Skip to main content

Multi-Factor Authentication

Multi-factor authentication (MFA) adds an essential layer of security to your Guardian Pro account. With MFA enabled, signing in requires both your password and a time-based verification code from an authenticator app, making it significantly harder for unauthorized users to access your account even if your password is compromised.

Why MFA Matters​

Guardian Pro provides access to sensitive information about your AWS infrastructure -- security findings, resource configurations, cost data, and the ability to remediate issues. Protecting access to this information is critical.

Risk Without MFAProtection With MFA
A compromised password grants full access to your Guardian Pro accountA compromised password alone is not sufficient -- the attacker also needs your physical device
Phishing attacks can capture credentialsTime-based codes expire every 30 seconds, limiting the window for credential reuse
Shared or weak passwords create vulnerabilityEven a weak password is protected by the second factor
tip

MFA is required for every Guardian Pro user on every plan.

Setting Up MFA​

Prerequisites​

You need an authenticator app installed on your mobile device or computer. Guardian Pro supports any TOTP-compatible (Time-based One-Time Password) authenticator app, including:

  • Google Authenticator (iOS / Android)
  • Microsoft Authenticator (iOS / Android)
  • Authy (iOS / Android / Desktop)
  • 1Password (iOS / Android / Desktop)

Set Up MFA at Your First Sign-In​

You set up MFA the first time you sign in, whether you accepted an invitation or created your organization. You cannot skip this step.

  1. Sign in with your email address and password (for a new invitation, set your password first).
  2. Guardian Pro shows a QR code and a manual entry key.
  3. Open your authenticator app and scan the QR code. If you cannot scan it, type the manual entry key into your app instead.
  4. Enter the 6-digit verification code from your authenticator app.
  5. Click Verify & Enable MFA.

You can check your MFA status at any time under Settings > MFA Setup.

Signing In with MFA​

After MFA is set up, every sign-in adds one step:

  1. Navigate to the Guardian Pro login page.
  2. Enter your email and password as usual.
  3. When prompted, open your authenticator app and enter the current 6-digit code.
  4. Click Verify to complete sign-in.
note

Verification codes refresh every 30 seconds. If a code does not work, wait for the next code to appear in your authenticator app. Also ensure that your device's clock is synchronized -- time-based codes depend on accurate system time.

MFA Is Always On​

MFA is required for every user in every organization, on every plan. It cannot be turned off, and Guardian Pro does not issue recovery codes.

caution

Keep your authenticator app backed up or synced (most apps, such as 1Password, Authy and Microsoft Authenticator, can do this). If you lose access to your authenticator app, you cannot sign in until support resets your MFA.

Lost Access to Your Authenticator App​

If you have lost or replaced the device with your authenticator app and cannot sign in:

  1. Use the contact page on our website, from the email address associated with your Guardian Pro account.
  2. Guardian Pro support confirms the request with an administrator of your organization. This safeguard prevents unauthorized MFA resets.
  3. Once confirmed, support resets your sign-in and you set up MFA again with your new device at your next sign-in.

Troubleshooting​

Code Not Accepted​

  • Ensure your device's clock is accurate. Time-based codes require the device clock to be within a few seconds of the actual time.
  • Wait for the next code to appear (codes refresh every 30 seconds).
  • If you set up your app with the manual entry key, check that it was entered correctly.

Multiple Guardian Pro Accounts​

If you have multiple Guardian Pro accounts (for example, across different organizations), ensure your authenticator app labels each entry clearly so you use the correct code for each account.

Next Steps​