Tanflow PAM · Capability
Multi-Factor Authentication
An attacker who can't pass the second factor at the gateway gets nowhere near the vaulted root password.
Overview
Strong authentication in front of every privilege
The gateway is the one way in to every privileged target, so it needs strong authentication. Tanflow PAM enforces multi-factor authentication at login and lets you choose which methods users may enrol, from authenticator apps to phishing-resistant passkeys.
Time-based codes from the Tanflow Authenticator, Google Authenticator, Authy or any compatible TOTP app.
One-time codes sent to the user's registered email address or mobile number at sign-in.
Phishing-resistant WebAuthn/FIDO2 using Touch ID, Windows Hello, a phone or a hardware security key.
Switch MFA enforcement on and choose which verification methods users may enrol.
SAML users authenticate through their identity provider's MFA. Administrators can reset a user's enrolment when a device is lost.
Why it matters
What you can show an auditor
- A stolen password alone doesn't reach the vaulted credentials
- Phishing-resistant passkeys for your highest-risk administrators
- Designed to align with the MFA expectations in RBI, SEBI, PCI DSS and CERT-In guidance
Part of Tanflow PAM
This is built into Tanflow PAM, the privileged access platform that needs no agents and deploys on your infrastructure in 2-4 weeks.
Explore the full platform →FAQ
Common questions
Do SAML users enrol in Tanflow MFA as well?
No. SAML users authenticate through their identity provider, which handles their MFA. The PAM MFA layer applies to users who log in locally.
What happens if a user loses their authenticator device?
An administrator uses the Reset MFA action on that user to clear the enrolment, the user enrols again, and the whole event is logged.
Free companion app
Download the Tanflow Authenticator
The Tanflow Authenticator is a free two-factor authentication app. It generates time-based one-time passwords (TOTP) on your device, offline, for Google, Microsoft, GitHub, AWS and any other service that supports TOTP.
- Standard TOTP that works offline, with no account needed
- Add accounts by QR scan or manual secret key
- Search, manage and reset accounts from one simple screen
See Multi-Factor Authentication in action
A short demo built around your environment and your compliance requirements.