In short: LastPass MFA is an add-on to LastPass Business that extends multi-factor authentication from the vault to VPNs, workstations, on-premises apps and identity providers. Users approve sign-ins with the LastPass Authenticator, biometrics or FIDO2 hardware keys, under contextual policies. It is licensed per user, requires LastPass Business, and Forever Systems supplies and configures it.
What LastPass MFA is
Every LastPass vault can, and should, be protected with multi-factor authentication. The LastPass MFA add-on goes further: it uses the same LastPass Authenticator app to protect the other places people sign in, so you have one MFA tool rather than one for the vault, another for the VPN and a third for computer logins.
LastPass calls these capabilities Advanced MFA. On LastPass's own published plans they come with Business Max; through us they are added to LastPass Business as a per-user add-on, so you can give them to the people who need them without changing everyone's plan.
What it protects and how
| Area | What the MFA add-on does |
|---|---|
| VPNs | A second factor on remote access VPN logins |
| Workstations | Workstation MFA on computer logins |
| On-premises and legacy apps | MFA for applications that sit outside your cloud identity provider |
| Cloud apps | MFA alongside LastPass single sign-on |
| Identity providers | MFA at sign-in to your identity provider |
| Policies | Contextual rules based on IP address, location and time of day, so routine sign-ins stay quick and unusual ones are challenged |
Users approve sign-ins with a push notification to the LastPass Authenticator, with fingerprint or face recognition on their phone, or with SMS one-time passcodes. LastPass also supports FIDO2-certified hardware keys, such as YubiKey and Feitian keys, for people who cannot or should not use a phone.
How LastPass MFA is licensed
The MFA add-on is licensed per user and can only be added to LastPass Business: every user who has the add-on also needs a LastPass Business licence. You do not have to buy it for everyone. A common pattern is to add it for administrators, finance and remote staff first, and extend it later.
- Prerequisite: LastPass Business on the same account.
- Term: aligned with your LastPass Business subscription; we confirm the term and renewal date when we quote.
- Changes: add users to the add-on as your rollout grows.
Prices depend on the number of users, so ask us for a quote.
Requirements and deployment
Advanced MFA relies on your users being managed in LastPass, so we start by making sure LastPass Business is connected to your directory and everyone has enrolled the LastPass Authenticator for vault MFA. Workstation MFA needs a LastPass component on each computer, which we push out with your existing device management rather than asking staff to install it. We also check how your users sign in to LastPass today, for example with federated login through Microsoft Entra ID, because that affects which MFA options apply where.
Our usual approach:
- Confirm the directory integration and enrol everyone in the LastPass Authenticator for vault MFA.
- Agree contextual policies, such as trusted office IP ranges and permitted locations.
- Turn on MFA for the VPN and single sign-on apps.
- Pilot Workstation MFA with IT, then roll it out by team, with a recovery process for lost phones.
- Issue hardware keys to anyone without a suitable smartphone.
Who it suits and how we help
The add-on suits organisations already using, or moving to, LastPass Business that want MFA on VPN and workstation logins without buying a separate identity product. Cyber insurers commonly ask about MFA on remote access and admin accounts, and MFA on cloud services is part of the Cyber Essentials requirements.
If you need a dedicated access security platform with device trust, compare it with the options in identity, MFA and privileged access or our specialist Cisco Duo MFA site. We supply the add-on on your Forever Systems account, configure policies and integrations, and support users through enrolment.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Can I buy LastPass MFA without LastPass Business?
No. Through us the MFA add-on is sold per user on top of LastPass Business, and each user with the add-on needs a Business licence.
Does LastPass MFA work on computer logins?
Yes. Workstation MFA adds a second factor to computer logins, approved through the LastPass Authenticator or another supported method.
Which authentication methods does LastPass MFA support?
Push approval in the LastPass Authenticator, biometrics on the phone, SMS one-time passcodes and FIDO2 hardware keys such as YubiKey, with contextual policies based on IP address, location and time of day.
Is LastPass MFA the same as Business Max?
No. Business Max is a LastPass plan that includes advanced MFA along with unlimited single sign-on and monitoring features. The MFA add-on gives LastPass Business users the advanced MFA capabilities on their own.