Synthetic Monitoring for MFA-Protected Applications

[lsantiagos01]

Hi OpsRamp Team and Community,

We are currently evaluating the Synthetic Monitoring capabilities of OpsRamp (based on the documentation at https://docs.opsramp.com/integrations/web-services/synthetic/) and would like to clarify an important technical point for our environment.

Main question:
Does OpsRamp support synthetic monitoring for applications protected by Multi-Factor Authentication (MFA) — for example, web apps that require both a username/password and an MFA challenge (token, push, SMS, etc.) before granting access or executing transactions?

A few follow-up questions:

• Is it possible to simulate the full login + MFA workflow within a synthetic monitor (entering credentials, handling MFA prompt/push, validating session, etc.)?

• Which MFA methods are supported (TOTP, push notifications, SMS, hardware tokens)?

• If the MFA process involves a human interaction (e.g., approving a push on a mobile app), how does OpsRamp handle that step in an automated test?

• Are there any documented limitations or prerequisites for this use case?

• Would we need IP whitelisting, specific agent configurations, or headless browser support to make it work?

• Are there examples or best practices available for configuring synthetic monitoring on MFA-protected applications?

Thank you in advance for your insights and any recommendations.

Santiago Silva