Setting Up Multi-Factor Authentication (MFA)

Keywords

MFA, multi-factor authentication, two-factor, 2FA, security code, login security, sign in, verification code, email code

Overview

Multi-Factor Authentication (MFA) adds a second verification step to the sign-in process for your Rockstar Learning Platform site. When MFA is enabled, a user who enters a correct user name and password is not signed in immediately. Instead, the platform emails them a security code, and they must enter that code to finish signing in.

This protects accounts against a password that has been guessed, reused from another site, or shared, because the password alone is no longer enough to get in.

Before you begin

• MFA is configured at the organization level by an administrator.
• Because security codes are delivered by email, every user who will sign in needs a valid, reachable email address on their user record. Review your user list for placeholder or shared email addresses before you turn MFA on.
• If your organization has previously had trouble receiving platform email, resolve that first. See Why are the system emails not appearing in my inbox? and Rockstar Learning Platform Domain Permissions. A user who cannot receive the security code cannot sign in.

Enabling MFA

1. Sign in as an administrator.
2. Go to the Settings tab in the admin portal.
3. Locate the Multi-Factor Authentication setting. Turn the setting on and save.

What signing in looks like with MFA turned on

1. The user goes to your platform URL and enters their user name and password as usual.
2. Instead of landing on their dashboard, they are taken to a verification page.
3. The platform sends a security code to the email address on their user record.
4. The user opens the email, copies the code, enters it on the verification page, and submits it.
5. The user is signed in.

Troubleshooting

A user says the code never arrived

• Ask the user to check their spam or junk folder, and any quarantine their email provider applies.
• Confirm the email address on the user's record in the Users tab is correct and current. See Editing Users.
• Have your IT team allow the platform's sending domains. See Rockstar Learning Platform Domain Permissions.
• Some consumer security products block platform mail. See Blocking Issues with AT&T's Internet Security with Active Armor.

A user sees an "Unauthorized" error instead of the verification page

This was a defect in earlier builds and was corrected in release 2.12.1 (August 27, 2026), tracked as RLP-8977. If a user on a current site still sees an authorization error rather than the code entry page, submit a ticket to Customer Solutions with the user's ID, the site URL, and the time of the attempt.