[Yandex Cloud documentation](../../../index.md) > [Yandex Identity Hub](../../index.md) > [Step-by-step guides](../index.md) > Authentication > Managing MFA > Activating or deactivating an MFA policy

# Activating or deactivating an MFA policy

## Activating an MFA policy {#reactivate-policy}

To activate an inactive [MFA policy](../../concepts/mfa.md#mfa-policies):

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization).
  1. In the left-hand panel, select ![shield](../../../_assets/console-icons/shield.svg) **Security settings**.
  1. Navigate to the **MFA policies** tab.
  1. In the MFA policy list, click ![ellipsis](../../../_assets/console-icons/ellipsis.svg) in the policy row and select ![arrows-rotate-right](../../../_assets/console-icons/arrows-rotate-right.svg) **Activate**.
  1. In the window that opens, confirm the operation.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. See the description of the CLI command for activating an MFA policy:

     ```bash
     yc organization-manager mfa-enforcement activate --help
     ```

  1. To activate an MFA policy, run this command:

     ```bash
     yc organization-manager mfa-enforcement activate \
       --id <policy_ID>
     ```

     Where `--id` is the ID of the MFA policy you need to activate.

- Terraform {#tf}

  With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.
  
  Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license.
  
  For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../../terraform/index.md).

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../../terraform/authentication.md) using the appropriate method.

  1. Open the Terraform configuration file and update the `status` parameter in the `yandex_organizationmanager_mfa_enforcement` resource:

     ```hcl
     resource "yandex_organizationmanager_mfa_enforcement" "example_mfa_policy" {
       name            = "<policy_name>"
       organization_id = "<organization_ID>"
       acr_id          = "<authentication_factor_type>"
       ttl             = "<lifetime>"
       status          = "MFA_ENFORCEMENT_STATUS_ACTIVE"
       apply_at        = "<activation_time>"
       enroll_window   = "<creation_deadline>"
       description     = "<policy_description>"
     }
     ```

     Where `status` is the policy status: `MFA_ENFORCEMENT_STATUS_ACTIVE` to activate the policy. This is an optional setting.

     For more on `yandex_organizationmanager_mfa_enforcement` properties, see [this provider guide](../../../terraform/resources/organizationmanager_mfa_enforcement.md).

  1. Apply the changes:

     1. In the terminal, navigate to the configuration file directory.
     1. Make sure the configuration is correct using this command:
     
        ```bash
        terraform validate
        ```
     
        If the configuration is valid, you will get this message:
     
        ```bash
        Success! The configuration is valid.
        ```
     
     1. Run this command:
     
        ```bash
        terraform plan
        ```
     
        You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
     1. Apply the configuration changes:
     
        ```bash
        terraform apply
        ```
     
     1. Type `yes` and press **Enter** to confirm the changes.

     Terraform will activate the MFA policy. You can check the MFA policy update using the [Cloud Center UI](https://center.yandex.cloud/organization) or this [CLI](../../../cli/index.md) command:

     ```bash
     yc organization-manager mfa-enforcement get <policy_ID>
     ```

- API {#api}

  Use the [Activate](../../api-ref/MfaEnforcement/activate.md) REST API method for the [MfaEnforcement](../../api-ref/MfaEnforcement/index.md) resource or the [MfaEnforcementService/Activate](../../api-ref/grpc/MfaEnforcement/activate.md) gRPC API call.

{% endlist %}

As a result, the MFA policy will be activated and switch to the `Active` status, and users with accounts added to the policy's target groups will be required to use an additional authentication factor.

## Deactivating an MFA policy {#deactivate-policy}

To temporarily deactivate an [MFA policy](../../concepts/mfa.md#mfa-policies):

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization).
  1. In the left-hand panel, select ![shield](../../../_assets/console-icons/shield.svg) **Security settings**.
  1. Navigate to the **MFA policies** tab.
  1. In the MFA policy list, click ![ellipsis](../../../_assets/console-icons/ellipsis.svg) in the policy row and select ![pause](../../../_assets/console-icons/pause.svg) **Suspend**.
  1. In the window that opens, confirm the operation.

- CLI {#cli}

  1. See the description of the CLI command for deactivating an MFA policy:

     ```bash
     yc organization-manager mfa-enforcement deactivate --help
     ```

  1. To deactivate an MFA policy, run this command:

     ```bash
     yc organization-manager mfa-enforcement deactivate \
       --id <policy_ID>
     ```

     Where `--id` is the ID of the MFA policy you need to deactivate.

- Terraform {#tf}

  With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.
  
  Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license.
  
  For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../../terraform/index.md).

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../../terraform/authentication.md) using the appropriate method.

  1. Open the Terraform configuration file and update the `status` parameter in the `yandex_organizationmanager_mfa_enforcement` resource:

     ```hcl
     resource "yandex_organizationmanager_mfa_enforcement" "example_mfa_policy" {
       name            = "<policy_name>"
       organization_id = "<organization_ID>"
       acr_id          = "<authentication_factor_type>"
       ttl             = "<lifetime>"
       status          = "MFA_ENFORCEMENT_STATUS_INACTIVE"
       apply_at        = "<activation_time>"
       enroll_window   = "<creation_deadline>"
       description     = "<policy_description>"
     }
     ```

     Where `status` is the policy status: `MFA_ENFORCEMENT_STATUS_INACTIVE` to deactivate the policy. This is an optional setting.

     For more on `yandex_organizationmanager_mfa_enforcement` properties, see [this provider guide](../../../terraform/resources/organizationmanager_mfa_enforcement.md).

  1. Apply the changes:

     1. In the terminal, navigate to the configuration file directory.
     1. Make sure the configuration is correct using this command:
     
        ```bash
        terraform validate
        ```
     
        If the configuration is valid, you will get this message:
     
        ```bash
        Success! The configuration is valid.
        ```
     
     1. Run this command:
     
        ```bash
        terraform plan
        ```
     
        You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
     1. Apply the configuration changes:
     
        ```bash
        terraform apply
        ```
     
     1. Type `yes` and press **Enter** to confirm the changes.

     Terraform will deactivate the MFA policy. You can check the MFA policy update using the [Cloud Center UI](https://center.yandex.cloud/organization) or this [CLI](../../../cli/index.md) command:

     ```bash
     yc organization-manager mfa-enforcement get <policy_ID>
     ```

- API {#api}

  Use the [Deactivate](../../api-ref/MfaEnforcement/deactivate.md) REST API method for the [MfaEnforcement](../../api-ref/MfaEnforcement/index.md) resource or the [MfaEnforcementService/Deactivate](../../api-ref/grpc/MfaEnforcement/deactivate.md) gRPC API call.

{% endlist %}

As a result, the MFA policy will be deactivated and switch to the `Inactive` status, while users whose accounts belong to the policy's target groups will no longer be required to use an additional authentication factor.

If you need to temporarily exclude specific users or groups from the policy without deactivating it completely, use [MFA policy exceptions](excluded-audience.md).

#### Useful links {#see-also}

* [Creating an MFA policy](create-policy.md)
* [Updating an MFA policy](update-policy.md)
* [Applying an MFA policy to users](add-users.md)
* [Managing exceptions to MFA policies](excluded-audience.md)
* [Deleting an MFA policy](delete-policy.md)
* [Removing an MFA factor and resetting the verification date](manage-verification.md)
* [Multi-factor authentication in Yandex Identity Hub](../../concepts/mfa.md)