Already a NinjaOne customer? Log in to view more guides and the latest updates.

NinjaOne Identity Access Management: Enable Conditional NinjaOne Multifactor Authentication Bypass

  • Last Updated June 26, 2026

Topic

This article explains how to bypass NinjaOne Multifactor Authentication (MFA) when adding an identity provider (IdP) in NinjaOne.

Environment

  • NinjaOne Platform

Description

Skip Login MFA will conditionally skip NinjaOne Login MFA based on evidence in the SAML (Security Assertion Markup Language) response that MFA was performed during the user's login through an IdP. This ensures that the user is not required to enter MFA twice to access NinjaOne.

Bypassing the login MFA does not override MFA requests for administrative tasks throughout NinjaOne. You may still be prompted for MFA depending on your actions. SSO users must still configure MFA for NinjaOne during their first login.

Select a category to learn more:

Important Notes

Consider the following information.

  • NinjaOne supports all IdPs for MFA bypass. If you are using a branded site, you have to add both the native and branded URLs to your IdP's affiliated URL (Uniform Resource Locator) list.
    • For example: https://<branding_hostname>/ws/account/saml-login.
  • There are two different workflows related to SAML.
    • Service Provider (SP) initiated workflow: You navigate to NinjaOne to log in, and you are forwarded to the identity provider.
    • Identity Provider (IdP) initiated workflow: You navigate to your identity provider to log in, and you are forwarded to NinjaOne to log in.

Configure Skip Login MFA

The following example is configured via Okta.

  1. Navigate to Administration → Accounts → Identity Providers.
  2. Click + Add provider. 
accounts_idp_add provider.png
Figure 1: Add a new identity provider in NinjaOne
  1. Add your IdP metadata. Refer to NinjaOne Identity Access Management: Configure Single Sign-On for instructions.
  2. Click Test Connection.
  3. Your IdP connection platform should open in a new tab. Enter your credentials and sign in.
  4. If prompted to receive a push notification, click to send. The SSO configuration dialog will open, indicating the connection has been validated.
  5. Follow all prompts from the IdP to validate the assertion.

If you successfully import the metadata from your IdP, you will be able to activate the Enable conditional NinjaOne MFA bypass toggle button. 

  1. You can update this information at any time; to change the settings for an existing IdP, open the IdP details from the Identity providers page and click Edit.
Figure 2: Edit the IdP settings in NinjaOne (click to enlarge)
  1. Select the appropriate toggle depending on whether you want to activate the MFA bypass for technicians or end users.
idp_edit_configure sso.png
Figure 3: Configure the SSO settings
  1. Configure MFA skip condition dialog will open. Copy the MFA attribute name and value from your identity provider and paste it into the SAML MFA attribute name field to bypass NinjaOne MFA.
  2. Select one MFA attribute option that best meets the organization’s requirements. There are two options available:
    • Contains ANY SAML MFA attribute value
    • Contains ALL SAML MFA attribute value
mfa_select all or any.png
Figure 4: Select one MFA attribute option
  1. After selecting the MFA attribute option, select the value from the drop-down menu. You can use a custom value by typing into the field and then pressing Enter on your keyboard. The Validate assertion action will evaluate the SAML assertion to verify whether the attribute name and value entered were present.
mfa_custom value.png
Figure 5: Create a custom value for the SAML MFA attribute
This dialog will only open if the Test Connection (Step 4) action did not contain the default, expected MFA attribute and value.
  1. Click Validate assertion to test the connection, and then click Apply.
  2. Click Save.

Additional Resources

To learn more about NinjaOne's identity services, refer to Identity Authentication and Management: Resource Catalog.

FAQ

Next Steps