Can I limit my authenticator account to a single device and browser?

[mercape]

Can I limit my authenticator account to a single device and browser?
The idea is that it can only be configured once on a single working device and never on a different one.
Thank you :) .

[Sneezry]

You can disable browser sync on the preferences page to store data only on your local machine.

[mercape]

One more question:
Can an account ([email protected]) be limited to only one configuration in the authenticator?
This would be for a work account and if the employee leaves the company we want to prevent another browser from being configured with the authenticator.

[Sneezry]

I don't think it's possible by TOTP RFC 6238, because you have to provide the secret either by showing a QR code or a secret string. And you cannot limit the user only to import that to only one 2FA client.

As far as I know, you can make it in two ways, but not TOTP.

1. Create your company's own 2FA client, and make the client import accounts by connecting to your company's server directly. The famous game social app Steam does a similar thing, the user cannot get the secret in standard ways.
2. Use a hardware security key instead of software as MFA (Yubikey for example).

[mymindstorm]

This would be for a work account and if the employee leaves the company we want to prevent another browser from being configured with the authenticator.

The best way to deal with this situation would be to lock or disable the employee's active directory/sso account. Their 2FA secrets should be unique and only associated with their AD or SSO account. That way, it is irrelevant if an employee still has their passwords and 2FA credentials.

[mercape]

The accounts are associated to an Azure Active Directory with a VPN virtual tunnel. We want the accounts to be associated to the autenticator extension to validate the VPN connection with 2FA.
From what you tell me it could be done without problems, if an employee leaves the company he/she will be removed from AD and his/her 2FA credentials would no longer be valid in the browser, right?

[mymindstorm]

Yes, that should be the case, but you should confirm the details with your IT admin and/or via a test account. Although, I would try to think of the situation in terms of the employee losing access to your company's internal services instead of an invalidation of the employee's 2FA credentials.

[mercape]

They are employees external to our infrastructure and we want them to connect to 2FA via VPN but they do not have a work phone to enable an authenticator.
The idea is that they can only configure 2FA once per account via the web browser, for security reasons.
Your application seems to fit the bill.
Indeed, we tested absolutely everything with our test team.