# Ensure MFA is available/enforced for application end-users

- Source: https://support.icompaas.com/support/solutions/articles/a_1790103906614338-ensure-mfa-is-availableenforced-for-application-end-users
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Supabase cloud](https://support.icompaas.com/support/solutions/c_1790103054038308) › [supabase checks](https://support.icompaas.com/support/solutions/folders/f_1790103067540538)
- Last updated: 2026-09-22
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure multi-factor authentication (MFA) is enabled for the application's users, with at least one second factor such as TOTP available. For sensitive data or actions, RLS policies should require an MFA-verified session by checking that the user's aal claim is aal2.

**Rationale**

Passwords can be stolen through phishing, reuse, or data breaches. MFA adds a second step that an attacker with only the password cannot complete. Offering MFA protects users who choose it, and requiring it through RLS for sensitive data makes sure that data cannot be accessed without a second factor, even if a password is compromised.

**Impact**

-   Users can protect their accounts with a second factor
    
-   Sensitive data can require an MFA-verified session
    
-   Requires application changes to enroll and challenge factors
    

**Default Value**

By default, TOTP MFA is enabled on all projects, but it is not required. Applications must add enrollment screens and RLS rules to enforce it.

**Pre-Requisites**

-   Project Owner or Admin role
    
-   Application changes to support MFA enrollment and verification
    

**Test Plan**

1.  Sign in to the Supabase Dashboard at [https://supabase.com/dashboard](https://supabase.com/dashboard).
    
2.  Select your project.
    
3.  Open Authentication in the sidebar and select Multi-Factor.
    
4.  Verify that at least one MFA method, such as TOTP, is enabled.
    
5.  Review RLS policies on sensitive tables and check whether they require aal2.
    
6.  If no MFA method is enabled, or sensitive tables do not require aal2, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the Supabase Dashboard at [https://supabase.com/dashboard](https://supabase.com/dashboard).
    
2.  Select your project.
    
3.  Open Authentication in the sidebar and select Multi-Factor.
    
4.  Enable TOTP (and other methods if needed) and save.
    
5.  Add MFA enrollment and verification to the application.
    
6.  In the SQL Editor, add a restrictive policy on sensitive tables that checks (select auth.jwt()->>'aal') = 'aal2'.
    

**Backout Plan**

1.  Sign in to the Supabase Dashboard at [https://supabase.com/dashboard](https://supabase.com/dashboard).
    
2.  Select your project.
    
3.  Drop the aal2 policy from the affected tables in the SQL Editor.
    
4.  Open Authentication > Multi-Factor and disable the MFA methods that were added, then save.
    

**Reference**

-   [https://supabase.com/docs/guides/auth/auth-mfa](https://supabase.com/docs/guides/auth/auth-mfa)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.