This is a factor plugin for the Moodle MFA Plugin which allows specific user accounts to be exempted from MFA requirements entirely.
Users listed in the configuration will automatically pass this factor, bypassing the need for any additional authentication. All other users receive a neutral result, meaning this factor does not affect them and other configured factors will determine their MFA requirement as normal.
This is intended for integration accounts or service accounts that authenticate programmatically and cannot complete interactive MFA challenges.
| Moodle version | Branch |
|---|---|
| Moodle 4.5+ | main |
Clone or copy this plugin into your Moodle installation:
git clone https://github.com/catalyst/moodle-factor_user admin/tool/mfa/factor/userThen run the upgrade:
php admin/cli/upgrade.phpOr complete the upgrade via Site administration → Notifications.
- Go to Site administration → Security → Multi-factor authentication.
- Enable and configure the Exempted users factor.
- Set the weight to a value that, on its own, satisfies your MFA threshold (typically 100).
- In the Exempted usernames textarea, enter one username per line for each account that should bypass MFA.
integration_api
lms_sync_account
hr_feed_user
Any user whose username appears in this list will pass MFA automatically. Users not on the list are unaffected by this factor.
Combine this factor with your normal MFA factors (e.g. TOTP, Email). Ensure this factor is ordered before the others so exempted accounts are passed immediately without being prompted for a second factor.
Note: This plugin is a workaround. Ideally, integration and service accounts should be configured with the No login (
nologin) or Web services (webservice) authentication method in Moodle. Accounts using these auth methods cannot log in via the standard login form and are therefore naturally exempt from MFA without needing this plugin. Use this factor only when those auth methods are not an option for your integration.
Granting MFA exemptions reduces security for the affected accounts. Ensure that:
- Only non-interactive service/integration accounts are added to the exemption list.
- Exempted accounts use strong, unique passwords and have minimal permissions.
If you find a security issue with this or any Catalyst plugin, please do not open a GitHub issue. Instead, responsibly disclose the issue in private via email:
If you have issues please log them in GitHub.
This plugin was developed by Catalyst IT Australia:
