Support for Microsoft Authenticator (TOTP) and Role-Based MFA Policies (Providers/Consumers/Admins)

Status Quo & Problem Statement

Currently, the IBM Developer Portal's native MFA implementation only supports Email OTP. Furthermore, managing exemptions is limited to a manual, static list of specific usernames. This is insufficient for enterprise security and creates a high administrative burden.

Email is considered a "soft" factor; our security policy specifically requires support for Microsoft Authenticator (and other TOTP-based apps) to protect our API ecosystem.

Proposed Requirements

1. Integration of Microsoft Authenticator (TOTP)

Enable industry-standard TOTP (Time-based One-Time Password) support within the Developer Portal.

Allow users to enroll their accounts by scanning a QR code with the Microsoft Authenticator app.

Provide a "Security" tab in the user profile for users to manage their own MFA devices and generate recovery codes.

2. Role-Based MFA Enforcement (RBAC)

Replace the manual "Excluded Users" text field with a Policy Engine based on Portal User Roles.

The system must allow administrators to toggle MFA requirements based on the following personas:

Admins: Mandatory MFA (Highest privilege).

Providers: Mandatory MFA (Ability to publish/delete APIs).

Consumers: Optional or Conditional MFA (External developers).

Requirement: Any user assigned a specific role should automatically inherit the MFA requirement without an admin having to manually add their username to a list.

Business Justification

Operational Efficiency: We cannot manually maintain exclusion lists for a growing user base. Automating this via roles (Providers vs. Consumers) reduces human error and "shadow" accounts without MFA.

Scalability: As we onboard thousands of Consumers, we need the flexibility to keep their friction low while keeping our internal Provider/Admin accounts strictly locked down.