# Mfa

The different ways in which a user pool's MFA enforcement can be configured.

- Source: [`aws-cognito/lib/user-pool.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0/packages/aws-cdk-lib/aws-cognito/lib/user-pool.ts#L400)

## Example

```ts
new cognito.UserPool(this, 'myuserpool', {
  // ...
  mfa: cognito.Mfa.REQUIRED,
  mfaSecondFactor: {
    sms: true,
    otp: true,
    email: false, // email-based MFA
  },
});
```

## Members

| Member | Description |
| --- | --- |
| `OFF` | Users are not required to use MFA for sign in, and cannot configure one. |
| `OPTIONAL` | Users are not required to use MFA for sign in, but can configure one if they so choose to. |
| `REQUIRED` | Users are required to configure an MFA, and have to use it to sign in. |

## Referenced by

- [`UserPoolProps`](/v2/docs/aws-cdk-lib.aws_cognito.UserPoolProps).mfa