Hi everyone,

I manage a Zoho Creator portal for our clients and have a security concern about MFA for portal users. I’d like to know if anyone has faced this and how you handled it.

Setup

• Creator plan: Enterprise
• “Enforce Multi-Factor Authentication (MFA) for portal users” is enabled.
• Portal users can only set up an OTP authenticator app (OneAuth, Google Authenticator, Microsoft Authenticator, Authy, etc.) on their mobile.

The concern
We give portal access to employees of our client companies. Each employee sets up the authenticator on their personal phone. When an employee leaves the client company, the client deactivates their company email, but the authenticator stays on the employee’s phone. They can still sign in to our portal with their password and OTP. This is a data security risk for us.

What we’d like
We’d like the MFA OTP to be sent to the user’s registered email address instead of an authenticator app. Then, once the client deactivates the employee’s email, the employee can no longer receive the OTP or sign in.

Questions

1. Does Zoho Creator support email-based OTP as an MFA mode for portal users? If yes, how do we enable it? If not, is it on the roadmap?
2. If this isn’t supported, what other approach do you recommend to automatically remove a departed employee’s portal access?

Any guidance, workarounds, or best practices would be appreciated. I can share screenshots of my settings if that helps.

Thanks,
KPFS