Step-Up authentication

Scope

This document defines how Step-Up Authentication is applied for Business Accounts when a login attempt is identified as risky.

Step-Up Authentication requires users to complete additional verification steps beyond their primary login method.

Purpose

Step-Up Authentication is designed to:

• Reduce account takeover risk

• Apply stronger authentication only when risk is detected

• Protect sensitive business data and operations

• Maintain a smooth user experience for low-risk logins

When Step-Up Authentication Is Triggered

Step-Up Authentication is enforced when:

• One or more Risk Detection Signals exceed configured thresholds

• Organization security policies require additional verification

• Users attempt to access sensitive resources or elevated privileges

Trigger Conditions ├── Medium risk login attempt ├── High risk login attempt ├── Access to sensitive resources ├── Policy-based enforcement └── Compliance requirements

The system may require one or more of the following:

Available methods depend on organization policy configuration.

Authentication Levels ├── Level 1: Primary authentication only ├── Level 2: Primary + one MFA factor └── Level 3: Strong MFA (phishing-resistant)

…Step-Up Authentication Flow

If step-up authentication fails:

After successful step-up authentication:

The following events are recorded:

Logs are available for security review and compliance audits.