MFA enforcement for Cloud Console

src/current/_includes/cockroachcloud/prefer-sso.md

@@ -1,5 +1,5 @@
     {{site.data.alerts.callout_info}}
-    We recommend that CockroachDB {{ site.data.products.cloud }} Console users log in with [Single Sign-On (SSO)]({% link cockroachcloud/cloud-org-sso.md %}), optionally with two-factor authentication (2FA) enabled for the SSO provider. This prevents potential attackers from using stolen credentials to access or tamper with your critical data.
+    We recommend that CockroachDB {{ site.data.products.cloud }} Console users log in with [Single Sign-On (SSO)]({% link cockroachcloud/cloud-org-sso.md %}), optionally with [multi-factor authentication (MFA)]({% link cockroachcloud/multi-factor-authentication.md %}) enabled for the SSO provider. This prevents potential attackers from using stolen credentials to access or tamper with your critical data.
 
     CockroachDB {{ site.data.products.cloud }} [Basic SSO]({% link cockroachcloud/cloud-org-sso.md %}#basic-sso) supports SSO with GitHub, Google, and Microsoft. [Cloud Organization SSO]({% link cockroachcloud/cloud-org-sso.md %}#cloud-organization-sso) provides additional configuration and flexibility, and includes support for OIDC or SAML protocols, autoprovisioning, and limiting the email domains that can use a given authentication method.
 

src/current/_includes/cockroachcloud/sso-intro.md

@@ -1,6 +1,6 @@
 Single Sign-On (SSO) allows members of your CockroachDB {{ site.data.products.cloud }} organization to authenticate using an identity from an identity provider (IdP) instead of using an email address and password.
 
-[Basic SSO]({% link cockroachcloud/cloud-org-sso.md %}#basic-sso) is enabled by default for each CockroachDB {{ site.data.products.cloud }} organization. members can authenticate to [CockroachDB {{ site.data.products.cloud }} Console](https://cockroachlabs.cloud) with any GitHub, Google, or Microsoft identity or with a password.
+[Basic SSO]({% link cockroachcloud/cloud-org-sso.md %}#basic-sso) is enabled by default for each CockroachDB {{ site.data.products.cloud }} organization. Members can authenticate to [CockroachDB {{ site.data.products.cloud }} Console](https://cockroachlabs.cloud) with any GitHub, Google, or Microsoft identity or with a password.
 
 [Cloud Organization SSO]({% link cockroachcloud/cloud-org-sso.md %}#cloud-organization-sso) lets users sign in at a custom login page unique to your organization, and provides additional customization and capabilities to help your organization meet its security and compliance requirements.
 

src/current/_includes/v25.4/sidebar-data/cloud-deployments.json

@@ -273,6 +273,12 @@
                         "/cockroachcloud/cloud-sso-sql.html"
                         ]
                     },
+                    {
+                        "title": "Multi-Factor Authentication for the Cloud Console",
+                        "urls": [
+                        "/cockroachcloud/multi-factor-authentication.html"
+                        ]
+                    },
                     {
                         "title": "SQL Client Certificate Authentication for Advanced Clusters",
                         "urls": [

src/current/_includes/v26.1/sidebar-data/cloud-deployments.json

@@ -308,6 +308,12 @@
                         "/cockroachcloud/cloud-sso-sql.html"
                         ]
                     },
+                    {
+                        "title": "Multi-Factor Authentication for the Cloud Console",
+                        "urls": [
+                        "/cockroachcloud/multi-factor-authentication.html"
+                        ]
+                    },
                     {
                         "title": "SQL Client Certificate Authentication for Advanced Clusters",
                         "urls": [

src/current/_includes/v26.2/sidebar-data/cloud-deployments.json

@@ -308,6 +308,12 @@
                         "/cockroachcloud/cloud-sso-sql.html"
                         ]
                     },
+                    {
+                        "title": "Multi-Factor Authentication for the Cloud Console",
+                        "urls": [
+                        "/cockroachcloud/multi-factor-authentication.html"
+                        ]
+                    },
                     {
                         "title": "SQL Client Certificate Authentication for Advanced Clusters",
                         "urls": [

src/current/cockroachcloud/authentication.md

@@ -120,5 +120,6 @@ The table below lists the `sslmode` settings you can use to [connect to your clu
 
 - [Cloud Organization SSO]({% link cockroachcloud/cloud-org-sso.md %})
 - [Configure Cloud Organization SSO]({% link cockroachcloud/configure-cloud-org-sso.md %})
+- [Multi-Factor Authentication for the CockroachDB Cloud Console]({% link cockroachcloud/multi-factor-authentication.md %})
 - [Client Connection Parameters]({% link {{site.current_cloud_version}}/connection-parameters.md %})
 - [Connect to Your CockroachDB {{ site.data.products.standard }} Cluster]({% link cockroachcloud/connect-to-your-cluster.md %})

src/current/cockroachcloud/cloud-org-sso.md

@@ -32,6 +32,7 @@ Cloud Organization SSO allows you to customize your SSO configuration to meet yo
 - Members can sign in using any enabled authentication method, to help reduce the impact of an IdP outage. If a member signs in using a new method for the first time, they are prompted to optionally update their default method. **This is possible only as long as the members are using the same email address to sign in through each method**.
 - You can [enable multiple authentication methods]({% link cockroachcloud/configure-cloud-org-sso.md %}#enable-or-disable-an-authentication-method) simultaneously. You can even add custom authentication methods that connect to IdPs such as Okta or ActiveDirectory through the [Security Access Markup Language (SAML)](https://wikipedia.org/wiki/Security_Assertion_Markup_Language) and [OpenID Connect (OIDC)](https://openid.net/connect/) identity protocols. If you use Okta, you can use the official [Cockroach Labs Okta app integration]({% link cockroachcloud/configure-cloud-org-sso.md %}#add-a-custom-authentication-method) to ease setup of custom SAML or OIDC authentication methods.
 - You can disable any authentication method. To enforce a requirement to use SSO, you can enable only SSO authentication methods and disable password authentication. If you disable password authentication, passwords are not retained.
+- You can enable and enforce the use of [multi-factor authentication to access the Cloud Console]({% link cockroachcloud/multi-factor-authentication.md %}) for any non-SSO users. This uses the Console's native multi-factor authentication feature.
 - You can [restrict the email domains]({% link cockroachcloud/configure-cloud-org-sso.md %}#allowed-email-domains) that are allowed to sign in using an SSO authentication method. By default, any email domain is allowed.
 - [Autoprovisioning](#autoprovisioning) can be enabled for SSO authentication methods, and automatically creates a CockroachDB {{ site.data.products.cloud }} organization account when a member successfully authenticates using an SSO authentication method for the first time, with no invitation required.
 - [SCIM Provisioning]({% link cockroachcloud/configure-scim-provisioning.md %}) automatically creates a CockroachDB {{ site.data.products.cloud }} organization account when a user is assigned to the SCIM application in your IdP that is connected to your CockroachDB {{ site.data.products.cloud }} organization.
@@ -108,6 +109,8 @@ To remove a user's access to CockroachDB {{ site.data.products.cloud }} manually
 
 Yes. When Cloud Organization SSO is enabled for your CockroachDB {{ site.data.products.cloud }} organization, only the [authentication methods you have enabled]({% link cockroachcloud/configure-cloud-org-sso.md %}#enable-or-disable-an-authentication-method) are displayed to your users.
 
+It's also possible to require non-SSO users to access the CockroachDB {{ site.data.products.cloud }} Console via the [Console's native multi-factor authentication feature]({% link cockroachcloud/multi-factor-authentication.md %}).
+
 #### Which SAML-based authentication flows are supported with Cloud Organization SSO?
 
 After SAML is configured, your users can sign in to the CockroachDB {{ site.data.products.cloud }} Console in two different ways:

src/current/cockroachcloud/configure-cloud-org-sso.md

@@ -295,6 +295,10 @@ After Cloud Organization SSO is enabled, it cannot be disabled. To emulate the b
 
 Members must still sign in using your organization's custom URL.
 
+## Enable MFA enforcement for non-SSO access
+
+While Cockroach Labs recommends SSO for CockroachDB {{ site.data.products.cloud }} Console access, organizations commonly retain password-based accounts as a failsafe when SSO is unavailable. To ensure that these remaining password-based accounts are well-protected, [enable CockroachDB {{ site.data.products.cloud }}'s native MFA feature]({% link cockroachcloud/multi-factor-authentication.md %}#native-cockroachdb-cloud-mfa-for-password-based-access) for password-based access.
+
 ## What next?
 
 - [Cloud Organization SSO Frequently Asked Questions]({% link cockroachcloud/cloud-org-sso.md %}#frequently-asked-questions-faq).

src/current/cockroachcloud/multi-factor-authentication.md

@@ -0,0 +1,120 @@
+---
+title: Multi-Factor Authentication for the CockroachDB Cloud Console
+summary: Secure CockroachDB Cloud Console access with multi-factor authentication
+toc: true
+docs_area: manage.security
+cloud: true
+---
+
+Multi-Factor Authentication (MFA) adds an additional layer of security to CockroachDB {{ site.data.products.cloud }} Console access by requiring users to provide a second form of verification to log in.
+
+CockroachDB {{ site.data.products.cloud }} Console supports MFA through different mechanisms depending on how your organization authenticates users:
+
+## MFA through an identity provider (recommended)
+
+When accessing the CockroachDB {{ site.data.products.cloud }} Console through Google, Microsoft, GitHub, or a custom [Cloud Organization SSO]({% link cockroachcloud/cloud-org-sso.md %}#cloud-organization-sso) authentication method, MFA is managed at the identity provider (IdP) level. This is the **recommended approach** for the majority of users in your organization.
+
+With this approach:
+
+- The IdP manages MFA policies and enrollment for all SSO users
+- Users authenticate through your IdP's MFA flow
+- CockroachDB {{ site.data.products.cloud }} Console inherits the MFA protection from your IdP
+
+Refer to your IdP's documentation for configuring MFA.
+
+## Native CockroachDB Cloud MFA for password-based access
+
+{{site.data.alerts.callout_info}}
+{% include feature-phases/preview.md %}
+{{site.data.alerts.end}}
+
+{% include_cached new-in.html version="v26.2" %} While Cockroach Labs recommends SSO for CockroachDB {{ site.data.products.cloud }} Console access, organizations commonly retain password-based accounts as a failsafe when SSO is unavailable. To ensure that these remaining password-based accounts are well-protected, you can enable CockroachDB {{ site.data.products.cloud }}'s native MFA feature for password-based access:
+
+- All users who authenticate with a password (rather than SSO) must enroll in Time-based One-Time Password (TOTP) authentication
+- Users scan a QR code with a standard authenticator app (Google Authenticator, Authy, 1Password, Microsoft Authenticator, etc.)
+- At each login, password users must enter their TOTP code in addition to their password
+- During setup, users receive recovery codes for account recovery if they lose access to their authenticator app
+
+Only organizations that have [enabled Cloud Organization SSO]({% link cockroachcloud/configure-cloud-org-sso.md %}#enable-cloud-organization-sso) can set up MFA for these password-based accounts.
+
+[Organization Admins]({% link cockroachcloud/authorization.md %}#organization-admin) can [enforce MFA usage for all password-based accounts](#enable-mfa-enforcement-for-all-password-based-accounts), which ensures account security across the organization.
+
+### Set up MFA for a password-based account
+
+You can increase the security of password-based access to the CockroachDB {{ site.data.products.cloud }} Console by setting up MFA for your account. This feature is specific to password-based access. MFA for [SSO users]({% link cockroachcloud/cloud-org-sso.md %}#cloud-organization-sso) is managed directly by the identity provider.
+
+[Organization Admins]({% link cockroachcloud/authorization.md %}#organization-admin) who log in via password (not through SSO) must set up MFA for their own accounts before they can [enable MFA enforcement](#enable-mfa-enforcement-for-all-password-based-accounts). All other password-based users will be required to initiate MFA setup upon attempting to log in after MFA enforcement has been enabled by an Organization Admin:
+
+1. A 6-digit verification code will be sent to the email associated with the account. Enter the code then click **Verify & Continue**.
+1. Scan the QR code using an authenticator app. You will receive another 6-digit code via the app. Enter the code then click **Verify & Continue**.
+1. You will be given several recovery codes, to use [in case you lose access to your authenticator app](#recover-your-account). Each code can be used once. Store them in a safe place, as the codes will not be shown again. Check the box indicating that you have saved the codes, then click **Complete setup**.
+
+The account associated with this email address will now need to [use MFA when logging in](#log-in-using-mfa-for-a-password-based-account) with username and password.
+
+For organizations that have enabled [Cloud Organization SSO]({% link cockroachcloud/cloud-org-sso.md %}#cloud-organization-sso), Organization Admins can [enforce MFA usage for all password-based accounts](#enable-mfa-enforcement-for-all-password-based-accounts).
+
+### Log in using MFA for a password-based account
+
+Users who have [set up MFA](#set-up-mfa-for-a-password-based-account) must provide a second authentication factor every time they log in to the CockroachDB {{ site.data.products.cloud }} Console with a password.
+
+To log in with MFA enabled:
+
+1. Go to your organization's CockroachDB {{ site.data.products.cloud }} Console.
+1. Enter your email address and password, then click **Continue**.
+1. When prompted for MFA verification, enter the 6-digit TOTP code from your authenticator app, then click **Verify**.
+
+        Alternatively, if you don't have access to your authenticator app, click **Use a recovery code instead** and enter one of the recovery codes that you stored during [MFA setup](#set-up-mfa-for-a-password-based-account). A single recovery code can only be used once. If you've lost access to your recovery codes, refer to [Recover your account](#recover-your-account).
+
+MFA verification is required once per session. You won't be prompted again until your session expires or you log out.
+
+### Enable MFA enforcement for all password-based accounts
+
+[Organization Admins]({% link cockroachcloud/authorization.md %}#organization-admin) can require password-based users to use MFA when accessing the CockroachDB {{ site.data.products.cloud }} Console.
+
+Before you can enforce MFA, you must have [Cloud Organization SSO]({% link cockroachcloud/cloud-org-sso.md %}#cloud-organization-sso) enabled for your organization. First make a [plan to enable Cloud Organization SSO]({% link cockroachcloud/configure-cloud-org-sso.md %}#plan-to-enable-cloud-organization-sso), then [enable Cloud Organization SSO]({% link cockroachcloud/configure-cloud-org-sso.md %}#enable-cloud-organization-sso).
+
+1. Log in to your organization's CockroachDB {{ site.data.products.cloud }} Console as a user with the [Organization Admin]({% link cockroachcloud/authorization.md %}#organization-admin) role.
+1. Go to **Organization** > **Authentication**.
+1. Under **Authentication Methods**, click **Username and Password**.
+1. If you have not yet enabled [Cloud Organization SSO]({% link cockroachcloud/cloud-org-sso.md %}#cloud-organization-sso), you will be prompted to do so.
+1. If you are a password-based user and you have not yet set up MFA for your own account, you will be prompted to do so before you can enforce MFA across the organization:
+    1. Click **Set up Multi-Factor Authentication on your account**.
+    1. Read the information on the **Enable MFA enforcement** modal, then click **Set up MFA**.
+    1. [Set up MFA for your account](#set-up-mfa-for-a-password-based-account).
+1. An Organization Admin will now be able to enable or disable the **Multi-Factor Authentication Enforcement** toggle. It is switched on by default.
+
+Once enabled, all password-based users will be logged out immediately. These users will be required to [enroll in MFA](#set-up-mfa-for-a-password-based-account) at their next login.
+
+{{site.data.alerts.callout_info}}
+This does not enforce MFA for users who log in via SSO or social credentials. MFA enforcement for those users is handled by the respective SSO or social platform.
+{{site.data.alerts.end}}
+
+### Reset a user's MFA
+
+[Organization Admins]({% link cockroachcloud/authorization.md %}#organization-admin) can reset the MFA of any users who have [set up MFA](#set-up-mfa-for-a-password-based-account) for their password-based access. Resetting the MFA will invalidate the user's existing TOTP binding and recovery codes, and it will force the user to go through the enrollment process upon their next login. To reset a user's MFA:
+
+1. Log in to your organization's CockroachDB {{ site.data.products.cloud }} Console as a user with the [Organization Admin]({% link cockroachcloud/authorization.md %}#organization-admin) role.
+1. Go to **Organization** > **Authentication**.
+1. Under **Authentication Methods**, click **Username and Password**.
+1. If [MFA enforcement has already been enabled](#enable-mfa-enforcement-for-all-password-based-accounts), this **Method Details** page will state that **MFA enforcement is active**. Click **View enrollment status**.
+1. A table containing the organization's MFA-enrolled users will appear. Under the **Action** column, you may choose to **Reset MFA** for other users or **Reconfigure MFA** for yourself. Click on the action to reset or reconfigure the user's MFA.
+
+### Recover your account
+
+During [MFA setup](#set-up-mfa-for-a-password-based-account), the user receives several recovery codes that they should store in a safe place. If the user loses access to their authenticator app, they can instead [log in using one of those codes](#log-in-using-mfa-for-a-password-based-account).
+
+A user might lose access to both their authenticator app and recovery codes. The account recovery process depends on their [role]({% link cockroachcloud/authorization.md %}):
+
+- **Regular users**: Contact an [Organization Admin]({% link cockroachcloud/authorization.md %}#organization-admin). The Admin can [reset your MFA](#reset-a-users-mfa) via the dashboard, which will require you to re-enroll at your next login.
+
+- **Organization Admin**: Contact another Organization Admin in your organization. The other Admin can [reset your MFA](#reset-a-users-mfa) via the dashboard, which will require you to re-enroll at your next login. 
+
+If every Organization Admin has been locked out, contact [CockroachDB Support](https://support.cockroachlabs.com). Support will perform a multi-signal identity verification process before manually resetting your MFA. You will be required to re-enroll at your next login.
+
+## See also
+
+- [Single Sign-On (SSO) for CockroachDB Cloud organizations]({% link cockroachcloud/cloud-org-sso.md %})
+- [Configure Cloud Organization SSO]({% link cockroachcloud/configure-cloud-org-sso.md %})
+- [Require SSO]({% link cockroachcloud/configure-cloud-org-sso.md %}#require-sso)
+- [Manage Users, Roles, and Service Accounts]({% link cockroachcloud/managing-access.md %})
+- [Authentication on CockroachDB Cloud]({% link cockroachcloud/authentication.md %})