Click above the horizontal line and specify the number of failed login attempts allowed before lockout. Valid values range from 1 to 25. The default is 7.

Note: FIC does not allow locked users to authenticate. Instead, it displays the message "Locked, please try again in <lockout interval> minutes."

Click above the horizontal line and specify a lockout period, which ranges from 60 to 7,200 seconds. The default is 60 seconds.

Enable or disable bypass.

• Enable—End-users can bypass MFA. If enabled, you must also set the Bypass Expiration Time, as described below.
• Disable (default)—End-users cannot bypass MFA.

Note: If Enable Bypass is disabled on the Settings page, the admin user can not enable bypass for FIC end-users on the Users page. See Managing users.

(Available only when Enable Bypass is enabled.) Specify the length of time in seconds that bypass remains in effect. Valid values range from 5 minutes to 72 hours. The default is 1 hour (3,600 seconds).

Enable or disable the Auto-alias by Email feature.

Note: The feature is disabled by default. For more information, see Enabling Auto-alias by Email.

This option is enabled by default. When it is disabled, FIC will remove all the tokens it has issued for rooted devices when end users are trying to activate new tokens using the devices. This will render the devices unusable with FIC.

When you re-enale the option, rooted devices can be used to activate new tokens.

Enable or disable remembering known devices.

• Enable — FortiIdentity Cloud can remember known devices. When users log in, they have the option to select a Remember this Device checkbox. On subsequent logins from the same device, they can bypass the multi-factor authentication step.
• Disable — FortiIdentity Cloud does not remember known devices.

Note: Once you enable this option, you must configure both the Forget Device After and the Auth Interval time frame.

Enable this if you want to configure Forget Device After.

If disabled, the known device will never be forgotten.

Specify how long a device remains in the known devices list (1 hour to 90 days).

Specify how frequently a user must log in to maintain their known device status (5 minutes to 3 days).

Note: The time frame set for Auth Interval should not exceed the time frame configured in Forget Device After.

HIGH (forbid all replays) — The authentication follows the current mechanism and does not allow any OTP replay.

MEDIUM (ignore FTM push replay) — The authentication counts OTP replays for manual input only. All the requests from push authentications are not counted and are not restricted by OTP replay protection.

LOW (ignore FTM/FTK auth replay) — OTP replay protection is disabled.

Note: For email and SMS, OTP replay are always rejected no matter what the setting is.

Select an adaptive auth profile.

Enable this option to allow end users to enroll their mobile numbers on the End-User Portal.

This option is available only when the Auth Method is set to SMS and the user does not have a phone number set.