Home / Help centre / Security & privacy
Security & privacy
Why aren't SSO users asked for Cyberlop's own MFA?
When single sign-on is on, Cyberlop delegates multi-factor authentication to your identity provider, so SSO users never see a Cyberlop prompt. Enforce MFA in your identity provider. The Require MFA for all users setting in Cyberlop covers local-password accounts.
Why this happens
Security teams normally set one MFA policy in one place, and Cyberlop follows that idea. The Security page states it plainly: when SSO is on, MFA moves to the identity provider. The user proves who they are there. That is by design. Cyberlop then trusts the result and does not ask a second time.
Cyberlop matches that sign-in to a Cyberlop account by verified identity. With the recommended option Require an admin-bound SSO subject, an admin binds each account to a fixed subject before the first sign-in.
How to fix it
- Ask which route the person uses: the SSO button or a local email and password.
- For SSO users, open your identity provider and find the sign-in policy for the Cyberlop app.
- Require a second factor for the people who use Cyberlop. The exact screen depends on your provider.
- For local accounts, open Settings → Two-factor auth, tick Require MFA for all users and click Save MFA settings.
Still not working?
The Cyberlop setting tells users without MFA to enroll at their next login. That prompt applies to local sign-ins only. If a local user still sees no prompt, check that you saved the setting. The status line reads "MFA is optional" until you do.
Questions about the provider itself belong with whoever runs that service for your company, since Cyberlop cannot see or change its policies. For Cyberlop-side help, use the contact page. For more detail, read what happens when MFA is on and the glossary entries for MFA and single sign-on.
Related questions
- How do I make two-factor authentication mandatory for my workspace?
- What happens to people without MFA when I make it mandatory?
- Why isn't anyone being asked to set up MFA?
- How do I set up single sign-on with my identity provider?
- What does "Require an admin-bound SSO subject" do?
Two-factor authentication: require MFA for everyone who signs in
Step-by-step, with annotated screenshots.
Updated · Back to the help centre
Security question we did not answer?
Our team will answer it directly, or walk through it on a call with your security lead.