topic Re: Disable email option completely for MFA in Cortex XDR Discussions

Disable email option completely for MFA

tmeksik — Wed, 05 Mar 2025 03:08:58 GMT

Hope this is still relevant here as we are using PAN SSO to sign into Cortex XDR.....

I would like to know if we have an option to disable email MFA if we have other active options enabled e.g. TOTP or Windows Hello.

I would have guess this would be a no - as the MFA email would be always required as a fallback option.

We are designing some strict access control on a certain account and would like to explore disabling email OTP is actually doable.

Thanks

Tum

Re: Disable email option completely for MFA

jmazzeo — Wed, 05 Mar 2025 15:22:53 GMT

Hi @tmeksik, thanks for reaching us using the Live Community.

You can change your MFA settings in the CSP portal, under "My Profile" you will find a link to check the MFA configuration.

If the provided SSO configuration doesn't meet your requirements, you can configure your own IDP with this procedure: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000sZ8mCAE

If this post answers your question, please mark it as the solution.

Re: Disable email option completely for MFA

tmeksik — Wed, 05 Mar 2025 19:40:34 GMT

Hi @jmazzeo

We wouldn't go with our own IdP for this.

I am aware of MFA settings under "My Profile". You can configure Okta, hw token, and Google authenticator there. What I cannot find is a way to disable Email option - if at all possible? It is fine the way it is - I just wanted to know if it is possible to disable it.

The KB page here also didn't include this info https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClN9CAK

Thanks

Tum

Re: Disable email option completely for MFA

gherghot — Wed, 02 Apr 2025 15:26:46 GMT

According to the KB https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClN9CAK

Email 2FA
Note: Effective from September 1st week, New users will no longer have the option to use email as a form of MFA.
No change for existing users who are using email.

Still not clear if and how is possible to disable email 2FA for existing users.