NOTE: You can configure MFA capabilities in IAM Identity Center when your identity source is configured with IAM Identity Center’s identity store, AWS Managed Microsoft AD, or AD Connector. MFA in IAM Identity Center is currently not supported for external identity providers.
MFA enforcement is step one. Real security posture comes next.
Share your work email and we'll show how identity controls map to compliance evidence.
Configure MFA Device Enforcement for Your Users
- Open the IAM Identity Center console.
- In the left navigation pane, choose Settings.
- On the Settings page, choose the Authentication tab.
- In the Multi-factor authentication section, choose Configure.
- On the Configure multi-factor authentication page, under If a user does not yet have a registered MFA device choose the option Require them to register an MFA device at sign in.
- Choose Save changes.
IAM Identity Center MFA FAQs
Common questions about enforcing MFA for IAM Identity Center users: which identity sources support it, how existing users are affected, and what it proves to an auditor.
No. MFA in IAM Identity Center is supported when your identity source is the IAM Identity Center identity store, AWS Managed Microsoft AD, or AD Connector. It is not supported for external identity providers — if you federate from Okta, Entra ID, or Google Workspace, you enforce MFA in that provider instead, and your evidence comes from there.
On the Authentication tab of IAM Identity Center Settings, choose Configure under Multi-factor authentication, then select Require them to register an MFA device at sign in under "If a user does not yet have a registered MFA device." Users without a device are prompted to enrol the next time they sign in, rather than being allowed through unprotected.
Nothing changes for them. The enforcement setting governs only what happens when a user has no registered device yet, so rolling it out does not interrupt anyone who has already enrolled. That makes it safe to switch on mid-quarter without a coordinated reset.
It covers part of it. Auditors look for enforced multi-factor authentication and the surrounding practice: who holds privileged access, when access was last reviewed, how joiners and leavers are handled, and whether the setting has stayed on. A screenshot of this page proves configuration on one day; a dated access-review record proves the control operated all year.
Turn identity controls into audit evidence
Book a demo and we'll show how Konfirmity turns AWS identity and access controls like MFA enforcement into evidence your next SOC 2 or ISO 27001 auditor accepts.
Book a demo
