Skip to main content
Sanne van Opstal-Brakel
Employee
Sanne van Opstal-Brakel
Employee
Oct 14, 2026 9:30 AM UTC

Cybersecurity Awareness Month | Core 4 habit: lock the door twice with MFA via SSO

This post is part of our Cybersecurity Awareness Month series, built around four core themes. Read the first post about reporting scams. Next up: MFA via SSO.

A strong password stops the easy attacks. It doesn’t help once someone already has your password, and stolen credentials play a part in 39% of breaches in Verizon’s 2026 DBIR. MFA closes that gap: a stolen password on its own gets an attacker a lot less far.

Enforce MFA through SSO

TOPdesk doesn’t have a single “turn on MFA” switch. What it does have is SAML SSO for both the Self-Service Portal and the Operator’s Section, and that’s the better setup. Connect TOPdesk to the identity provider your organization already uses (Microsoft Entra ID and Okta are common ones), and you can enforce MFA there for every login, not just the ones into TOPdesk.

How to set it up

  1. Configure SAML SSO. Go to Settings > Functional Settings > Login Settings > General. The SSO/SAML setup in the Documentation Portal walks you through it.
  2. Do it for both realms. Set it up separately for the Self-Service Portal realm and the Operator’s Section realm, because they aren’t linked automatically.
  3. Set the MFA policy in your identity provider. Connecting a provider doesn’t enforce MFA by itself. That comes from the provider’s policies, like a Conditional Access rule in Entra ID.
  4. Check for local password logins. Any that are left in TOPdesk bypass SSO and MFA.

Stuck on a step? Search the My TOPdesk knowledge base.

The most common miss

The Self-Service Portal is secured, and the Operator’s Section is still on a plain password, even though operator accounts have far more to lose.

A note on NIS2 and DORA

If NIS2 or DORA applies to your organization, TOPdesk can support the processes behind compliance, like incident handling and asset management. No tool makes you compliant on its own, and TOPdesk is no exception. Read more about it on this page (Dutch only).

Your turn

Quick check: is MFA enforced through your identity provider, does it cover both realms, and is every local password login gone? Two more posts in the Core 4 are on their way. In the meantime, how does your setup look? Tell us in the comments.

Terms & ConditionsAccessibility statement