[Yandex Cloud documentation](../../../index.md) > [Yandex Identity Hub](../../index.md) > [Step-by-step guides](../index.md) > Authentication > Managing MFA > Applying an MFA policy to users

# Applying an MFA policy to users

For an [MFA policy](../../concepts/mfa.md#mfa-policies) to apply to user accounts, you need to explicitly add the relevant users or the [groups](../../concepts/groups.md) they are members of to the policy's target groups.

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization).
  1. In the left-hand panel, select ![shield](../../../_assets/console-icons/shield.svg) **Security settings**.
  1. Navigate to the **MFA policies** tab and select the policy you need from the list. In the window that opens:

      1. Navigate to the **Users and groups** tab.
      1. To add a new user or group to the policy's target groups:

          1. Click ![person-plus](../../../_assets/console-icons/person-plus.svg) **Add users**.
          1. In the window that opens, select the required user or user group.
          1. Click **Add**.
      1. To delete a user or group from the policy:
          1. In the list of users and groups, click ![ellipsis](../../../_assets/console-icons/ellipsis.svg) and select ![trash-bin](../../../_assets/console-icons/trash-bin.svg) **Delete** next to the user or user group.
          1. Confirm the deletion.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. View a list of users or groups subject to the MFA policy:

     ```bash
     yc organization-manager mfa-enforcement list-audience \
       --id <policy_ID>
     ```

  1. See the description of the CLI command for changing the list of users or groups subject to the MFA policy:

     ```bash
     yc organization-manager mfa-enforcement update-audience --help
     ```

  1. To add users or groups to the MFA policy, or to remove them from it, run this command:

     ```bash
     yc organization-manager mfa-enforcement update-audience \
       --id <policy_ID> \
       --audience-delta subject-id=<subject_ID>,action=<action>
     ```

     Where:

     * `--audience-delta`: Parameter to edit the list of users/groups in the policy:
       * `subject-id`: User or group ID.
       * `action`: Action, `action-add` to add, `action-remove` to delete.

     You can specify multiple `--audience-delta` parameters to edit more than one object at the same time.

- Terraform {#tf}

  With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.
  
  Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license.
  
  For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../../terraform/index.md).

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../../terraform/authentication.md) using the appropriate method.

  1. To add a user or group to an MFA policy, describe the `yandex_organizationmanager_mfa_enforcement_audience` resource parameters in the configuration file:

     ```hcl
     resource "yandex_organizationmanager_mfa_enforcement_audience" "example_mfa_audience" {
       mfa_enforcement_id = "<MFA_policy_ID>"
       subject_id         = "<user_or_group_ID>"
     }
     ```

     Where:

     * `mfa_enforcement_id`: ID of the MFA policy to which you want to add a user or group. This is a required setting.
     * `subject-id`: ID of the user or group you need to add to the MFA policy. This is a required setting.

     To add multiple users or groups, create a separate `yandex_organizationmanager_mfa_enforcement_audience` resource for each one.

     For more on the properties of the `yandex_organizationmanager_mfa_enforcement_audience` resource, see [this provider guide](../../../terraform/resources/organizationmanager_mfa_enforcement_audience.md).

  1. Create the resources:

     1. In the terminal, navigate to the configuration file directory.
     1. Make sure the configuration is correct using this command:
     
        ```bash
        terraform validate
        ```
     
        If the configuration is valid, you will get this message:
     
        ```bash
        Success! The configuration is valid.
        ```
     
     1. Run this command:
     
        ```bash
        terraform plan
        ```
     
        You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
     1. Apply the configuration changes:
     
        ```bash
        terraform apply
        ```
     
     1. Type `yes` and press **Enter** to confirm the changes.

     Terraform will create all the required resources. You can make sure the users were added to the MFA policy using the [Cloud Center UI](https://center.yandex.cloud/organization) or this [CLI](../../../cli/index.md) command:

     ```bash
     yc organization-manager mfa-enforcement list-audience --id <policy_ID>
     ```

  1. To delete a user or group from an MFA policy, delete the relevant `yandex_organizationmanager_mfa_enforcement_audience` resource from the configuration file and apply the changes.

- API {#api}

  Use the [UpdateAudience](../../api-ref/MfaEnforcement/updateAudience.md) REST API method for the [MfaEnforcement](../../api-ref/MfaEnforcement/index.md) resource or the [MfaEnforcementService/UpdateAudience](../../api-ref/grpc/MfaEnforcement/updateAudience.md) gRPC API call.

{% endlist %}

If you remove a user or group from an MFA policy and re-add them later, you will have to set up authentication for them again. To avoid this, add the user or group to the [policy exceptions](excluded-audience.md).

{% note info %}

You can add any type of [user accounts](../../../iam/concepts/users/accounts.md) to the MFA policy target groups, but the policy will only apply to [federated](../../../iam/concepts/users/accounts.md#saml-federation) and [local](../../../iam/concepts/users/accounts.md#local) user accounts.

If a group added to an MFA policy includes users with different account types, the policy will only apply to users with federated and local accounts.

{% endnote %}

#### Useful links {#see-also}

* [Managing exceptions to MFA policies](excluded-audience.md)
* [Creating an MFA policy](create-policy.md)
* [Updating an MFA policy](update-policy.md)
* [Activating or deactivating an MFA policy](deactivate-reactivate-policy.md)
* [Deleting an MFA policy](delete-policy.md)
* [Removing an MFA factor and resetting the verification date](manage-verification.md)
* [Multi-factor authentication in Yandex Identity Hub](../../concepts/mfa.md)