---
title: Multi-factor authentication with realm level certificate
slug: isac/admin-guide/android/multi-factor-authentication-with-realm-level-certificate
docTags: 
createdAt: 2026-07-23T05:01:25.153Z
---

This feature enables ISAC Mobile client to connect to Ivanti Connect Secure profiles configured with Username/Password or certificate as primary authentication and TOTP-based secondary authentication with realm-level certificate restrictions.

This feature is supported only when TLS 1.3 and port redirection is enabled.

### Secondary Authentication

Ivanti Secure Access Client supports only one case of dual-factor authentication, in which the client certificate is the primary, while the local authorization is the secondary. From 22.5R2.1/22.6R2 release, SAML Authentication server will appear in Additional Authentication Server dropdown only in case Primary Auth server is Cert Authentication.

| Any Password | AD/LDAP/System Local |
| ------------ | -------------------- |
| Primary      | Sec                  |
| Cert         | TOTP                 |
| Any Password | TOTP                 |
| Any Password | Radius               |
| Cert         | AD                   |
| Cert         | LDAP                 |
| Any Password | AD                   |
| Any Password | LDAP                 |
| Any Password | System Local         |

For configuration details, see [Creating an Authentication Realm](https://help.ivanti.com//ps/help/en_US/ICS/22.x/22.7R2/ag/auth_realms.htm#authentication_realms_1695845683_1016082).