[GH-ISSUE #5088] Add MFA to Local Users #9877

New Issue

saavagebueno commented

@Camis commented on GitHub (Jan 11, 2026):

Yes, this is must have!

@Camis commented on GitHub (Jan 11, 2026): Yes, this is must have!

saavagebueno commented

@ashokjp2 commented on GitHub (Jan 11, 2026):

Yes +1, must have considering this opens access to the entire network. Also currently I cant find option to even change password to make it more secure. If we had atleast MFA, then that issue could have waited.

@ashokjp2 commented on GitHub (Jan 11, 2026): Yes +1, must have considering this opens access to the entire network. Also currently I cant find option to even change password to make it more secure. If we had atleast MFA, then that issue could have waited.

saavagebueno commented

@obale commented on GitHub (Jan 17, 2026):

+1

My current workaround is to add an Identity Provider via the dashboard, transfer ownership status to an IdP account and block the internal admin user.

@obale commented on GitHub (Jan 17, 2026): +1 My current workaround is to add an Identity Provider via the dashboard, transfer ownership status to an IdP account and block the internal admin user.

saavagebueno commented

@ashokjp2 commented on GitHub (Jan 18, 2026):

There is no way I see to block or disable the internal user. Please let me know if I am missing something. If i delete, what happens to the device / peers mapped to the initial owner user account.

@ashokjp2 commented on GitHub (Jan 18, 2026): There is no way I see to block or disable the internal user. Please let me know if I am missing something. If i delete, what happens to the device / peers mapped to the initial owner user account.

saavagebueno commented

@obale commented on GitHub (Jan 18, 2026):

In my case I connected an external IdP, logged in with an IdP account first and made it Owner. After that under the Users page there is a switch allowing to block the internal user.

The internal account does not have any peers or resources. It was a new setup. This may not work for most setups though.

@obale commented on GitHub (Jan 18, 2026): In my case I connected an external IdP, logged in with an IdP account first and made it Owner. After that under the Users page there is a switch allowing to block the internal user. The internal account does not have any peers or resources. It was a new setup. This may not work for most setups though.

saavagebueno commented

@ashokjp2 commented on GitHub (Jan 18, 2026):

Perfect, thankyou. anyway to move peers and devices to the new admin as well?
If so that solves my problem temporarily :)

@ashokjp2 commented on GitHub (Jan 18, 2026): Perfect, thankyou. anyway to move peers and devices to the new admin as well? If so that solves my problem temporarily :)

saavagebueno commented

@obale commented on GitHub (Jan 18, 2026):

netbird down and netbird up on the device or logout and login with new account!?! I am not aware of an automated migration approach.

@obale commented on GitHub (Jan 18, 2026): netbird down and netbird up on the device or logout and login with new account!?! I am not aware of an automated migration approach.

saavagebueno commented

@LorenzoVaccher01 commented on GitHub (Feb 3, 2026):

+1!!!!

@LorenzoVaccher01 commented on GitHub (Feb 3, 2026): +1!!!!

saavagebueno commented

https://github.com/dexidp/dex/pull/3712

@heymoe commented on GitHub (Feb 3, 2026):

My guess is Netbird is waiting on Dex to add 2FA support before it will add that functionality to local user management without having to use a 3rd party / external IdP provider. I found this thread tracking the progress of adding 2FA to Dex if anyone is interested in following the progress:

@heymoe commented on GitHub (Feb 3, 2026): My guess is Netbird is waiting on Dex to add 2FA support before it will add that functionality to local user management without having to use a 3rd party / external IdP provider. I found this thread tracking the progress of adding 2FA to Dex if anyone is interested in following the progress: https://github.com/dexidp/dex/pull/3712

saavagebueno commented

@proteus88 commented on GitHub (Feb 5, 2026):

For small deployments this is a must have. +1

@proteus88 commented on GitHub (Feb 5, 2026): For small deployments this is a must have. +1

saavagebueno commented

@adrianbaena commented on GitHub (Feb 25, 2026):

If anybody is interested, here the team behind Dex is following the whole process of SSO and MFA: https://github.com/dexidp/dex/issues/4560

@adrianbaena commented on GitHub (Feb 25, 2026): If anybody is interested, here the team behind Dex is following the whole process of SSO and MFA: https://github.com/dexidp/dex/issues/4560

saavagebueno commented

@stelle007 commented on GitHub (Mar 16, 2026):

MFA was included when you used Zentinal for the quick deploymend. why did you make the product worse for self-hosted setup and remove MFA ?

This is a must have.

+1

@stelle007 commented on GitHub (Mar 16, 2026): MFA was included when you used Zentinal for the quick deploymend. why did you make the product worse for self-hosted setup and remove MFA ? This is a must have. +1

saavagebueno commented

@hyllm commented on GitHub (Mar 18, 2026):

+1 ... also using Google as IdP for Owner and no local admin for now

@hyllm commented on GitHub (Mar 18, 2026): +1 ... also using Google as IdP for Owner and no local admin for now

saavagebueno commented

https://github.com/dexidp/dex/pull/3712

@svenkispert commented on GitHub (Mar 21, 2026):

It's merged! :) Will be included in the upcoming release.

My guess is Netbird is waiting on Dex to add 2FA support before it will add that functionality to local user management without having to use a 3rd party / external IdP provider. I found this thread tracking the progress of adding 2FA to Dex if anyone is interested in following the progress:

dexidp/dex#3712

@svenkispert commented on GitHub (Mar 21, 2026): It's merged! :) Will be included in the upcoming release. https://github.com/dexidp/dex/pull/3712 > My guess is Netbird is waiting on Dex to add 2FA support before it will add that functionality to local user management without having to use a 3rd party / external IdP provider. I found this thread tracking the progress of adding 2FA to Dex if anyone is interested in following the progress: > > [dexidp/dex#3712](https://github.com/dexidp/dex/pull/3712)

saavagebueno commented

@IngwiePhoenix commented on GitHub (Mar 29, 2026):

Came across this too and found this article here: https://netbird.io/knowledge-hub/accessible-mfa-implementation

Just installed NetBird myself and was confused to not find any MFA. This is very cruicial.

@IngwiePhoenix commented on GitHub (Mar 29, 2026): Came across this too and found this article here: https://netbird.io/knowledge-hub/accessible-mfa-implementation Just installed NetBird myself and was confused to not find any MFA. This is very cruicial.

saavagebueno commented

@zcj6758 commented on GitHub (May 4, 2026):

我刚安装了NetBird，需要内置idp启用双因素身份验证（MFA）功能。这非常重要

@zcj6758 commented on GitHub (May 4, 2026): 我刚安装了NetBird，需要内置idp启用双因素身份验证（MFA）功能。这非常重要

saavagebueno commented

@jnfrati commented on GitHub (May 4, 2026):

Hey hey! We're looking to release the MFA functionality in the next week or so, sorry for keeping y'all waiting!

We're trying to polish some rough edges but hopefully we can get this functionality out soon 🙌

In case anyone wants to keep an eye on the PRs:

Management: https://github.com/netbirdio/netbird/pull/5804
Dashboard: https://github.com/netbirdio/dashboard/pull/615

@jnfrati commented on GitHub (May 4, 2026): Hey hey! We're looking to release the MFA functionality in the next week or so, sorry for keeping y'all waiting! We're trying to polish some rough edges but hopefully we can get this functionality out soon 🙌 In case anyone wants to keep an eye on the PRs: - Management: https://github.com/netbirdio/netbird/pull/5804 - Dashboard: https://github.com/netbirdio/dashboard/pull/615

saavagebueno commented

@pkkrusty commented on GitHub (May 9, 2026):

Is this MFA limited to cloud SaaS offering, or will it exist in self-hosted?

@pkkrusty commented on GitHub (May 9, 2026): Is this MFA limited to cloud SaaS offering, or will it exist in self-hosted?

saavagebueno commented

@Discolor3182 commented on GitHub (May 14, 2026):

It is added to 0.71.0. Thank you very much!

@Discolor3182 commented on GitHub (May 14, 2026): It is added to 0.71.0. Thank you very much!

saavagebueno commented

@pkkrusty commented on GitHub (May 14, 2026):

Initial test seems to work great! Thank you for this important security feature!

@pkkrusty commented on GitHub (May 14, 2026): Initial test seems to work great! Thank you for this important security feature!

saavagebueno commented