# Enroll and complete MFA

**Flow key:** `mfa-enrollment-and-challenge`

## Outcome

The rightful user adds a second factor, proves possession, stores recovery options safely, and can complete or recover future challenges.

## Actors

- Authenticated user
- Identity service
- Authenticator/SMS/security key provider
- Support or recovery process

## Preconditions and entry points

- A synthetic account can change security settings.
- Reauthentication credential is available.
- A controllable factor device and recovery channel exist.

## Required test data

Use synthetic, isolated, resettable data. Never use real credentials, payment instruments, private customer records, or production notifications.

| Data | Canonical valid seed | Critical variations |
|---|---|---|
| Account | active verified user without MFA | existing MFA, managed account, elevated-risk session |
| Factor | TOTP authenticator | SMS, email OTP, push, WebAuthn/security key, passkey |
| Codes | current valid OTP and saved recovery code | wrong, expired, reused, adjacent time window, leading zero |
| Devices | primary and backup synthetic devices | lost device, clock skew, offline, changed phone |
| Policy | MFA required for sensitive actions | optional, organization-enforced, remembered device |

## Canonical steps

Treat this as the ordinary successful path inferred from common product behavior. Adapt it to observed labels, business rules, APIs, and implementation evidence; do not invent a requirement.

| Step | User or system action | Expected evidence |
|---:|---|---|
| 1 | Open security settings and start MFA enrollment. | The product reauthenticates and explains factor/recovery consequences. |
| 2 | Register the factor using the displayed secret/challenge. | Secret is scoped, protected, and not active before proof. |
| 3 | Enter the current valid proof. | Exactly one factor becomes active for the intended account. |
| 4 | Capture and acknowledge recovery options. | Recovery codes are shown once, stored hashed/protected, and individually single-use. |
| 5 | Sign out and sign in again. | A challenge appears at the correct stage and accepts only valid fresh proof. |
| 6 | Use one recovery path and inspect alerts/audit. | Recovery works once, preserves account control, and triggers appropriate notification. |

## Alternate paths

- Add backup factor
- Replace factor
- Remember trusted device
- Organization mandates enrollment
- Step-up challenge without full login

## Failure and recovery paths

- Clock skew or delayed SMS
- Push fatigue/repeated prompts
- Factor lost during enrollment
- Enrollment commits but confirmation fails
- Recovery bypasses required identity proof

## Completion oracle

- The stated outcome is true in visible UI and authoritative persisted state.
- Exactly one intended business result and no unintended side effect occurred.
- Identity, tenant, authorization, money/data, lifecycle, notifications, integrations, analytics, and audit agree where applicable.
- Refresh, retry, back/forward, and a second authorized read do not reveal a contradictory result.
- Any partial, delayed, canceled, failed, or unknown outcome is labeled truthfully and has a safe recovery path.

## Evidence to capture

- Entry context, actor, tenant, role, feature flags, locale, time zone, and initial identifiers/state.
- Step-level screenshots or DOM state plus request/response, correlation, job, event, and stable business IDs where available.
- Before/after authoritative records, versions, totals, permissions, lifecycle states, and downstream side effects.
- Notifications, audit events, integration deliveries, retries, deduplication, latency, and recovery evidence.
- Untested branches, unsafe-to-run cases, product decisions, and evidence tier.

## Product decisions to resolve

- Exact eligibility, required data, authorization, and validation rules.
- Which steps are synchronous, asynchronous, optional, skippable, reversible, or irreversible.
- Idempotency, concurrency, timeout, retry, cancellation, and compensation semantics.
- Retention, privacy, notification, audit, performance, accessibility, and localization commitments.

## Related CARBON items

- [mfa and one time codes](../../items/identity/mfa-and-one-time-codes.md)
- [login](../../items/identity/login.md)
- [session lifecycle](../../items/identity/session-lifecycle.md)
- [permission](../../items/automation/permission.md)

[Back to Identity and access flows](index.md)
