Intelligent MFA: Challenge the Risk, Not Your Regulars

Intelligent MFA scores every login for risk before deciding whether to challenge it, so the customers who sign in the same way every morning stop paying a friction tax that protects nobody. This walkthrough of the FusionAuth 1.68 release covers the ten risk signals and how they combine into a single low, medium, or high rating, why a deterministic engine rather than a probabilistic one matters when an auditor asks how a challenge decision was made, and how to watch a policy behave against real login traffic before enforcing anything.

• Blanket MFA policies cannot tell a regular apart from a threat. The customer on the same phone in the same city who has signed in every morning for two years gets the identical challenge as a first-time login from an unknown device, in a country the customer has never visited, from an IP already on a block list. Lacking any notion of risk, the system treats everyone as a suspect.
• The friction tax compounds in measurable ways. Drop-off climbs at the MFA step, support tickets accumulate from people asking why they must verify on the same laptop as always, and some users switch MFA off entirely. Plenty of teams never enable it at all rather than impose that cost on every login.
• The scoring is deterministic, and that is the point. Each signal is scored by fixed rules that combine into one composite rating, so there is a written policy behind every challenge and a logged result to show for it. Probabilistic engines return a score with no rule behind it, and an auditor will not accept the answer that the model decided.
• The decision runs inside your own deployment. Whether self-hosted or on a dedicated FusionAuth Cloud instance with no shared infrastructure, scoring happens in your environment against your users' data. Most signals evaluate on local data with no external call, so the engine can run air-gapped.
• Ten signals group four ways: device recognition and trust, network and traffic including block-listed IPs and bot-like behavior, account and credential state such as dormancy and stale or recently changed passwords, and location. Nine are available in every paid plan; Impossible Travel is Enterprise.
• Two signals sharpen when the Reactor data feed is connected. Blocklisted IP and Suspicious User Agent draw on that feed, and when it is unavailable they fall back to a medium contribution while every other signal keeps working. The risk decision stays explainable either way.
• Signals do not vote in isolation. One strong signal can be sufficient on its own, and Impossible Travel alone is enough to trigger a challenge. A cluster also stacks: an unfamiliar device, plus a password unchanged in a year, plus an account dark for months adds up to a login worth a second look even though no single element is alarming.
• Enforcement is a choice you make after seeing the score. Two presets ship ready to use, challenging either on high risk only or on high and medium, and low risk always passes through untouched. Both are no code; Enterprise adds a Lambda that receives the composite score and request context for teams that need to write the rest, though most never do.
• You can observe before you enforce. Point a policy at your own real login traffic in a test tenant and watch how it behaves against your users and their actual patterns, then decide where the line sits rather than switching it on and hoping.
• The deterministic record maps onto compliance frameworks. It lines up with the step-up expectations in NIST SP 800-63B and the access control language in SOC 2 and ISO 27001, because you can point at the rule and what it scored rather than at a model's output.
• Three questions beat a feature scoreboard when evaluating options. Does your authentication need to run where your applications run, do you need to own the challenge decision and be able to see and change the logic, and do the available risk factors actually match how your users get attacked.

• FusionAuth 1.68, the release Intelligent MFA ships in
• The launch blog post behind this walkthrough
• Risk signals documentation, covering all 10 signals
• Contextual MFA configuration, including the two no-code presets
• The FusionAuth Reactor data feed
• Impossible Travel, the one signal gated to Enterprise
• The Enterprise MFA requirement Lambda
• NIST SP 800-63B, cited for its step-up authentication expectations