Turning off MFA

Hi David Harrison1,

You can delete the token for that user, if you are planning to keep the username as it is. And then the user can generate a new token when the new person tries to login with the same credentials. 

If you are not planning for the same username, then you just need to add a new user and that user can proceed to login with the given credentials and then can use it generate a new token. 

https://docs.sophos.com/nsg/sophos-firewall/18.5/Help/en-us/webhelp/onlinehelp/AdministratorHelp/Authentication/HowToArticles/AuthenticationConfigureTwoFactorAuthentication/index.html

https://docs.sophos.com/nsg/sophos-firewall/18.5/Help/en-us/webhelp/onlinehelp/AdministratorHelp/Authentication/OneTimePassword/index.html#multi-factor-authentication-mfa-settings

Thank you for your suggestion.

I've tried it on one FW (removing the token) but I can no longer log into that firewall with the admin account after deleting the token. Luckily i have another administrator account that does let me in.. Do i just change the admin password to get that account working again?

Hello David Harrison1,

You mean the MFA used for the main administrator account ? 

And that is not working ?


Cause, it's token will be generated under the authentication > Multi-factor authentication > Issued tokens

ahh, that's the one. 

yes.. but i think I've broken it.. 

I have managed to turn off the token in the MFA token (status =off) but the "MFA for default admin" is turned on.

Because I have logged out, I now cant log back in as admin. is there a way to turn the MFA token status back "on" without the default admin account?

And thanks for your help Vivek!

ahh, that's the one. 

yes.. but i think I've broken it.. 

I have managed to turn off the token in the MFA token (status =off) but the "MFA for default admin" is turned on.

Because I have logged out, I now cant log back in as admin. is there a way to turn the MFA token status back "on" without the default admin account?

And thanks for your help Vivek!

So, MFA admin token is for the default admin account. 

If I understood correctly, you want to turn on the MFA for admin from the auth > MFA, right ? 

are you not able to toggle it  from the another admin account ? 

You can PM me, further to narrow down the situation. 

Hi Vivek, yes, when I log in with my own account with admin privs, it doesn't allow enabling the Status for the issued token.

Hi Vivek, 

using my own admin privs account, im unable to toggle the Status or edit MFA for the main admin account

Hey David Harrison1
You can PM (private message) me the support access id, then may with that default admin access, it can be toggled.

Hey David Harrison1,

I have an easy way for you: 
> Sophos Firewall: Multi-Factor Authentication Recovery - https://support.sophos.com/support/s/article/KB-000043846?language=en_US