> For the complete documentation index, see [llms.txt](https://docs.securepass.me/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.securepass.me/documentation/admin-user-guide/configure-mfa/multiple-login-options.md).

# Multiple login options

SECUREpass supports a broad set of authentication modes, so security can be matched to the application, the user population and the risk of the transaction rather than applied uniformly.

At sign-in, a user sees the modes enabled for their account.

![The Sign in Options panel, showing the authentication modes available to a user.](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/tBd36C1gNV2KueLutomo/assets/signin-options.png)

Administrators enable and rank these modes organisation-wide under **Configuration → Authentication Modes**.

![The Authentication Modes page, showing every available authentication method with its assurance level.](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/TNvOpAS2HDS1kMNmJaQ4/assets/auth-modes.png)

Modes fall into broad families:

| Family                      | Modes                                                      |
| --------------------------- | ---------------------------------------------------------- |
| **Knowledge**               | Password, Knowledge-Based Authentication (KBA)             |
| **One-time passcode**       | SMS OTP, Email OTP                                         |
| **Authenticator app**       | Authenticator (TOTP), PushNotification, QR code, GRID card |
| **Hardware token**          | HTOK                                                       |
| **Certificate-based**       | Digital Signature Certificate (DSC), Mobile PKI            |
| **Biometric**               | FingerPrint, Face Recognition                              |
| **Directory and federated** | Kerberos, Office365                                        |

Duress authentication — a distress credential that signals coercion while appearing to succeed — is configured separately, under *Adaptive Authentication*.

Each mode carries an **assurance level** — Basic, Medium or High — and a **category** of Primary, Secondary or Tertiary, which determines the factor slot it occupies when an application is configured.

> Enabling and ranking modes is covered in *Configure MFA*. Applying them to a specific application is covered in *Manage Resources → Assigning roles and authentication*.

***