> ## Documentation Index
> Fetch the complete documentation index at: https://anaconda.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Enabling two-factor authentication

Two-factor authentication (2FA) can be enabled in Keycloak using either Google Authenticator or the One-Time Password(OTP) tool FreeOTP.

For more background on OTPs, see [Keycloak's documentation on OTP](https://www.keycloak.org/docs/latest/server_admin/#one-time-password-otp-policies).

## For all new users

1. [Log in to the Keycloak administrative console](https://anaconda.com/docs/psm-on-prem/6.8.0/admin/user_config/user_roles.md#accessing-the-keycloak-administrative-console).

2. Navigate to the dev realm.

3. Select **Realm settings** from the left-hand navigation.

4. Click the **Themes** tab.

   ![](https://mintcdn.com/anaconda-29683c67/9t4S9uQ-n8Qk5XW_/images/psm-on-prem/kc_realm_theme.png?fit=max\&auto=format\&n=9t4S9uQ-n8Qk5XW_\&q=85\&s=664d1adf2edaae506dc14358f6156333)

5. Open the **Account theme** dropdown menu and select **keycloak** from the list.

6. Click **Save**.

7. Select **Authentication** from the left-hand navigation.

8. Click the **Required actions** tab.

9. Find **Configure OTP** in the **Required actions** column, and toggle **Set as default action** to `ON`.

   ![](https://mintcdn.com/anaconda-29683c67/9t4S9uQ-n8Qk5XW_/images/psm-on-prem/kc_configure_2fa.png?fit=max\&auto=format\&n=9t4S9uQ-n8Qk5XW_\&q=85\&s=4f51fb321c2356ce342898a0ad1aa581)

## For existing users

> [!NOTE]
>
> This must be done for every user that does not have an OTP configured.

1. [Log in to the Keycloak administrative console](https://anaconda.com/docs/psm-on-prem/6.8.0/admin/user_config/user_roles.md#accessing-the-keycloak-administrative-console).
2. Navigate to the dev realm.
3. Select **Users** from the left-hand navigation.
4. Select a user from the list to view their profile page.
5. Open the **Required user actions** dropdown menu and select **Configure OTP**.
6. Click **Save**.