User Story 1: MFA Setup and Enrollment
As a B2B SaaS platform administrator
I want to enable and configure Multi-Factor Authentication for my organization
So that I can enhance security and protect sensitive business data from unauthorized access
Acceptance Criteria:
Primary Flow:
[Link] I am logged in as an admin user
WHEN I navigate to Security Settings
THEN I should see an option to "Enable MFA for Organization"
2. GIVEN MFA is not yet enabled
WHEN I click "Enable MFA"
THEN I should see MFA configuration options (SMS, Email, Authenticator App, Hardware
Token)
3. GIVEN I select "Authenticator App" as the MFA method
WHEN I confirm the selection
THEN the system should generate a QR code and backup codes
4. GIVEN I scan the QR code with my authenticator app
WHEN I enter the 6-digit verification code
THEN the system should validate the code and enable MFA for my account
5. GIVEN MFA is successfully enabled
WHEN the setup is complete
THEN I should see a confirmation message and be able to download backup codes
Edge Cases & Validations:
Invalid MFA Code: Display "Invalid code. Please try again." with option to regenerate QR
code
Expired Setup Session: After 10 minutes, display "Setup session expired. Please restart MFA
setup."
Network Issues: Display "Connection error. Please check your internet and try again."
Already Enabled: If MFA is already active, show current status and option to reconfigure
Error States:
E001: "MFA setup failed. Please contact support if the issue persists."
E002: "Invalid verification code. You have 2 attempts remaining."
E003: "Too many failed attempts. Please wait 5 minutes before trying again."
Open Questions:
1. Should MFA be mandatory for all users or optional per user?
2. What's the backup code expiration policy?
3. Should we support multiple MFA methods per user simultaneously?
4. What happens to active sessions when MFA is enabled?
User Story 2: MFA Authentication During Login
As a business user with MFA enabled
I want to complete the MFA challenge during login
So that I can securely access my account while maintaining a smooth user experience
Acceptance Criteria:
Primary Flow:
[Link] I have entered valid email/password credentials AND MFA is enabled on my
account.
WHEN I click "Sign In".
THEN I should be redirected to the MFA verification page.
2. GIVEN I am on the MFA verification page.
WHEN the page loads.
THEN I should see a 6-digit code input field and "Verify" button.
3. GIVEN I enter a valid 6-digit MFA code.
WHEN I click "Verify" or press Enter.
THEN the system should validate the code and log me in successfully.
4. GIVEN I successfully complete MFA verification.
WHEN authentication is complete.
THEN I should be redirected to my dashboard with a session created.
5. GIVEN I check "Remember this device for 30 days".
WHEN I complete MFA verification.
THEN future logins from this device should skip MFA for 30 days
Edge Cases & Validations:
Code Format: Only accept 6-digit numeric codes
Code Expiration: TOTP codes expire every 30 seconds
Rate Limiting: Maximum 5 attempts per 15-minute window
Session Timeout: MFA challenge expires after 5 minutes of inactivity
Backup Codes: Allow backup code usage if primary method fails
Error States:
E101: "Invalid verification code. Please check your authenticator app and try again."
E102: "Verification code has expired. Please enter the current code."
E103: "Too many failed attempts. Your account has been temporarily locked for 15 minutes."
E104: "MFA challenge expired. Please sign in again."
E105: "This backup code has already been used. Please use a different code."
Alternative Flows:
Backup Code Flow: "Can't access your authenticator? Use a backup code instead"
Contact Support: "Still having trouble? Contact support for assistance"
Resend Code: For SMS/Email MFA, provide "Resend Code" option with 60-second cooldown
Open Questions:
1. Should we allow users to disable "Remember Device" if they're on a shared
computer?
2. What's the maximum session duration after successful MFA?
3. Should backup codes be single-use or reusable?
4. How should we handle MFA for API access and service accounts?
5. Should we log MFA attempts for security auditing?