Platform / MFA and adaptive access
Ask for stronger proof when the moment calls for it.
Passkeys, push, authenticator apps and more, with sign-in rules that look at the person, the network, the device and the risk.
- PasswordLow-risk apps, from a trusted network
- Any second factorAuthenticator app, push, SMS, YubiKey, Duo, RSA
- Phishing-resistantPasskeys only. A password plus a security question never counts as MFA
Ten authenticators
Switch on the ones you trust, and decide per group which are required, optional or disabled.
- Passkeys (WebAuthn), the one factor IdRa counts as phishing-resistant
- IdRa Verify push, with number challenge, browser, OS and location shown on the phone
- Authenticator apps (TOTP) and email codes
- SMS and voice through Twilio, YubiKey OTP, security questions
- Duo and RSA SecurID, if you already run them
Policies that read the situation
App sign-in rules run in order and match on groups, network zones, risk level, device state and platform. The first match decides: allow, deny or step up.
- IP zones, plus country and ASN zones on deployments behind Cloudflare (not on idra.team today)
- Three assurance levels: password, any second factor, phishing-resistant
- A re-authentication window per MFA rule
Quiet protection at the door
Attacks get stopped before a password is ever checked, and people hear about what happens on their account.
- ThreatInsight: public threat feeds plus a local password-spray detector
- CAPTCHA: Turnstile, hCaptcha or reCAPTCHA
- Lockout, rate limits, and recovery that never says whether an account exists
- Security emails with an “I don’t recognize this” link that raises the person’s risk
Standards it speaks
- WebAuthn
- FIDO2 passkeys
- TOTP
- Web Push
Not here yet
- A device-bound, FastPass-style sign-in, and native desktop MFA
- An IdRa Verify native app: it’s an installable web app, not yet proven on real phones
- Policy simulation, shared policies and “remember this device” prompts
We’d rather you read this now than find it in a pilot. See the full comparison.
Create your organization.
Pick an address and confirm your email, then sign in as its first admin. A setup wizard takes you through the rest.