Skip to main content
Checks that MFA is enabled for all OneLogin users.

​
About

When you connect OneLogin to DSALTA, the platform syncs your users, roles, and access settings using read-only API access. DSALTA evaluates this control on every sync. If the requirement is not met, DSALTA activates this check.

​
Why This Matters

A password alone is a single point of failure. If it is phished, guessed, or reused from a breached site, an attacker gains full access. Multi-factor authentication adds a second verification step that blocks the vast majority of account-takeover attempts and is a baseline requirement across SOC 2, ISO 27001, and most security frameworks.

​
How to Fix

Before you begin
  • Ensure you have administrator access to your OneLogin account.
Enforce MFA for all users
  1. Sign in to your OneLogin admin console.
  2. Open the Security or Authentication settings.
  3. Enable Multi-Factor Authentication and set it to required (not optional).
  4. Select the allowed methods (authenticator app, hardware key, or SMS).
  5. Communicate the change to your team and set an enrollment deadline.
Once MFA is enforced and all users have enrolled, DSALTA retrieves the change on the next sync and sets the check status to Passing.

​
Frequently Asked Questions

This check runs automatically every 24 hours while the OneLogin integration is connected. You can also trigger a manual sync from Integrations in the sidebar.
A failing check appears in your Data Library → Tests dashboard. Work through the steps above; once the underlying configuration is fixed, the status updates automatically on the next sync.
Yes. If it does not apply to your environment, mark it as Not Applicable with a justification. The exclusion is documented for auditors.
No. DSALTA uses read-only API access and never modifies, creates, or deletes resources. All remediation is performed by your team directly in OneLogin.