I did not receive an SMS code

Confirm the phone number entered is correct and that your device has cellular reception. If SMS still fails, use an authenticator app or contact your administrator for an alternative verification method.

I lost my phone or device

Use saved backup codes or a recovery email to regain access. If those are unavailable, request an administrator-initiated account recovery following your organization’s identity verification process.

Authenticator app codes are failing

Check that your device clock is set to automatic network time. Unsynced clocks commonly cause TOTP errors. Re-scan the QR code if needed and verify time sync settings.

How do I remove an old device

Sign in from an enrolled device or complete identity verification with helpdesk. Administrators should revoke the old device and require re-enrollment for a replacement.

My organization enforces MFA but I need an exception

Submit a formal exception request to your security or compliance team including justification, duration, and compensating controls; temporary exceptions should be time-boxed and audited.

Are these logs admissible for audits

Maintain complete enrollment and authentication logs per retention policies; retention needs vary by regulation—retain HIPAA-related logs for 6 years (45 CFR §164.530(j)) and financial records per IRS rules.

User MFA Instructions

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

USER MFA INSTRUCTIONS

Service Provider: Client Name:

RECITALS

WHEREAS, Service Provider and Client enter into this Agreement to define the terms under which Service Provider will implement, configure, and provide instructions and support for multi-factor authentication ("MFA") for Client users; and

WHEREAS, the parties wish to set forth the Scope of Work, payment terms, confidentiality obligations, and other terms governing the provision of MFA services and the distribution of User MFA Instructions to Client's users.

WHEREAS, the parties acknowledge that timely user enrollment and adherence to the instructions set forth herein are material to the security objectives of Client's environment.

SCOPE OF WORK

Detailed Scope of Work

MFA SETUP AND USER INSTRUCTIONS

1. Initial Enrollment: Users shall enable MFA by following the steps below. The Service Provider will provide step-by-step guidance and remote assistance where reasonably required.

2. Recommended Methods (select available methods and provide configuration details):

Available Authentication Methods Authenticator App (TOTP) SMS-based OTP Push Notification Hardware Token (U2F/FIDO)

Primary User Phone Number (for SMS or account recovery) Authenticator App Name (if applicable) Backup Codes or Recovery Procedure (issued to user)

RESPONSIBILITIES

Service Provider will: provide configuration settings, user-facing instructions, one round of remote enrollment assistance per user group, and a written report of enrollment completion. Client will: ensure users receive instructions, require completion of MFA enrollment within the agreed period, and maintain assigned user contact information.

PAYMENT TERMS

Total Fee Payment Schedule Late Payment Fee

TERM AND TERMINATION

This Agreement commences on Start Date: and shall continue until End Date: unless earlier terminated in accordance with this section.

Either party may terminate this Agreement for convenience upon written notice delivered at least days prior to termination. Either party may terminate immediately for material breach that is not cured within 15 days of written notice.

CONFIDENTIALITY

Each party shall maintain in confidence all non-public information marked or otherwise reasonably understood to be confidential ("Confidential Information") disclosed in connection with this Agreement, including but not limited to user contact lists, enrollment status, and technical configuration details. Confidential Information shall not be disclosed except to employees, contractors or affiliates who have a need to know and who are bound by obligations of confidentiality at least as protective as those set forth herein. Confidential obligations survive termination for a period of three years.

GOVERNING LAW

This Agreement shall be governed by and construed in accordance with the laws of the State of , without regard to conflict of laws principles.

ENTIRE AGREEMENT

This Agreement, including any exhibits and the Scope of Work, constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements, proposals, or understandings, whether written or oral. Amendments must be in writing and signed by authorized representatives of both parties.

ACKNOWLEDGMENT

By signing below, the undersigned acknowledge receipt of the User MFA Instructions described in this Agreement and agree to cooperate in the timely enrollment of users, to observe any security protocols set forth, and to pay fees in accordance with the Payment Terms.

I acknowledge that I have received, reviewed, and will comply with these User MFA Instructions.

Service Provider:

By:

Date:

Client:

By:

Date:

What the User MFA Instructions Cover

This User MFA Instructions document explains how to enroll, verify, and manage multi-factor authentication (MFA) for user accounts. It covers commonly supported authentication methods, required account fields, device registration, backup and recovery options, and administrative controls. The instructions are written for U.S.-based organizations and reference applicable recordkeeping and security considerations for regulated environments such as HIPAA and financial services. The content is procedural and neutral: it is intended to reduce sign-in risk, preserve account access, and document the steps users must follow to comply with organizational security policies.

Why Following These MFA Instructions Matters

MFA significantly reduces the risk of unauthorized access and credential-based attacks, supports regulatory compliance where applicable, and documents proof of secure access for audits and incident response.

Who Needs These User MFA Instructions

Use these instructions together with your organization’s security policy; administrators should adapt enforcement and retention details to local rules and contractual obligations.

System administrators who provision or enforce MFA policies across user groups.
End users required to enroll devices and keep recovery methods current.
Compliance or security officers verifying enrollment and audit records.

Essential Account Data Collected During MFA Setup

Device ID: Unique device identifier captured at enrollment

Phone Number: Primary mobile number for SMS or voice codes

Authenticator Secret: TOTP/shared secret stored for time-based codes

Backup Codes: One-time codes issued for account recovery

Recovery Email: Alternate address used for verification resets

Enrollment Timestamp: Date/time stamp recorded for audit trail

Step-by-Step: Enroll and Verify MFA

Follow these four core steps to enroll a new MFA method and confirm account access.

01

Start Enrollment: Open your account security settings and select Add MFA.
02

Choose Method: Select SMS, authenticator app (TOTP), or hardware key.
03

Verify Device: Enter the code sent or generated to confirm ownership.
04

Save Backups: Record backup codes and set a recovery email.

Technical and Platform Requirements

Check device compatibility and required apps before starting enrollment to prevent interruptions.

Supported Integrations: Google Workspace, Microsoft 365, Salesforce supported
Authenticator Apps: TOTP apps (Authy, Google Authenticator) work on mobile
Network Needs: Internet access or SMS service required for verification

If your organization enforces single sign-on (SSO) or uses an identity provider, follow the provider’s enrollment steps; contact your IT or identity team for SSO-specific configuration.

Overview: How MFA Enrollment Works

A concise workflow shows the typical actions taken by users and the system during MFA setup and use.

Initiate: User requests to add or change MFA in account settings.
Configure: User selects method and registers a device or app.
Authenticate: System sends or verifies a code to confirm ownership.
Log: Enrollment event and device details are recorded in logs.

Recommended MFA Policy Settings

Administrators can apply consistent settings across accounts; use these recommended baseline values.

Setting	Recommended Value
Method	TOTP + SMS fallback
Enforcement	Required for privileged accounts
Session Timeout	15–60 minutes for sensitive apps
Recovery Policy	Backup codes + admin-assisted reset

Common Setup Mistakes to Avoid

Using a shared or group phone number that others can access, which undermines individual authentication.
Failing to save backup codes or recovery email, which forces helpdesk intervention on lockout.
Registering multiple devices without clear labels, making it hard to revoke lost devices quickly.
Relying only on SMS for high-risk roles; consider app-based or hardware authenticators for stronger assurance.

Risks and Compliance Consequences of Poor MFA Practice

Account Compromise: Unauthorized access risk

Regulatory Liability: HIPAA/financial penalties possible

Data Breach: Exposure of sensitive records

Service Disruption: Operational outages and remediation

Reputational Harm: Loss of customer trust

Financial Loss: Direct and indirect costs

Timelines and Revalidation Expectations

Set clear deadlines for initial enrollment, periodic revalidation, and recovery code rotation to maintain account hygiene.

Initial Enrollment:

Complete within 7 days of account activation

Periodic Revalidation:

Reconfirm device or method every 12 months

Backup Code Refresh:

Rotate backup codes after device change or annually

Device Replacement:

Re-enroll MFA immediately when device is lost

Breach Notification:

Follow state breach timelines; notify per policy

Key Components of a Complete User MFA Process

A robust MFA program includes enrollment, multiple authentication options, recovery processes, administrative controls, monitoring, and user guidance to ensure security and continuity.

Enrollment

A straightforward, documented flow that captures device ID, method choice, and consent for using MFA for authentication and audit purposes.

Auth Methods

Support for app-based TOTP, push notifications, SMS/voice fallback, and hardware tokens to accommodate user needs and risk tiers.

Recovery Options

Procedures for backup codes, recovery email verification, and administrator-assisted resets while preventing social engineering risks.

Admin Controls

Capabilities to enforce policies, revoke devices, require re-enrollment, and manage exceptions for privileged accounts.

Monitoring & Logs

Audit trails that record enrollment events, authentication attempts, and administrative actions for compliance and investigations.

User Education

Clear, concise guidance and training to reduce errors, phishing risk, and support requests related to MFA.

FAQs and Troubleshooting for User MFA

Answers to common problems encountered during MFA enrollment, verification, and recovery to help users resolve issues before contacting support.

Need help? Contact support

I did not receive an SMS code
Confirm the phone number entered is correct and that your device has cellular reception. If SMS still fails, use an authenticator app or contact your administrator for an alternative verification method.
I lost my phone or device
Use saved backup codes or a recovery email to regain access. If those are unavailable, request an administrator-initiated account recovery following your organization’s identity verification process.
Authenticator app codes are failing
Check that your device clock is set to automatic network time. Unsynced clocks commonly cause TOTP errors. Re-scan the QR code if needed and verify time sync settings.
How do I remove an old device
Sign in from an enrolled device or complete identity verification with helpdesk. Administrators should revoke the old device and require re-enrollment for a replacement.
My organization enforces MFA but I need an exception
Submit a formal exception request to your security or compliance team including justification, duration, and compensating controls; temporary exceptions should be time-boxed and audited.
Are these logs admissible for audits
Maintain complete enrollment and authentication logs per retention policies; retention needs vary by regulation—retain HIPAA-related logs for 6 years (45 CFR §164.530(j)) and financial records per IRS rules.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now