Cannot enable MFA on some user groups

[ezoltan]

Hi Forum,

I've just upgraded Zabbix to 7.0.2 and configured MFA with TOTP. Successfully enabled MFA for a number of user groups, however the option to enable it for groups with administrative privileges is not clickable, hence cannot change it from Disabled to my TOTP MFA profile.




What am I doing wrong?

Thank you.

[Min Tun]

I'm also facing the same issue.
Does anyone find out the reason why users with admin privilege cannot be enabled 2FA? Are there any options to turn it on?

[pcutrone]

The best way to prevent issues with conflicting 2FA is to make a single group with 2FA authentication enabled and leave everything else disabled. This way you will only have to add users that you want to use 2FA to a single group and it allows you to remove a user from 2fa in case their device is lost. This will allow you to create a new account, test the permissions get everything configured properly THEN add the user to the 2fa. If you choose to enable 2fa across a bunch of different 'groups' you run into conflicts with a 2fa loop where they keep setting up 2fa but it never working. Just create a new 2FA group and add your admins to that. Keep the 2fa on everything else disabled.