Multi-factor authentication
Brendan Heywood, 
Peter Burnett, This is a Moodle plugin which adds Multi-Factor authentication (MFA), also known as Two-factor authentication (2FA) on top of your existing chosen authentication plugins.
https://en.wikipedia.org/wiki/Multi-factor_authentication
Why another MFA plugin for Moodle?
There are other 2FA plugins for moodle such as:
https://moodle.org/plugins/auth_a2fa
This one is different because it is NOT a Moodle authentication plugin. It leverages new API's that Catalyst specifically implemented in Moodle Core to enable plugins to augment the login process instead of replacing it. This means that this MFA plugin can be added on top of any other authentication plugin resulting in a much cleaner architecture, and it means you can compose a solution that does everything you need instead of compromising by swapping out the entire login flow.
See this tracker and the dev docs for more info:
https://tracker.moodle.org/browse/MDL-66173
https://docs.moodle.org/dev/Login_callbacks
The other major difference is that we support multiple authentication factor types as sub plugins, eg IP Range, Email, TOPT and in future others such as SMS or hardware tokens or anything else as new sub-plugins. They can be flexible configured so that different combinations of factors are considered enough.
Flexible Configuration
The MFA has multiple sub-plugins for each type of factor. Different factors can be combined and checked in a specific order. See the plugin readme for the full details:
https://github.com/catalyst/moodle-tool_mfa/#configuration
For more information, consult the readme:
Screenshots
Contributors
This seems to be a matter of MFA configuration. Grace period can be used to give other users some time to configure their Authenticator app. Also User capability and Role Factor can help to let some users pass MFA if they are not suppose to have Authenticator app. Please have a look at the doc to get more details on factors and how they can be used to get your target use case https://github.com/catalyst/moodle-tool_mfa#authentication-factors
Kind regards,
Mikhail
If a user self-registers, and confirms their account, they cannot log in the first time while MFA via SMS is required.
We are collecting the cellular number at registration, so the system knows what it is, but the number has not been validated yet, so it cannot be used. But the user cannot log in and validate it. A bit of a catch 22. What is the proper way to allow self-registration AND require SMS TOTP codes at the same time?
First I would like to thank you for this plugin.
I tried to use the plugin with a commercial theme called Edumy but I got the below error, So I contacted the theme support and they replied as below.
Any idea how can I fix this, or is there a new release of the plugin that will solve this issue?
ERROR:
Coding error detected, it must be fixed by a programmer: page layout file [dirroot]/theme/edumy/layout/ccn_minimal.php does not contain the main content placeholder, please include "<?php echo $OUTPUT->main_content() ?>" in the theme layout file.
Theme Support Response:
"Edumy already does include all required functions for the main content area on the page. It appears that the plugin is using an outdated method of printing content into the body area.
Hope this helps to clarify!"
Coding error detected, it must be fixed by a programmer: page layout file [dirroot]/theme/edumy/layout/columns2.php does not contain the main content placeholder, please include "<?php echo $OUTPUT->main_content() ?>" in theme layout file.
We have built a custom theme for Moodle for a customer and are using this plugin in concert with that. It as been working very well so far.
However, due to our own custom theme and the upcoming 2022/2023 Moodle 4.0 changes to the theme, we are trying to anticipate any extra work we'll have to charge due to this update.
Because it seemed wise to take the plugins we use into account as well, I'd like to ask you wether they anticipate any trouble with the upcoming Moodle version in the context of this plugin? How fast can we expect an update? Anything we can do ourselves?
We know it's fairly early, but this client is a very big and bureaucratic one, and any and all information will be useful to us.
I also thought it might be good to start a general Moodle 4.0 megathread for the (undoubtedly volumous) questions that will appear.