MFA & Security

Soracom supports multi-factor authentication (MFA) for operator and SAM user accounts. Enabling MFA adds a second authentication factor — such as a TOTP code from an authenticator app — to protect against unauthorized access even if passwords are compromised.

What it does

• TOTP-based MFA: Use any standard authenticator app (Google Authenticator, Authy, 1Password) for second-factor codes
• Per-user enforcement: Enable MFA individually on operator accounts and SAM users
• Recovery codes: Generate backup codes for account recovery if the authenticator device is lost
• Session management: Control session duration and idle timeout settings
• Password policies: Set minimum password complexity and rotation requirements

Common use cases

• Securing operator accounts that manage production IoT fleets
• Enforcing MFA for all team members accessing the Soracom console
• Meeting compliance requirements for multi-factor authentication

Related

• Operators — Account management for operator-level MFA
• SAM Users & Roles — Manage MFA for sub-accounts
• Audit Logs — Monitor authentication events and access attempts