Magento 2.4 - Two factor authentication

Question

I'm upgrading my development migration to 2.4. I was surprised to see that 2FA was enabled. Can this be turned off?

I have enough issues to deal with and prefer not to go through this learning curve. I prefer not to be forced to add apps to my phone so that I may get into the admin. I would prefer the ability to make the decision to add this at production time.

Answer 1

You can disable the 2FA module with

bin/magento module:disable Magento_TwoFactorAuth

This will let you login to admin normally until you have done your own risk assessments and set your security policy for Magento admin login.

For a more elegant solution the following module will let you disable and enable 2FA from the command line or admin

https://github.com/markshust/magento2-module-disabletwofactorauth

Answer 2

I found a way, by adding a system configuration to Enable/Disable it. I made a module, you can download it with composer:

composer require wolfsellers/module-enabledisabletfa

Or check it at: https://github.com/wolfsellers/module-enabledisabletfa

Answer 3

you can disable using this command :

 bin/magento module:disable Magento_TwoFactorAuth
 bin/magento cache:flush 

Answer 4

Try to disable Magento_TwoFactorAuth module and then run all commands for cache and permissions.

Answer 5

Please disable Magento_TwoFactorAuth module

php bin/magento module:disable Magento_TwoFactorAuth

php bin/magento s:up

php bin/magento c:c

OR

Into Magento_root/app/etc/config.php find Magento_TwoFactorAuth and put 1 to 0 like this then save the file and run php bin/magento s:up command.

'Magento_TwoFactorAuth' => 0,

I Hope This Helps You.

Answer 6

Securing your Magento Admin account. Two-factor authentication (2FA) is now required for the Magento Admin. Admin users must first configure their 2FA before logging into the Admin through either the UI or a web API. 2FA is enabled by default and cannot be disabled. This extra step of authentication makes it harder for malicious users to log in to the Admin without authorization.

source