MFA on the logins your IdP can't see.
A second factor on Active Directory, database, and network logins, using the MFA app your users already have.
- Kerberos
- NTLM
- LDAP
- SMB
- PostgreSQL
- MySQL
- RADIUS
j.doesrv-fin-01- 09:14:02.118 · kerberos · AS-REQRequest
- 09:14:02.140 · dc-sensor · awaiting MFAHeld
- 09:14:06.902 · push · iPhone 15Approved
- 09:14:06.915 · dc-sensor · TGT issuedAccess granted
4.8s from sign-in to access
A second factor on logins your IdP can't see, using the app your users already have.
- Replaces
Nothing.
It sits in front of AD, databases, and network gear. No rip and replace.
- Active Directory
- Databases
- Network gear
- Needs
One lightweight component for each path you protect.
- Active Directoryneeds DC Sensor
- Databasesneeds DB agent
- RADIUS / VPNneeds RADIUS Bridge
What MFA covers
Push held at the DC
The login waits at the domain controller until the user approves.
kerberos → hold → push → TGTBring your own Duo or Okta
Keep the MFA app you already pay for.
provider: wallet | duo | oktaMFA on database connect
Database logins get a push before the connection opens.
$ psql -h prod-db -U a.khan → push → connectedEnrollment
Users enroll themselves in under a minute.
status: pending → registeredWhich factors work where
| protocol | wallet push | duo | okta verify | fido2 key | totp code |
|---|---|---|---|---|---|
| AD & Windowsdc sensor | |||||
| kerberos | Needs the DC Sensor | Needs the DC Sensor | Needs the DC Sensor | ||
| ntlm | Needs the DC Sensor | Needs the DC Sensor | Needs the DC Sensor | ||
| rdp | Needs the DC Sensor | Needs the DC Sensor | Needs the DC Sensor | ||
| Linuxssh gateway | |||||
| ssh | Needs the SSH gateway | Needs the SSH gateway | Needs the SSH gateway | ||
| sudo | Needs the SSH gateway | Needs the SSH gateway | Needs the SSH gateway | ||
| Databasesdb agent | |||||
| postgresql | Needs the DB agent | Needs the DB agent | Needs the DB agent | ||
| mysql | Needs the DB agent | Needs the DB agent | Needs the DB agent | ||
| Networkradius bridge | |||||
| radiusvpn, wi-fi | Needs the RADIUS Bridge | Needs the RADIUS Bridge | Needs the RADIUS Bridge | ||
| AuthNull consoleadmin sign-in | |||||
| console sign-in | |||||
updated 2026-10-22 · source: product
How a login gets its second factor
- 1user → system
The login starts as normal.
- 2component → authnull
The login is held while AuthNull asks for the second factor.
- 3authnull → mfa app
A push or a prompt on the user's phone.
- 4authnull → component → siem
Approve or deny, then the decision goes to your SIEM.
Live in an afternoon
Most teams enforce MFA on a pilot group the same afternoon, after a short run in audit mode.
Step 01: Connect Active Directory
~ 10 minPoint AuthNull at your domain and choose which groups and OUs to sync.
Step 02: Install the DC Sensor
~ 15 minInstall the sensor on your domain controllers. Nothing goes on workstations.
Step 03: Enroll users
~ 1 min per userUsers install Wallet or keep Duo or Okta, and register their factor.
Step 04: Start in audit mode
as long as you needPolicies log what they would do without prompting anyone, so you can check the impact first.
Step 05: Set policy
~ 15 minChoose who must use MFA, starting with domain admins.
Step 06: Enforce
same day ✓Switch the policy to enforce. Logins wait at the DC until the user approves.
Evidence for your auditors
AuthNull's policies and logs help you show MFA and access controls for common frameworks.
PCI DSS 4.0
8.4MFA for all access into the cardholder data environment.
AuthNull evidence- MFA policies
- Auth logs
CMMC
IA.L2-3.5.3MFA for privileged and network access.
AuthNull evidence- MFA policies
- PAM sessions
- Auth logs
SOC 2
CC6.1Logical access controls.
AuthNull evidence- Policy decisions
- Auth logs
Cyber insurance
QuestionnairesMFA on admin and remote access, as insurers ask.
AuthNull evidence- RADIUS MFA
- PAM MFA
AuthNull supports evidence collection for these controls. It does not certify compliance on its own.