Skip to main content

Why is Atlas requiring a verification code on login, and why do I need to set up MFA?

S
Written by Seemi
Updated over 11 months ago

Answer

Starting March 26, 2025, MongoDB will begin rolling out mandatory multi-factor authentication (MFA) for MongoDB Atlas users.

Atlas will enable the email one-time password (OTP) feature for users who have not yet configured MFA. Upon login, these users must complete an email OTP verification and will subsequently be encouraged to set up a second MFA option as part of the ongoing MFA setup process. This approach allows users to explore additional MFA options, including those resistant to phishing.

Atlas supports the following MFA methods:

  • Security key or biometrics: FIDO2 (WebAuthn) compliant security keys such as YubiKey, or biometric authentication methods like Apple Touch ID or Windows Hello.

  • One-time password (OTP) and push notifications: Provided through the Okta Verify app.

  • Authenticator apps: Applications like Twilio Authy, Google Authenticator, or Microsoft Authenticator can be used for generating time-based OTPs.

  • Email: Used for generating OTPs.

Note: MongoDB encourages users to choose phishing-resistant MFA methods, such as security keys or biometrics.

MFA will be a prerequisite for all users when logging into MongoDB services using Atlas credentials. These services include:

Additional information

Multi-factor authentication protects users from credential-based attacks and unauthorized access. Making MFA’s additional layer of authentication mandatory ensures greater account security. This safeguards mission-critical applications and data.

  • Users will no longer be able to remove the last MFA factor from their user profile.

  • Newly registered users will not face an MFA challenge during account activation, which occurs after they verify their email. Once their session is active, Atlas will set email OTP as the default MFA method. These users will be required to complete an email OTP MFA challenge the next time they attempt to log in.

  • Users with no MFA factor will be challenged with email OTP if they log in through a bypass SSO URL or if they switch from social login to Atlas credentials by using password reset flow.

  • Users will have the option to choose "Remember this device." If they select this option, they will not be required to complete the MFA challenge again for 15 days when using the same device and browser.

Relevant resources

Did this answer your question?