooseleggs](https://openziti.discourse.group/u/gooseleggs)\ **Post date:** [February 5, 2023, 2:27am UTC](https://openziti.discourse.group/t/mfa-posture-check-questions/1050/1 "2023-02-05T02:27:00Z")
So, starting to look into MFA and posture checks. _Question 1:_ From the documentation: ```auto MFA Posture Checks also support forcing a client to re-submit a valid TOTP on timeout, after locking/unlocking a device, or waking a device from sleep. Timeouts are set through the timeoutSeconds property. Where values 0 and -1 represent no timeout. Forcing submission on lock/unlock is set through promptOnUnlock as true or false. After an unlock event the client is given a five-minute grace period before the posture check begins to fail. Forcing submission on wake is set through promptOnWake as true or false. After a wake event the client is given a five-minute grace period before the posture check begins to fail. ``` and with a configuration of: ![image](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/1X/1d3301dc809fcd6019ac6ea1b68c596bd34a9402.png) I then apply it to a dial service policy: ![image](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/1X/e454af21280f02473f0b96e264fcfc6912bb9c7e.png) What I would be expecting, based on what I read in the documentation, is that should the machine go to sleep, or I lock/unlock the device, within 5 minutes I should be prompted for MFA/ require to input MFA. This is on ZDEW. However, it does not timeout and I can continue to use it. Thought I would ask here to confirm if my thinking is correct. The expected outcome, is that you need to unlock the Ziti client when logging in / unlocking lock screen / Waking from sleep (which really is lock screen). However, you can work on the session until one of those conditions exist. _Question 2_ What is the reasoning being a 5 minute grace period - the documentation does not state the reason. Is this configurable? ---
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [February 5, 2023, 3:36am UTC](https://openziti.discourse.group/t/mfa-posture-check-questions/1050/2 "2023-02-05T03:36:17Z")
I tend to have my machine sleep for more than the allotted session timeout so when I return to my machine, it’s already locked but I do remember this feature and enabling and. Reading the doc, I’d have the same conclusion you have. As for the five minute grace period, let’s use a scenario. I am ssh’ed to a remote machine using OpenZiti. I’m at an office and I need to use the bathroom. I lock my screen, use the toilet and return and unlock my screen all well within the (default) 30 minute session timeout… When I return and unlock my screen, it’s annoying if all my OpenZiti connections are disconnected. I’ll have to re-establish all of them. Instead, it’s far more friendly to get a warning and put my MFA in, instead of having to re-ssh, or reconnect to sql server or “whatever”. Our first testers hit this exact scenario (we had implemented it as “immediately” at first) so we had to add this short grace period. I don’t think it’s configurable yet. Make sense? ---
**Author:** ![gooseleggs](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/gooseleggs/32/450_2.png) [@gooseleggs](https://openziti.discourse.group/u/gooseleggs)\ **Post date:** [February 5, 2023, 4:07am UTC](https://openziti.discourse.group/t/mfa-posture-check-questions/1050/3 "2023-02-05T04:07:21Z")
Yes, I don’t see a big use on the timeout in my scenario. Agreed about having to use a toilet or whatever - and if you are logged in, then it is ass-u-me that it is the same user. However, when un-locking should I then be getting a “hey, you got 5 mins to authenticate or else I’m cutting you off prompt?” I was not getting this. Issue I see with 5 minutes, if I log in (switch user), then I would assume I have 5 minutes of access before being cut from that service? I understand there are trade-offs - just wanting to understand. ---
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [February 5, 2023, 4:11am UTC](https://openziti.discourse.group/t/mfa-posture-check-questions/1050/4 "2023-02-05T04:11:51Z")
> [@gooseleggs](#): > > “hey, you got 5 mins to authenticate or else I’m cutting you off prompt?” Yes you should. If you're not seeing that, it's a bug. I filed [MFA Require on Wake / Unlock not showing warning · Issue #594 · openziti/desktop-edge-win · GitHub](https://github.com/openziti/desktop-edge-win/issues/594) for that. @jeremy.tellier and @scareything -- looks like a bug to try to squash. Thanks