Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/central/partner/help/en-us/index.html?contextId=modern-authentication-about

About authentication

Sophos Fusion Partner administrators can authenticate using either a username and password secured with multi-factor authentication, or a passkey.

Authenticating with a username and password requires multi-factor authentication using a time-based one-time password (TOTP) authentication app like Google Authenticator, Microsoft Authenticator, or Authy.

Passkeys provide an easier, more secure method of logging in. They use two authentication factors: a biometric scan or device PIN and a key stored securely on the computer or mobile device. They're phishing-resistant because they can't be faked or hijacked, and they're secure from your computer to the cloud. Passkeys only need a single action, such as pressing a finger on a fingerprint reader, to authenticate the user to the service.

When users enroll, they're asked to set a password, and to set up at least one TOTP authenticator app. Admins can add passkey authentication methods in Sophos Fusion Partner later on.

Note

Sophos Fusion Partner administrators must register at least two multi-factor authentication (MFA) methods. For more information, see Sophos Fusion Partner MFA Requirements.

Deprecated authentication methods

Multi-factor authentication methods based on SMS text or on email-plus-PIN are now deprecated. New users enrolling in Sophos Fusion Partner must use a TOTP authenticator app or passkey to authenticate.

If an existing user who uses SMS text or email-plus-PIN authentication has their multi-factor authentication methods reset, they're considered a new user. This means they must use a TOTP authenticator app or passkey to authenticate.

Failed sign-in attempts

Sophos Fusion Partner enforces a lock-out policy for failed sign-in attempts. Your account will be temporarily locked after five consecutive incorrect sign-in attempts. The lockout initially lasts one minute and gradually increases to a maximum of five hours if you make further incorrect sign-in attempts with the same account. You can contact Sophos Support to unlock your account. See Sophos Support.