diff --git a/new-ui/src/pages/full/OverviewPage/components/ConnectModal/ConnectModal.tsx b/new-ui/src/pages/full/OverviewPage/components/ConnectModal/ConnectModal.tsx
index febf59116..3fc75a72a 100644
--- a/new-ui/src/pages/full/OverviewPage/components/ConnectModal/ConnectModal.tsx
+++ b/new-ui/src/pages/full/OverviewPage/components/ConnectModal/ConnectModal.tsx
@@ -2,16 +2,18 @@
 import './style.scss';
 
 import { useQuery } from '@tanstack/react-query';
-import { type ReactNode, useEffect } from 'react';
+import { Fragment, type ReactNode, useEffect } from 'react';
 import { useShallow } from 'zustand/shallow';
 import { Modal } from '../../../../../shared/components/Modal/Modal';
 import { useAppData } from '../../../../../shared/providers/AppDataContext';
 import { api } from '../../../../../shared/rust-api/api';
 import { isPresent } from '../../../../../shared/utils/isPresent';
+import { mfaStepCount, mfaToText } from '../../../../../shared/utils/mfa';
 import {
   ConnectModalTitle,
   ConnectModalView,
   type ConnectModalViewValue,
+  mfaMethodToConnectModalView,
 } from './hooks/types';
 import { useConnectModal } from './hooks/useConnectModal';
 import { ConnectModalConnectionError } from './views/ConnectModalConnectionError/ConnectModalConnectionError';
@@ -25,17 +27,26 @@ import { ConnectModalPostureCheckFail } from './views/ConnectModalPostureCheckFa
 export const ConnectModal = () => {
   const reset = useConnectModal((s) => s.reset);
 
-  const [view, visible, location] = useConnectModal(
-    useShallow((s) => [s.view, s.visible, s.location]),
+  const [view, visible, location, stepIndex, stepPlan] = useConnectModal(
+    useShallow((s) => [s.view, s.visible, s.location, s.stepIndex, s.stepPlan]),
   );
 
+  const stepCount = isPresent(location) ? mfaStepCount(location) : 0;
+  const stepMethod = stepPlan[stepIndex];
+  const isOnMfaStepView =
+    isPresent(stepMethod) && view === mfaMethodToConnectModalView(stepMethod);
+  const stepLabel =
+    stepCount > 1 && isOnMfaStepView
+      ? `Step ${stepIndex + 1}/${stepCount}: ${mfaToText(stepMethod)}`
+      : null;
+
   const isOpen = isPresent(view) && isPresent(location) && visible;
 
   return (
     <Modal
       id="connect-modal"
       size="small"
-      title={view ? ConnectModalTitle[view] : ''}
+      title={stepLabel ?? (view ? ConnectModalTitle[view] : '')}
       isOpen={isOpen}
       afterClose={() => {
         reset();
@@ -75,6 +86,7 @@ const ModalContent = () => {
     retry: false,
   });
   const activeView = useConnectModal((s) => s.view);
+  const stepIndex = useConnectModal((s) => s.stepIndex);
 
   // When user completes connection and it's working modal is no longer needed so auto close it
   // biome-ignore lint/correctness/useExhaustiveDependencies: side-effect on connect
@@ -88,5 +100,7 @@ const ModalContent = () => {
 
   if (!activeView) return null;
 
-  return viewContent[activeView];
+  return (
+    <Fragment key={`${activeView}-${stepIndex}`}>{viewContent[activeView]}</Fragment>
+  );
 };
diff --git a/new-ui/src/pages/full/OverviewPage/components/ConnectModal/hooks/useConnectModal.tsx b/new-ui/src/pages/full/OverviewPage/components/ConnectModal/hooks/useConnectModal.tsx
index 4e79e839a..0a9d43b97 100644
--- a/new-ui/src/pages/full/OverviewPage/components/ConnectModal/hooks/useConnectModal.tsx
+++ b/new-ui/src/pages/full/OverviewPage/components/ConnectModal/hooks/useConnectModal.tsx
@@ -4,7 +4,9 @@ import {
   MfaMethod,
   type MfaMethodValue,
 } from '../../../../../../shared/rust-api/types';
-import type { ConnectModalViewValue } from './types';
+import { isPresent } from '../../../../../../shared/utils/isPresent';
+import { resolveMfaStepPlan } from '../../../../../../shared/utils/mfa';
+import { type ConnectModalViewValue, mfaMethodToConnectModalView } from './types';
 
 interface StoreValues {
   visible: boolean;
@@ -14,6 +16,9 @@ interface StoreValues {
   postureError: string | null;
   autoStartOpenId: boolean;
   mfaMethod: MfaMethodValue;
+  stepIndex: number;
+  stepPlan: MfaMethodValue[];
+  mfaToken: string | null;
 }
 
 const defaults: StoreValues = {
@@ -24,11 +29,16 @@ const defaults: StoreValues = {
   perviousView: null,
   postureError: null,
   autoStartOpenId: false,
+  stepIndex: 0,
+  stepPlan: [],
+  mfaToken: null,
 } as const;
 
 interface Store extends StoreValues {
   open: (init?: Partial<StoreValues>) => void;
   setView: (view: ConnectModalViewValue, values?: Partial<StoreValues>) => void;
+  setMfaToken: (token: string) => void;
+  goToStep: (stepIndex: number) => void;
   reset: () => void;
 }
 
@@ -38,7 +48,16 @@ export const useConnectModal = create<Store>((set, get) => ({
     set(defaults);
   },
   open: (init) => {
-    set({ ...defaults, ...init, visible: true });
+    const location = init?.location ?? null;
+    const stepPlan = isPresent(location) ? resolveMfaStepPlan(location) : [];
+    set({ ...defaults, ...init, stepPlan, visible: true });
+  },
+  setMfaToken: (token) => {
+    set({ mfaToken: token });
+  },
+  goToStep: (stepIndex) => {
+    const { stepPlan, setView } = get();
+    setView(mfaMethodToConnectModalView(stepPlan[stepIndex]), { stepIndex });
   },
   setView: (view, vals) => {
     const pervious = get().view ?? null;
diff --git a/new-ui/src/pages/full/OverviewPage/components/ConnectModal/hooks/useConnectModalMfaOidc.ts b/new-ui/src/pages/full/OverviewPage/components/ConnectModal/hooks/useConnectModalMfaOidc.ts
index 27a4dc194..d91591cfd 100644
--- a/new-ui/src/pages/full/OverviewPage/components/ConnectModal/hooks/useConnectModalMfaOidc.ts
+++ b/new-ui/src/pages/full/OverviewPage/components/ConnectModal/hooks/useConnectModalMfaOidc.ts
@@ -29,7 +29,9 @@ export const useConnectModalMfaOidc = ({
   onSessionExpired,
   onServiceUnavailable,
 }: Options = {}) => {
-  const location = useConnectModal(useShallow((s) => s.location));
+  const [location, stepPlan, mfaToken, setMfaToken] = useConnectModal(
+    useShallow((s) => [s.location, s.stepPlan, s.mfaToken, s.setMfaToken]),
+  );
 
   const [isStarting, setIsStarting] = useState(false);
   const [startError, setStartError] = useState<string | null>(null);
@@ -71,13 +73,21 @@ export const useConnectModalMfaOidc = ({
     cleanup();
 
     try {
-      const info = await api.mfaStart(instance.id, location.id, MfaMethod.Oidc);
-      await api.openLink(`${instance.proxy_url}openid/mfa?token=${info.token}`);
+      const session = await api.startMfaStep(
+        instance.id,
+        location.id,
+        MfaMethod.Oidc,
+        stepPlan,
+        mfaToken,
+      );
+      setMfaToken(session.token);
+
+      await api.openLink(`${instance.proxy_url}openid/mfa?token=${session.token}`);
 
       setIsStarting(false);
       setIsPolling(true);
 
-      const taskId = await api.mfaPollOpenId(instance.id, location.id, info.token);
+      const taskId = await api.mfaPollOpenId(instance.id, location.id, session.token);
       taskIdRef.current = taskId;
 
       // The backend brings up the connection itself; completion means connected.
@@ -126,6 +136,9 @@ export const useConnectModalMfaOidc = ({
   }, [
     instance,
     location,
+    stepPlan,
+    mfaToken,
+    setMfaToken,
     cleanup,
     onPostureError,
     onSessionExpired,
diff --git a/new-ui/src/pages/full/OverviewPage/components/ConnectModal/hooks/useMfaStep.ts b/new-ui/src/pages/full/OverviewPage/components/ConnectModal/hooks/useMfaStep.ts
new file mode 100644
index 000000000..2f5cf95a5
--- /dev/null
+++ b/new-ui/src/pages/full/OverviewPage/components/ConnectModal/hooks/useMfaStep.ts
@@ -0,0 +1,29 @@
+import { useShallow } from 'zustand/shallow';
+import { isPresent } from '../../../../../../shared/utils/isPresent';
+import { usableMfaMethods } from '../../../../../../shared/utils/mfa';
+import { useConnectModal } from './useConnectModal';
+
+export const useMfaStep = () => {
+  const [location, stepIndex, stepPlan, mfaToken, setMfaToken, goToStep] =
+    useConnectModal(
+      useShallow((s) => [
+        s.location,
+        s.stepIndex,
+        s.stepPlan,
+        s.mfaToken,
+        s.setMfaToken,
+        s.goToStep,
+      ]),
+    );
+
+  const currentStep = location?.mfa_steps[stepIndex];
+
+  return {
+    canPickOtherMethod:
+      isPresent(currentStep) && usableMfaMethods(currentStep).length > 1,
+    stepPlan,
+    mfaToken,
+    setMfaToken,
+    goToStep,
+  };
+};
diff --git a/new-ui/src/pages/full/OverviewPage/components/ConnectModal/views/ConnectModalMfaEmail/ConnectModalMfaEmail.tsx b/new-ui/src/pages/full/OverviewPage/components/ConnectModal/views/ConnectModalMfaEmail/ConnectModalMfaEmail.tsx
index 65973f13f..6b9aa4735 100644
--- a/new-ui/src/pages/full/OverviewPage/components/ConnectModal/views/ConnectModalMfaEmail/ConnectModalMfaEmail.tsx
+++ b/new-ui/src/pages/full/OverviewPage/components/ConnectModal/views/ConnectModalMfaEmail/ConnectModalMfaEmail.tsx
@@ -10,6 +10,7 @@ import { isPresent } from '../../../../../../../shared/utils/isPresent';
 import { ConnectModalPostureCheckLoading } from '../../components/ConnectModalPostureCheckLoading/ConnectModalPostureCheckLoading';
 import { ConnectModalView } from '../../hooks/types';
 import { useConnectModal } from '../../hooks/useConnectModal';
+import { useMfaStep } from '../../hooks/useMfaStep';
 
 const MIN_POSTURE_LOADER_MS = 500;
 
@@ -18,10 +19,16 @@ export const ConnectModalMfaEmail = () => {
     useShallow((s) => [s.perviousView, s.location]),
   );
 
+  const { canPickOtherMethod, stepPlan, mfaToken, setMfaToken, goToStep } = useMfaStep();
+
   const { verifyCode, isVerifying, verifyError, isStarting, startError } = useMfaConnect(
     location as LocationInfo,
     MfaMethod.Email,
     {
+      stepPlan,
+      mfaToken,
+      setMfaToken,
+      onStepAdvanced: goToStep,
       debounceMs: location?.posture_check_required ? MIN_POSTURE_LOADER_MS : 0,
       onSessionExpired: () =>
         useConnectModal.getState().setView(perviousView ?? ConnectModalView.MfaSettings),
@@ -87,13 +94,15 @@ export const ConnectModalMfaEmail = () => {
         }}
       />
       <Controls>
-        <Button
-          variant={ButtonVariant.Secondary}
-          text="Use different MFA"
-          onClick={() => {
-            useConnectModal.getState().setView(ConnectModalView.MfaSettings);
-          }}
-        />
+        {canPickOtherMethod && (
+          <Button
+            variant={ButtonVariant.Secondary}
+            text="Other methods"
+            onClick={() => {
+              useConnectModal.getState().setView(ConnectModalView.MfaSettings);
+            }}
+          />
+        )}
         <div className="right">
           <Button
             text="Verify"
diff --git a/new-ui/src/pages/full/OverviewPage/components/ConnectModal/views/ConnectModalMfaMobile/ConnectModalMfaMobile.tsx b/new-ui/src/pages/full/OverviewPage/components/ConnectModal/views/ConnectModalMfaMobile/ConnectModalMfaMobile.tsx
index 016547907..41ca8572a 100644
--- a/new-ui/src/pages/full/OverviewPage/components/ConnectModal/views/ConnectModalMfaMobile/ConnectModalMfaMobile.tsx
+++ b/new-ui/src/pages/full/OverviewPage/components/ConnectModal/views/ConnectModalMfaMobile/ConnectModalMfaMobile.tsx
@@ -10,6 +10,7 @@ import type { LocationInfo } from '../../../../../../../shared/rust-api/types';
 import { ConnectModalPostureCheckLoading } from '../../components/ConnectModalPostureCheckLoading/ConnectModalPostureCheckLoading';
 import { ConnectModalView } from '../../hooks/types';
 import { useConnectModal } from '../../hooks/useConnectModal';
+import { useMfaStep } from '../../hooks/useMfaStep';
 
 type Screen = 'loading' | 'qr' | 'error';
 
@@ -18,9 +19,14 @@ export const ConnectModalMfaMobile = () => {
     useShallow((s) => [s.perviousView, s.location]),
   );
 
+  const { canPickOtherMethod, stepPlan, mfaToken, setMfaToken } = useMfaStep();
+
   const { start, isStarting, startError, qrValue, connectionError } = useMfaMobileConnect(
     location as LocationInfo,
     {
+      stepPlan,
+      mfaToken,
+      setMfaToken,
       onPostureError: (msg) => {
         useConnectModal.setState({ postureError: msg });
         useConnectModal.getState().setView(ConnectModalView.PostureCheckFail);
@@ -68,11 +74,11 @@ export const ConnectModalMfaMobile = () => {
         </div>
       )}
       <Controls>
-        {screen === 'qr' && (
+        {screen === 'qr' && canPickOtherMethod && (
           <Button
             containerProps={{ className: 'full' }}
             variant={ButtonVariant.Secondary}
-            text="Use different MFA"
+            text="Other methods"
             onClick={() => {
               useConnectModal.getState().setView(ConnectModalView.MfaSettings);
             }}
diff --git a/new-ui/src/pages/full/OverviewPage/components/ConnectModal/views/ConnectModalMfaSettings/ConnectModalMfaSettings.tsx b/new-ui/src/pages/full/OverviewPage/components/ConnectModal/views/ConnectModalMfaSettings/ConnectModalMfaSettings.tsx
index 35e111b5c..49288714c 100644
--- a/new-ui/src/pages/full/OverviewPage/components/ConnectModal/views/ConnectModalMfaSettings/ConnectModalMfaSettings.tsx
+++ b/new-ui/src/pages/full/OverviewPage/components/ConnectModal/views/ConnectModalMfaSettings/ConnectModalMfaSettings.tsx
@@ -1,6 +1,5 @@
-/** biome-ignore-all lint/style/noNonNullAssertion: temp */
 import './style.scss';
-import { useMutation, useQuery } from '@tanstack/react-query';
+import { useMutation } from '@tanstack/react-query';
 import { Fragment, useMemo, useState } from 'react';
 import { useShallow } from 'zustand/shallow';
 import { Button } from '../../../../../../../shared/components/Button/Button';
@@ -10,113 +9,128 @@ import { Controls } from '../../../../../../../shared/components/Controls/Contro
 import { MfaSelector } from '../../../../../../../shared/components/LocationCard/components/MfaSelector/MfaSelector';
 import { SizedBox } from '../../../../../../../shared/components/SizedBox/SizedBox';
 import { api } from '../../../../../../../shared/rust-api/api';
-import { getLocationDetailsQueryOptions } from '../../../../../../../shared/rust-api/query';
-import {
-  LocationMfaMode,
-  MfaMethod,
-  type MfaMethodValue,
-} from '../../../../../../../shared/rust-api/types';
+import type { MfaMethodValue } from '../../../../../../../shared/rust-api/types';
 import { ThemeSpacing } from '../../../../../../../shared/types';
-import { ConnectModalView } from '../../hooks/types';
+import { isPresent } from '../../../../../../../shared/utils/isPresent';
+import {
+  mfaStepCount,
+  pickableMfaMethods,
+  resolveMfaStepPlan,
+  usableMfaMethods,
+} from '../../../../../../../shared/utils/mfa';
+import { mfaMethodToConnectModalView } from '../../hooks/types';
 import { useConnectModal } from '../../hooks/useConnectModal';
 
 export const ConnectModalMfaSettings = () => {
-  const { mutate: setMfaMethod } = useMutation({
-    mutationFn: api.setLocationMfaMethod,
+  const { mutate: setMfaStepPlan } = useMutation({
+    mutationFn: api.setLocationMfaStepPlan,
     meta: { invalidate: [['locations']] },
   });
 
-  const [perviousView, location, currentMethod] = useConnectModal(
-    useShallow((s) => [s.perviousView, s.location, s.mfaMethod]),
+  const [perviousView, location, stepPlan, stepIndex] = useConnectModal(
+    useShallow((s) => [s.perviousView, s.location, s.stepPlan, s.stepIndex]),
   );
 
-  const { data: locationDetails } = useQuery(
-    getLocationDetailsQueryOptions({
-      locationId: location!.id,
-      connectionType: 'Location',
-    }),
+  const isEditingDefaults = perviousView === null;
+  const mfaSteps = location?.mfa_steps ?? [];
+  const isMultiStep = isPresent(location) && mfaStepCount(location) > 1;
+  const defaultPlan = isPresent(location) ? resolveMfaStepPlan(location) : [];
+
+  const [selectedStepMethods, setSelectedStepMethods] = useState<MfaMethodValue[]>(
+    isEditingDefaults ? defaultPlan : stepPlan,
   );
+  const [saveAsDefault, setSaveAsDefault] = useState(false);
 
-  const locationDefaultMfaMethod = locationDetails?.mfa_method ?? MfaMethod.Totp;
+  const editableSteps = useMemo(() => {
+    if (isEditingDefaults) {
+      return mfaSteps.map((step, index) => ({
+        stepIndex: index,
+        methods: pickableMfaMethods(step),
+      }));
+    }
+    const currentStep = mfaSteps[stepIndex];
+    if (!isPresent(currentStep)) return [];
+    return [{ stepIndex, methods: usableMfaMethods(currentStep) }];
+  }, [isEditingDefaults, mfaSteps, stepIndex]);
 
-  const [selectedMethod, setSelectedMethod] = useState<MfaMethodValue>(currentMethod);
+  const selectMethodForStep = (targetStepIndex: number, method: MfaMethodValue) => {
+    setSelectedStepMethods((currentPlan) =>
+      currentPlan.map((selected, index) =>
+        index === targetStepIndex ? method : selected,
+      ),
+    );
+  };
 
-  const [setAsDefault, setSetAsDefault] = useState(perviousView === null);
+  const handleSubmit = () => {
+    if (!isPresent(location)) return;
 
-  const MfaFactorsList = useMemo((): MfaMethodValue[] => {
-    if (location?.location_mfa_mode === LocationMfaMode.Internal) {
-      return [MfaMethod.Totp, MfaMethod.Email, MfaMethod.MobileApprove];
+    if (isEditingDefaults) {
+      setMfaStepPlan({ locationId: location.id, mfaStepPlan: selectedStepMethods });
+      useConnectModal.setState({ visible: false });
+      return;
     }
-    return [MfaMethod.Oidc];
-  }, [location?.location_mfa_mode]);
 
-  const handleSubmit = () => {
-    if (!location) return;
-    useConnectModal.setState({ mfaMethod: selectedMethod });
-    if (setAsDefault && selectedMethod !== locationDefaultMfaMethod && location) {
-      setMfaMethod({ locationId: location.id, mfaMethod: selectedMethod });
-    }
-    if (perviousView === null) {
-      useConnectModal.setState({ visible: false });
-    } else {
-      switch (selectedMethod) {
-        case 'totp':
-          useConnectModal.setState({ view: ConnectModalView.MfaTotp });
-          break;
-        case 'email':
-          useConnectModal.setState({ view: ConnectModalView.MfaEmail });
-          break;
-        case 'mobileapprove':
-          useConnectModal.setState({ view: ConnectModalView.MfaMobile });
-          break;
-        case 'oidc':
-          useConnectModal.setState({ view: ConnectModalView.MfaOidc });
-          break;
-        default:
-          useConnectModal.setState({ visible: false });
-          break;
-      }
+    if (!isMultiStep && saveAsDefault) {
+      setMfaStepPlan({ locationId: location.id, mfaStepPlan: selectedStepMethods });
     }
+
+    const methodForCurrentStep = selectedStepMethods[stepIndex];
+    useConnectModal
+      .getState()
+      .setView(mfaMethodToConnectModalView(methodForCurrentStep), {
+        stepPlan: selectedStepMethods,
+        mfaMethod: methodForCurrentStep,
+      });
   };
 
   return (
     <div id="mfa-settings-view">
-      {perviousView !== null && (
+      {!isEditingDefaults && (
         <p className="view-description">
-          If you're having issues with your current verification method, you can choose
-          another one or set a new default.
+          {isMultiStep
+            ? `If you're having issues with your current verification method, you can choose another one for this login.`
+            : `If you're having issues with your current verification method, you can choose another one or set a new default.`}
         </p>
       )}
-      {perviousView === null && (
+      {isEditingDefaults && (
         <p className="view-description">
-          {`You can change the MFA method for a one-time login or set a new default method.`}
+          {`Choose the default verification method for each step of this location.`}
         </p>
       )}
-      <div className="methods">
-        {MfaFactorsList.map((factor) => (
-          <MfaSelector
-            key={factor}
-            factor={factor}
-            selected={selectedMethod === factor}
-            isDefault={locationDefaultMfaMethod === factor}
-            onClick={() => setSelectedMethod(factor)}
-          />
+      <div className="steps">
+        {editableSteps.map(({ methods, stepIndex: index }) => (
+          <div className="step" key={index}>
+            {isMultiStep && isEditingDefaults && (
+              <p className="step-label">Step {index + 1}</p>
+            )}
+            <div className="methods">
+              {methods.map((entry) => (
+                <MfaSelector
+                  key={entry.method}
+                  factor={entry.method}
+                  selected={selectedStepMethods[index] === entry.method}
+                  isDefault={defaultPlan[index] === entry.method}
+                  configured={entry.configured}
+                  onClick={() => selectMethodForStep(index, entry.method)}
+                />
+              ))}
+            </div>
+          </div>
         ))}
       </div>
-      {perviousView !== null && (
+      {!isEditingDefaults && !isMultiStep && (
         <Fragment>
           <SizedBox height={ThemeSpacing.Xl2} />
           <Checkbox
-            active={setAsDefault}
-            onClick={() => setSetAsDefault((prev) => !prev)}
+            active={saveAsDefault}
+            onClick={() => setSaveAsDefault((current) => !current)}
             text="Set as default MFA method"
           />
-          <SizedBox height={ThemeSpacing.Xl2} />
         </Fragment>
       )}
-      {perviousView === null && <SizedBox height={ThemeSpacing.Xl3} />}
+      <SizedBox height={isEditingDefaults ? ThemeSpacing.Xl3 : ThemeSpacing.Xl2} />
       <Controls>
-        {perviousView !== null && (
+        {!isEditingDefaults && (
           <Button
             variant={ButtonVariant.Secondary}
             text="Cancel"
@@ -127,7 +141,7 @@ export const ConnectModalMfaSettings = () => {
           <Button
             variant={ButtonVariant.Primary}
             size="primary"
-            text={perviousView === null ? 'Save changes' : 'Continue'}
+            text={isEditingDefaults ? 'Save changes' : 'Continue'}
             onClick={handleSubmit}
           />
         </div>
diff --git a/new-ui/src/pages/full/OverviewPage/components/ConnectModal/views/ConnectModalMfaSettings/style.scss b/new-ui/src/pages/full/OverviewPage/components/ConnectModal/views/ConnectModalMfaSettings/style.scss
index 9d4647d5a..3f6483ef0 100644
--- a/new-ui/src/pages/full/OverviewPage/components/ConnectModal/views/ConnectModalMfaSettings/style.scss
+++ b/new-ui/src/pages/full/OverviewPage/components/ConnectModal/views/ConnectModalMfaSettings/style.scss
@@ -5,6 +5,23 @@
     row-gap: var(--spacing-md);
   }
 
+  .steps {
+    display: flex;
+    flex-flow: column;
+    row-gap: var(--spacing-xl);
+
+    > .step {
+      display: flex;
+      flex-flow: column;
+      row-gap: var(--spacing-sm);
+
+      > .step-label {
+        font: var(--t-body-xs-400);
+        color: var(--fg-white-70);
+      }
+    }
+  }
+
   .controls {
     padding-top: 0;
   }
diff --git a/new-ui/src/pages/full/OverviewPage/components/ConnectModal/views/ConnectModalMfaTotp/ConnectModalMfaTotp.tsx b/new-ui/src/pages/full/OverviewPage/components/ConnectModal/views/ConnectModalMfaTotp/ConnectModalMfaTotp.tsx
index 6c6d3618a..6324dfca3 100644
--- a/new-ui/src/pages/full/OverviewPage/components/ConnectModal/views/ConnectModalMfaTotp/ConnectModalMfaTotp.tsx
+++ b/new-ui/src/pages/full/OverviewPage/components/ConnectModal/views/ConnectModalMfaTotp/ConnectModalMfaTotp.tsx
@@ -10,6 +10,7 @@ import { isPresent } from '../../../../../../../shared/utils/isPresent';
 import { ConnectModalPostureCheckLoading } from '../../components/ConnectModalPostureCheckLoading/ConnectModalPostureCheckLoading';
 import { ConnectModalView } from '../../hooks/types';
 import { useConnectModal } from '../../hooks/useConnectModal';
+import { useMfaStep } from '../../hooks/useMfaStep';
 
 const MIN_POSTURE_LOADER_MS = 500;
 
@@ -18,10 +19,16 @@ export const ConnectModalMfaTotp = () => {
     useShallow((s) => [s.perviousView, s.location]),
   );
 
+  const { canPickOtherMethod, stepPlan, mfaToken, setMfaToken, goToStep } = useMfaStep();
+
   const { verifyCode, isVerifying, verifyError, isStarting, startError } = useMfaConnect(
     location as LocationInfo,
     MfaMethod.Totp,
     {
+      stepPlan,
+      mfaToken,
+      setMfaToken,
+      onStepAdvanced: goToStep,
       debounceMs: location?.posture_check_required ? MIN_POSTURE_LOADER_MS : 0,
       onSessionExpired: () =>
         useConnectModal.getState().setView(perviousView ?? ConnectModalView.MfaSettings),
@@ -86,20 +93,21 @@ export const ConnectModalMfaTotp = () => {
         }}
       />
       <Controls>
-        <Button
-          variant={ButtonVariant.Secondary}
-          text="Use different MFA"
-          onClick={() => {
-            useConnectModal.getState().setView(ConnectModalView.MfaSettings);
-          }}
-        />
+        {canPickOtherMethod && (
+          <Button
+            variant={ButtonVariant.Secondary}
+            text="Other methods"
+            onClick={() => {
+              useConnectModal.getState().setView(ConnectModalView.MfaSettings);
+            }}
+          />
+        )}
         <div className="right">
           <Button
             text="Verify"
             variant={ButtonVariant.Primary}
             onClick={() => handleVerify()}
             loading={isVerifying}
-            disabled={isStarting}
           />
         </div>
       </Controls>
diff --git a/new-ui/src/shared/components/LocationCard/LocationCard.tsx b/new-ui/src/shared/components/LocationCard/LocationCard.tsx
index 35a08166e..0fcc05eb2 100644
--- a/new-ui/src/shared/components/LocationCard/LocationCard.tsx
+++ b/new-ui/src/shared/components/LocationCard/LocationCard.tsx
@@ -1,6 +1,7 @@
 import './style.scss';
 import clsx from 'clsx';
 import type { ReactNode } from 'react';
+import { Fragment } from 'react/jsx-runtime';
 import type { InstanceInfo, LocationInfo } from '../../rust-api/types';
 import { Direction } from '../../types';
 import { Fold } from '../Fold/Fold';
@@ -48,7 +49,7 @@ interface InnerProps {
 }
 
 const LocationCardInner = ({ isOpen, onOpen, disableOpen }: InnerProps) => {
-  const { location, currentView } = useLocationCardContext();
+  const { location, currentView, stepIndex } = useLocationCardContext();
 
   return (
     <div
@@ -73,7 +74,9 @@ const LocationCardInner = ({ isOpen, onOpen, disableOpen }: InnerProps) => {
           )}
         </div>
       </div>
-      <Fold open={isOpen}>{views[currentView]}</Fold>
+      <Fold open={isOpen}>
+        <Fragment key={`${currentView}-${stepIndex}`}>{views[currentView]}</Fragment>
+      </Fold>
     </div>
   );
 };
diff --git a/new-ui/src/shared/components/LocationCard/components/LocationCardConnectButton.tsx b/new-ui/src/shared/components/LocationCard/components/LocationCardConnectButton.tsx
index ce4359213..a1a1c2636 100644
--- a/new-ui/src/shared/components/LocationCard/components/LocationCardConnectButton.tsx
+++ b/new-ui/src/shared/components/LocationCard/components/LocationCardConnectButton.tsx
@@ -1,6 +1,6 @@
 import { useMutation } from '@tanstack/react-query';
 import { api } from '../../../rust-api/api';
-import { shouldStartMfa } from '../../../utils/mfa';
+import { hasUnpassableMfaStep, shouldStartMfa } from '../../../utils/mfa';
 import { parseConnectError } from '../api/connectError';
 import { useLocationCardContext } from '../context/context';
 import { LocationCardViews } from '../context/types';
@@ -61,6 +61,10 @@ export const LocationCardConnectButton = () => {
   };
 
   return (
-    <ConnectButton active={location.active} onClick={handleClick} disabled={isBusy} />
+    <ConnectButton
+      active={location.active}
+      onClick={handleClick}
+      disabled={isBusy || hasUnpassableMfaStep(location)}
+    />
   );
 };
diff --git a/new-ui/src/shared/components/LocationCard/components/LocationCardConnectionTiles/LocationCardConnectionTiles.tsx b/new-ui/src/shared/components/LocationCard/components/LocationCardConnectionTiles/LocationCardConnectionTiles.tsx
index a0331475b..dc3d577fe 100644
--- a/new-ui/src/shared/components/LocationCard/components/LocationCardConnectionTiles/LocationCardConnectionTiles.tsx
+++ b/new-ui/src/shared/components/LocationCard/components/LocationCardConnectionTiles/LocationCardConnectionTiles.tsx
@@ -6,10 +6,14 @@ import {
   ClientTrafficPolicy,
   type InstanceInfo,
   type LocationInfo,
-  LocationMfaMode,
 } from '../../../../rust-api/types';
 import { isPresent } from '../../../../utils/isPresent';
-import { mfaToText } from '../../../../utils/mfa';
+import {
+  mfaStepCount,
+  mfaStepsToText,
+  mfaToText,
+  shouldStartMfa,
+} from '../../../../utils/mfa';
 import { BoxIcon } from '../../../BoxIcon/BoxIcon';
 import { Icon, IconKind } from '../../../Icon';
 
@@ -26,11 +30,21 @@ export const LocationCardConnectionTiles = ({ location, instance, variant }: Pro
     location.route_all_traffic ||
     instance?.client_traffic_policy === ClientTrafficPolicy.ForceAllTraffic;
 
-  const mfaMethod = useMemo(() => {
+  const stepCount = mfaStepCount(location);
+  const isMultiStep = stepCount > 1;
+
+  const mfaLabel = useMemo(() => {
+    if (isMultiStep) return mfaStepsToText(stepCount);
     const key = `${location.connection_type.toLowerCase()}-${location.id}`;
     const method = connectionMfaMethod[key];
-    return method;
-  }, [connectionMfaMethod, location.connection_type.toLowerCase, location.id]);
+    return isPresent(method) ? mfaToText(method) : null;
+  }, [
+    connectionMfaMethod,
+    location.connection_type,
+    location.id,
+    stepCount,
+    isMultiStep,
+  ]);
 
   return (
     <div className={clsx('location-card-connection-tiles', `variant-${variant}`)}>
@@ -43,16 +57,15 @@ export const LocationCardConnectionTiles = ({ location, instance, variant }: Pro
           {routeAllTraffic ? 'All traffic' : 'Predefined traffic'}
         </p>
       </div>
-      {location.location_mfa_mode !== LocationMfaMode.Disabled &&
-        isPresent(mfaMethod) && (
-          <div className="tile">
-            <BoxIcon>
-              <Icon icon={IconKind.LockClosed} />
-            </BoxIcon>
-            <p className="label">Active MFA</p>
-            <p className="label-value">{mfaToText(mfaMethod)}</p>
-          </div>
-        )}
+      {shouldStartMfa(location) && isPresent(mfaLabel) && (
+        <div className="tile">
+          <BoxIcon>
+            <Icon icon={IconKind.LockClosed} />
+          </BoxIcon>
+          <p className="label">Active MFA</p>
+          <p className="label-value">{mfaLabel}</p>
+        </div>
+      )}
     </div>
   );
 };
diff --git a/new-ui/src/shared/components/LocationCard/components/LocationCardMfaEdit/LocationCardMfaEdit.tsx b/new-ui/src/shared/components/LocationCard/components/LocationCardMfaEdit/LocationCardMfaEdit.tsx
index 5f3724fd2..2f0d93c09 100644
--- a/new-ui/src/shared/components/LocationCard/components/LocationCardMfaEdit/LocationCardMfaEdit.tsx
+++ b/new-ui/src/shared/components/LocationCard/components/LocationCardMfaEdit/LocationCardMfaEdit.tsx
@@ -1,7 +1,13 @@
 import './style.scss';
 import clsx from 'clsx';
 import type { LocationInfo } from '../../../../rust-api/types';
-import { mfaToText } from '../../../../utils/mfa';
+import {
+  mfaStepCount,
+  mfaStepsToText,
+  mfaToText,
+  resolveMfaStepPlan,
+  usableMfaMethods,
+} from '../../../../utils/mfa';
 import { IconButton } from '../../../IconButton/IconButton';
 import { IconButtonVariant } from '../../../IconButton/types';
 
@@ -12,15 +18,21 @@ interface Props {
 }
 
 export const LocationCardMfaEdit = ({ location, onEdit, variant }: Props) => {
-  if (location.location_mfa_mode === 'disabled' || !location.mfa_method) return null;
+  const stepCount = mfaStepCount(location);
+  const label =
+    stepCount > 1
+      ? mfaStepsToText(stepCount)
+      : mfaToText(resolveMfaStepPlan(location)[0]);
+
+  const canEdit = location.mfa_steps.some((step) => usableMfaMethods(step).length > 1);
 
   return (
     <div className={clsx('location-card-mfa-edit', `variant-${variant}`)}>
       <div className="mfa-badge">
         <p>MFA</p>
       </div>
-      <p className="name">{mfaToText(location.mfa_method)}</p>
-      {location.location_mfa_mode === 'internal' && !location.active && (
+      <p className="name">{label}</p>
+      {canEdit && !location.active && (
         <IconButton
           variant={IconButtonVariant.SmallSelected}
           icon="edit"
diff --git a/new-ui/src/shared/components/LocationCard/components/MfaSelector/MfaSelector.tsx b/new-ui/src/shared/components/LocationCard/components/MfaSelector/MfaSelector.tsx
index 490e2eb02..ee6d60d1d 100644
--- a/new-ui/src/shared/components/LocationCard/components/MfaSelector/MfaSelector.tsx
+++ b/new-ui/src/shared/components/LocationCard/components/MfaSelector/MfaSelector.tsx
@@ -1,7 +1,7 @@
 import './style.scss';
 import clsx from 'clsx';
 import { type HTMLProps, type MouseEventHandler, useMemo } from 'react';
-import type { MfaMethodValue } from '../../../../rust-api/types';
+import { MfaMethod, type MfaMethodValue } from '../../../../rust-api/types';
 import { mfaToText } from '../../../../utils/mfa';
 import { Icon, IconKind, type IconKindValue } from '../../../Icon';
 
@@ -9,6 +9,7 @@ interface Props {
   factor: MfaMethodValue;
   selected?: boolean;
   isDefault?: boolean;
+  configured?: boolean;
   onClick?: MouseEventHandler<HTMLDivElement>;
   containerProps?: Omit<HTMLProps<HTMLDivElement>, 'onClick'>;
 }
@@ -19,6 +20,7 @@ export const MfaSelector = ({
   containerProps,
   selected = false,
   isDefault = false,
+  configured = true,
 }: Props) => {
   const iconKind = useMemo((): IconKindValue => {
     switch (factor) {
@@ -35,25 +37,41 @@ export const MfaSelector = ({
     }
   }, [factor]);
 
+  const isMobileOnly = factor === MfaMethod.Biometric;
+  const selectable = configured && !isMobileOnly;
+
   return (
     <div
       {...containerProps}
       className={clsx(containerProps?.className, 'mfa-selector', {
         selected,
+        disabled: !selectable,
       })}
-      onClick={onClick}
+      aria-disabled={!selectable}
+      onClick={(event) => {
+        if (selectable) {
+          onClick?.(event);
+        }
+      }}
       data-factor={factor}
     >
       <Icon className="factor-icon" icon={iconKind} size={20} />
       <div className="middle">
         <p className="name">{mfaToText(factor)}</p>
-        {isDefault && (
+      </div>
+      <div className="right">
+        {!selectable && (
+          <p className="disabled-label">
+            {isMobileOnly ? 'Mobile client only' : 'Not configured'}
+          </p>
+        )}
+        {selectable && isDefault && (
           <div className="default-badge">
             <p>Default</p>
           </div>
         )}
+        {selectable && !isDefault && selected && <Icon icon={IconKind.Check} size={16} />}
       </div>
-      {selected && <Icon icon={IconKind.Check} size={16} />}
     </div>
   );
 };
diff --git a/new-ui/src/shared/components/LocationCard/components/MfaSelector/style.scss b/new-ui/src/shared/components/LocationCard/components/MfaSelector/style.scss
index 164325802..82b671880 100644
--- a/new-ui/src/shared/components/LocationCard/components/MfaSelector/style.scss
+++ b/new-ui/src/shared/components/LocationCard/components/MfaSelector/style.scss
@@ -6,7 +6,7 @@
   --box-shadow: box-shadow: 0 4px 4px 0 rgb(0 0 0 / 0%);
 
   display: grid;
-  grid-template-columns: 20px minmax(0, 1fr) 16px;
+  grid-template-columns: 20px minmax(0, 1fr) auto;
   column-gap: var(--spacing-sm);
   background: var(--bg);
   border: 1px solid var(--border);
@@ -39,6 +39,22 @@
     --box-shadow: box-shadow: 0 4px 4px 0 rgb(0 0 0 / 5%);
   }
 
+  &.disabled {
+    --bg: transparent;
+    --border: var(--border-action-disabled);
+    --color: var(--fg-white-40);
+    --icon: var(--fg-white-40);
+
+    cursor: not-allowed;
+
+    &:hover {
+      --bg: transparent;
+      --border: var(--border-action-disabled);
+      --color: var(--fg-white-40);
+      --icon: var(--fg-white-40);
+    }
+  }
+
   > .middle {
     display: flex;
     flex-flow: row nowrap;
@@ -47,6 +63,14 @@
     column-gap: var(--spacing-md);
   }
 
+  > .right {
+    display: flex;
+    flex-flow: row nowrap;
+    align-items: center;
+    justify-content: flex-end;
+    column-gap: var(--spacing-sm);
+  }
+
   .default-badge {
     display: inline-block;
     box-sizing: border-box;
@@ -63,6 +87,12 @@
     }
   }
 
+  .disabled-label {
+    color: var(--fg-white-40);
+    font: var(--t-body-sm-400);
+    white-space: nowrap;
+  }
+
   .factor-icon {
     --icon-color: var(--icon);
 
diff --git a/new-ui/src/shared/components/LocationCard/context/context.tsx b/new-ui/src/shared/components/LocationCard/context/context.tsx
index e9ae26d32..50a977db9 100644
--- a/new-ui/src/shared/components/LocationCard/context/context.tsx
+++ b/new-ui/src/shared/components/LocationCard/context/context.tsx
@@ -4,16 +4,27 @@ import {
   useCallback,
   useContext,
   useEffect,
+  useMemo,
   useRef,
   useState,
 } from 'react';
 import { useAppData } from '../../../providers/AppDataContext';
 import { api } from '../../../rust-api/api';
-import type { InstanceInfo, LocationInfo } from '../../../rust-api/types';
+import type { InstanceInfo, LocationInfo, MfaStep } from '../../../rust-api/types';
 import { ConnectionType, MfaMethod, type MfaMethodValue } from '../../../rust-api/types';
 import { useAppStore } from '../../../store/useAppStore';
 import { isPresent } from '../../../utils/isPresent';
-import { LocationCardViews, type LocationCardViewsValue } from './types';
+import {
+  mfaToText,
+  resolveMfaStepPlan,
+  shouldStartMfa,
+  usableMfaMethods,
+} from '../../../utils/mfa';
+import {
+  LocationCardViews,
+  type LocationCardViewsValue,
+  mfaMethodToLocationCardView,
+} from './types';
 
 interface LocationCardContextValue {
   location: LocationInfo;
@@ -23,7 +34,15 @@ interface LocationCardContextValue {
   postureError: string | null;
   autoConnectOpenid: boolean;
   mfaMethod: MfaMethodValue;
+  canPickOtherMethod: boolean;
+  stepPlan: MfaMethodValue[];
+  stepIndex: number;
+  stepLabel: string | null;
+  mfaToken: string | null;
   setMfaMethod: (value: MfaMethodValue) => void;
+  setMfaToken: (token: string) => void;
+  goToStep: (stepIndex: number) => void;
+  setStepPlanOnce: (plan: MfaMethodValue[]) => void;
   setView: (view: LocationCardViewsValue) => void;
   setPostureError: (error: string | null) => void;
   startMfa: () => void;
@@ -60,8 +79,23 @@ export const LocationCardProvider = ({
     location.active ? LocationCardViews.Connected : LocationCardViews.Default,
   );
   const [mfaMethod, setMfaMethod] = useState<MfaMethodValue>(
-    location.mfa_method ?? MfaMethod.Totp,
+    resolveMfaStepPlan(location)[0] ?? MfaMethod.Totp,
+  );
+
+  const mfaSteps = useMemo<MfaStep[]>(
+    () => (shouldStartMfa(location) ? location.mfa_steps : []),
+    [location],
+  );
+  const isMultiStep = mfaSteps.length > 1;
+
+  // one-off choice made through "Other methods", dropped when a new flow starts
+  const [stepPlanOnce, setStepPlanOnce] = useState<MfaMethodValue[]>([]);
+  const stepPlan = useMemo<MfaMethodValue[]>(
+    () => resolveMfaStepPlan(location, stepPlanOnce),
+    [location, stepPlanOnce],
   );
+  const [stepIndex, setStepIndex] = useState(0);
+  const [mfaToken, setMfaToken] = useState<string | null>(null);
 
   // Other location updates must not undo an optimistic connection transition.
   // biome-ignore lint/correctness/useExhaustiveDependencies: synchronize only on active state
@@ -69,8 +103,10 @@ export const LocationCardProvider = ({
     if (location.active) {
       setCurrentView(LocationCardViews.Connected);
     } else {
-      setMfaMethod(location.mfa_method ?? MfaMethod.Totp);
+      setMfaMethod(resolveMfaStepPlan(location)[0] ?? MfaMethod.Totp);
       setCurrentView(LocationCardViews.Default);
+      setStepIndex(0);
+      setMfaToken(null);
     }
   }, [location.active]);
 
@@ -82,25 +118,25 @@ export const LocationCardProvider = ({
     [currentView],
   );
 
+  const goToStep = useCallback(
+    (nextStepIndex: number) => {
+      setStepIndex(nextStepIndex);
+      setView(mfaMethodToLocationCardView(stepPlan[nextStepIndex]));
+    },
+    [setView, stepPlan],
+  );
+
   const startMfa = useCallback(async () => {
     mfaStarted.current = true;
     const appConfig = await api.getAppConfig();
     setAutoConnectOpenid(appConfig.auto_start_openid_mfa);
-    switch (mfaMethod) {
-      case MfaMethod.Totp:
-        setView(LocationCardViews.MfaTotp);
-        break;
-      case MfaMethod.Email:
-        setView(LocationCardViews.MfaEmail);
-        break;
-      case MfaMethod.Oidc:
-        setView(LocationCardViews.MfaOidc);
-        break;
-      case MfaMethod.MobileApprove:
-        setView(LocationCardViews.MfaMobile);
-        break;
-    }
-  }, [setView, mfaMethod]);
+    const defaultPlan = resolveMfaStepPlan(location);
+    setStepPlanOnce([]);
+    setStepIndex(0);
+    setMfaToken(null);
+    setMfaMethod(defaultPlan[0]);
+    setView(mfaMethodToLocationCardView(defaultPlan[0]));
+  }, [setView, location]);
 
   const mfaAutoStartRequested = useAppStore(
     (s) => s.mfaAutoStartLocationId === location.id,
@@ -135,6 +171,16 @@ export const LocationCardProvider = ({
     }
   }, [location.active]);
 
+  const currentStep = mfaSteps[stepIndex];
+  const canPickOtherMethod =
+    isPresent(currentStep) && usableMfaMethods(currentStep).length > 1;
+
+  const stepMethod = stepPlan[stepIndex];
+  const showStepLabel = isMultiStep && isPresent(stepMethod);
+  const stepLabel = showStepLabel
+    ? `Step ${stepIndex + 1}/${mfaSteps.length}: ${mfaToText(stepMethod)}`
+    : null;
+
   return (
     <LocationCardContext.Provider
       value={{
@@ -145,10 +191,18 @@ export const LocationCardProvider = ({
         location,
         instance,
         mfaMethod,
+        canPickOtherMethod,
+        stepPlan,
+        stepIndex,
+        stepLabel,
+        mfaToken,
         setView,
         setPostureError,
         startMfa,
         setMfaMethod,
+        setMfaToken,
+        setStepPlanOnce,
+        goToStep,
       }}
     >
       {children}
diff --git a/new-ui/src/shared/components/LocationCard/context/types.ts b/new-ui/src/shared/components/LocationCard/context/types.ts
index 007abfe48..8d2052767 100644
--- a/new-ui/src/shared/components/LocationCard/context/types.ts
+++ b/new-ui/src/shared/components/LocationCard/context/types.ts
@@ -1,3 +1,5 @@
+import { MfaMethod, type MfaMethodValue } from '../../../rust-api/types';
+
 export const LocationCardViews = {
   Default: 'default',
   MfaTotp: 'mfa-totp',
@@ -13,3 +15,18 @@ export const LocationCardViews = {
 
 export type LocationCardViewsValue =
   (typeof LocationCardViews)[keyof typeof LocationCardViews];
+
+export const mfaMethodToLocationCardView = (
+  method: MfaMethodValue,
+): LocationCardViewsValue => {
+  switch (method) {
+    case MfaMethod.Email:
+      return LocationCardViews.MfaEmail;
+    case MfaMethod.Oidc:
+      return LocationCardViews.MfaOidc;
+    case MfaMethod.MobileApprove:
+      return LocationCardViews.MfaMobile;
+    default:
+      return LocationCardViews.MfaTotp;
+  }
+};
diff --git a/new-ui/src/shared/components/LocationCard/hooks/useMfaConnect.ts b/new-ui/src/shared/components/LocationCard/hooks/useMfaConnect.ts
index 699ff946e..50086c840 100644
--- a/new-ui/src/shared/components/LocationCard/hooks/useMfaConnect.ts
+++ b/new-ui/src/shared/components/LocationCard/hooks/useMfaConnect.ts
@@ -11,12 +11,17 @@ import {
   mfaErrorMessage,
 } from '../../../rust-api/mfaError';
 import { getInstancesQueryOptions } from '../../../rust-api/query';
-import type { LocationInfo, MfaMethod } from '../../../rust-api/types';
+import type { LocationInfo, MfaMethod, MfaMethodValue } from '../../../rust-api/types';
+import { isPresent } from '../../../utils/isPresent';
 
 type CodeMfaMethod = typeof MfaMethod.Totp | typeof MfaMethod.Email;
 
 type UseMfaConnectOptions = {
   debounceMs?: number;
+  stepPlan: MfaMethodValue[];
+  mfaToken: string | null;
+  setMfaToken: (token: string) => void;
+  onStepAdvanced: (nextStepIndex: number) => void;
   onConnected?: () => void;
   onSessionExpired?: () => void;
   onPostureError?: (message: string) => void;
@@ -35,13 +40,18 @@ export const useMfaConnect = (
   method: CodeMfaMethod,
   {
     debounceMs = 0,
+    stepPlan,
+    mfaToken,
+    setMfaToken,
+    onStepAdvanced,
     onConnected,
     onSessionExpired,
     onPostureError,
     onServiceUnavailable,
-  }: UseMfaConnectOptions = {},
+  }: UseMfaConnectOptions,
 ) => {
-  const [token, setToken] = useState<string | null>(null);
+  const [token, setToken] = useState<string | null>(mfaToken);
+  const [stepAttemptId, setStepAttemptId] = useState<string | null>(null);
   const [isStarting, setIsStarting] = useState(debounceMs > 0);
   const [startError, setStartError] = useState<string | null>(null);
   const [isVerifying, setIsVerifying] = useState(false);
@@ -65,9 +75,17 @@ export const useMfaConnect = (
 
     (async () => {
       try {
-        const info = await api.mfaStart(instance.id, location.id, method);
+        const session = await api.startMfaStep(
+          instance.id,
+          location.id,
+          method,
+          stepPlan,
+          mfaToken,
+        );
         await waitForMinimumDuration(startedAt, debounceMs);
-        setToken(info.token);
+        setToken(session.token);
+        setStepAttemptId(session.stepAttemptId);
+        setMfaToken(session.token);
       } catch (err) {
         void error(`MFA start failed: ${err}`);
         await waitForMinimumDuration(startedAt, debounceMs);
@@ -88,15 +106,23 @@ export const useMfaConnect = (
 
   const verifyCode = useCallback(
     async (code: string) => {
-      if (!token || !instance) return;
+      if (isStarting || !token || !instance) return;
 
       setIsVerifying(true);
       setVerifyError(null);
 
       try {
-        // mfaFinishCode completes MFA and brings up the connection in the
-        // backend; the preshared key never reaches the frontend.
-        await api.mfaFinishCode(instance.id, location.id, token, code);
+        const nextStepIndex = await api.mfaFinishCode(
+          instance.id,
+          location.id,
+          token,
+          code,
+          stepAttemptId,
+        );
+        if (isPresent(nextStepIndex)) {
+          onStepAdvanced(nextStepIndex);
+          return;
+        }
         onConnected?.();
       } catch (err) {
         void error(`MFA verification failed: ${err}`);
@@ -114,7 +140,16 @@ export const useMfaConnect = (
         setIsVerifying(false);
       }
     },
-    [token, instance, location, onConnected, onSessionExpired],
+    [
+      isStarting,
+      token,
+      stepAttemptId,
+      instance,
+      location,
+      onStepAdvanced,
+      onConnected,
+      onSessionExpired,
+    ],
   );
 
   return { token, isStarting, startError, verifyCode, isVerifying, verifyError };
diff --git a/new-ui/src/shared/components/LocationCard/hooks/useMfaMobileConnect.ts b/new-ui/src/shared/components/LocationCard/hooks/useMfaMobileConnect.ts
index e1a5f72b6..041c26194 100644
--- a/new-ui/src/shared/components/LocationCard/hooks/useMfaMobileConnect.ts
+++ b/new-ui/src/shared/components/LocationCard/hooks/useMfaMobileConnect.ts
@@ -12,8 +12,13 @@ import {
   mfaErrorMessage,
 } from '../../../rust-api/mfaError';
 import { getInstancesQueryOptions } from '../../../rust-api/query';
-import type { LocationInfo, MfaErrorPayload } from '../../../rust-api/types';
+import type {
+  LocationInfo,
+  MfaErrorPayload,
+  MfaMethodValue,
+} from '../../../rust-api/types';
 import { MfaMethod, TauriEvent } from '../../../rust-api/types';
+import { isPresent } from '../../../utils/isPresent';
 
 type TokenData = {
   token: string;
@@ -21,14 +26,25 @@ type TokenData = {
 };
 
 type Options = {
+  stepPlan: MfaMethodValue[];
+  mfaToken: string | null;
+  setMfaToken: (token: string) => void;
   onConnected?: () => void;
   onPostureError?: (message?: string) => void;
   onServiceUnavailable?: () => void;
 };
 
-export const useMfaMobileConnect = (location: LocationInfo, options?: Options) => {
-  const { onConnected, onPostureError, onServiceUnavailable } = options ?? {};
-
+export const useMfaMobileConnect = (
+  location: LocationInfo,
+  {
+    stepPlan,
+    mfaToken,
+    setMfaToken,
+    onConnected,
+    onPostureError,
+    onServiceUnavailable,
+  }: Options,
+) => {
   const { data: instances } = useQuery(getInstancesQueryOptions);
   const instance = instances?.find((i) => i.id === location.instance_id);
 
@@ -148,13 +164,21 @@ export const useMfaMobileConnect = (location: LocationInfo, options?: Options) =
     setTokenData(null);
 
     try {
-      const info = await api.mfaStart(instance.id, location.id, MfaMethod.MobileApprove);
-      if (!info.challenge) {
+      const session = await api.startMfaStep(
+        instance.id,
+        location.id,
+        MfaMethod.MobileApprove,
+        stepPlan,
+        mfaToken,
+      );
+      setMfaToken(session.token);
+
+      if (!isPresent(session.challenge)) {
         setStartError('Unsupported response from proxy');
         return;
       }
 
-      setTokenData({ token: info.token, challenge: info.challenge });
+      setTokenData({ token: session.token, challenge: session.challenge });
     } catch (e) {
       void error(`Mobile MFA start failed for location ${location.id}: ${e}`);
       if (isMfaPostureError(e, location)) {
@@ -169,7 +193,15 @@ export const useMfaMobileConnect = (location: LocationInfo, options?: Options) =
     } finally {
       setIsStarting(false);
     }
-  }, [instance, location, onPostureError, onServiceUnavailable]);
+  }, [
+    instance,
+    location,
+    stepPlan,
+    mfaToken,
+    setMfaToken,
+    onPostureError,
+    onServiceUnavailable,
+  ]);
 
   const reset = useCallback(() => {
     cleanupListeners();
diff --git a/new-ui/src/shared/components/LocationCard/hooks/useMfaOidcConnect.ts b/new-ui/src/shared/components/LocationCard/hooks/useMfaOidcConnect.ts
index 7e28f80f7..644ef86e7 100644
--- a/new-ui/src/shared/components/LocationCard/hooks/useMfaOidcConnect.ts
+++ b/new-ui/src/shared/components/LocationCard/hooks/useMfaOidcConnect.ts
@@ -19,7 +19,8 @@ import { useLocationCardContext } from '../context/context';
 import { LocationCardViews } from '../context/types';
 
 export const useMfaOidcConnect = () => {
-  const { location, setPostureError, setView } = useLocationCardContext();
+  const { location, setPostureError, setView, stepPlan, mfaToken, setMfaToken } =
+    useLocationCardContext();
 
   const [isStarting, setIsStarting] = useState(false);
   const [startError, setStartError] = useState<string | null>(null);
@@ -62,13 +63,21 @@ export const useMfaOidcConnect = () => {
     cleanup();
 
     try {
-      const info = await api.mfaStart(instance.id, location.id, MfaMethod.Oidc);
-      await api.openLink(`${instance.proxy_url}openid/mfa?token=${info.token}`);
+      const session = await api.startMfaStep(
+        instance.id,
+        location.id,
+        MfaMethod.Oidc,
+        stepPlan,
+        mfaToken,
+      );
+      setMfaToken(session.token);
+
+      await api.openLink(`${instance.proxy_url}openid/mfa?token=${session.token}`);
 
       setIsStarting(false);
       setIsPolling(true);
 
-      const taskId = await api.mfaPollOpenId(instance.id, location.id, info.token);
+      const taskId = await api.mfaPollOpenId(instance.id, location.id, session.token);
       taskIdRef.current = taskId;
 
       // The backend brings up the connection itself; completion means connected.
@@ -116,7 +125,16 @@ export const useMfaOidcConnect = () => {
     } finally {
       setIsStarting(false);
     }
-  }, [instance, location, setPostureError, setView, cleanup]);
+  }, [
+    instance,
+    location,
+    stepPlan,
+    mfaToken,
+    setMfaToken,
+    setPostureError,
+    setView,
+    cleanup,
+  ]);
 
   return { start, isStarting, startError, isPolling, pollError };
 };
diff --git a/new-ui/src/shared/components/LocationCard/views/DefaultView/DefaultView.tsx b/new-ui/src/shared/components/LocationCard/views/DefaultView/DefaultView.tsx
index f9784c119..ff3e71fb5 100644
--- a/new-ui/src/shared/components/LocationCard/views/DefaultView/DefaultView.tsx
+++ b/new-ui/src/shared/components/LocationCard/views/DefaultView/DefaultView.tsx
@@ -1,12 +1,9 @@
 import { useMutation } from '@tanstack/react-query';
 import { Fragment } from 'react/jsx-runtime';
 import { api } from '../../../../rust-api/api';
-import {
-  ClientTrafficPolicy,
-  LocationMfaMode,
-  MfaMethod,
-} from '../../../../rust-api/types';
+import { ClientTrafficPolicy } from '../../../../rust-api/types';
 import { ThemeSpacing } from '../../../../types';
+import { shouldStartMfa } from '../../../../utils/mfa';
 import { Divider } from '../../../Divider/Divider';
 import { SizedBox } from '../../../SizedBox/SizedBox';
 import { Toggle } from '../../../Toggle/Toggle';
@@ -18,8 +15,6 @@ import { LocationCardViews } from '../../context/types';
 export const DefaultView = () => {
   const { location, instance, setView } = useLocationCardContext();
 
-  const mfaMethod = location.mfa_method ?? MfaMethod.Totp;
-
   const { mutate: updateRouting } = useMutation({
     mutationFn: api.updateLocationRouting,
     meta: {
@@ -50,7 +45,7 @@ export const DefaultView = () => {
           />
         </Fragment>
       )}
-      {location.location_mfa_mode !== LocationMfaMode.Disabled && mfaMethod && (
+      {shouldStartMfa(location) && (
         <Fragment>
           <Divider spacing={ThemeSpacing.Md} />
           <LocationCardMfaEdit
diff --git a/new-ui/src/shared/components/LocationCard/views/LocationCardMfaEmailView/LocationCardMfaEmailView.tsx b/new-ui/src/shared/components/LocationCard/views/LocationCardMfaEmailView/LocationCardMfaEmailView.tsx
index 4d56aa240..bfac89220 100644
--- a/new-ui/src/shared/components/LocationCard/views/LocationCardMfaEmailView/LocationCardMfaEmailView.tsx
+++ b/new-ui/src/shared/components/LocationCard/views/LocationCardMfaEmailView/LocationCardMfaEmailView.tsx
@@ -20,11 +20,25 @@ import { LocationCardMfaStartLoader } from '../LocationCardMfaStartLoader/Locati
 const MIN_POSTURE_LOADER_MS = 500;
 
 export const LocationCardMfaEmailView = () => {
-  const { setView, location, setPostureError } = useLocationCardContext();
+  const {
+    setView,
+    location,
+    setPostureError,
+    stepLabel,
+    canPickOtherMethod,
+    stepPlan,
+    mfaToken,
+    setMfaToken,
+    goToStep,
+  } = useLocationCardContext();
   const { verifyCode, isVerifying, verifyError, isStarting, startError } = useMfaConnect(
     location,
     MfaMethod.Email,
     {
+      stepPlan,
+      mfaToken,
+      setMfaToken,
+      onStepAdvanced: goToStep,
       debounceMs: location.posture_check_required ? MIN_POSTURE_LOADER_MS : 0,
       onConnected: () => setView(LocationCardViews.Connected),
       onSessionExpired: () => setView(LocationCardViews.Default),
@@ -79,7 +93,7 @@ export const LocationCardMfaEmailView = () => {
       }}
     >
       <Divider spacing={ThemeSpacing.Md} />
-      <LocationViewHeader title="Email verification">
+      <LocationViewHeader title={stepLabel ?? 'Email verification'}>
         <p>Enter the 6-digit code sent to your email address.</p>
       </LocationViewHeader>
       <SizedBox height={ThemeSpacing.Xl} />
@@ -102,13 +116,15 @@ export const LocationCardMfaEmailView = () => {
           }}
         />
         <div className="right">
-          <Button
-            variant={ButtonVariant.Outlined}
-            text="Other methods"
-            onClick={() => {
-              setView(LocationCardViews.MfaSettings);
-            }}
-          />
+          {canPickOtherMethod && (
+            <Button
+              variant={ButtonVariant.Outlined}
+              text="Other methods"
+              onClick={() => {
+                setView(LocationCardViews.MfaSettings);
+              }}
+            />
+          )}
           <Button
             text="Verify"
             variant={ButtonVariant.Primary}
diff --git a/new-ui/src/shared/components/LocationCard/views/LocationCardMfaMobileView/LocationCardMfaMobileView.tsx b/new-ui/src/shared/components/LocationCard/views/LocationCardMfaMobileView/LocationCardMfaMobileView.tsx
index a3bb41f12..567838716 100644
--- a/new-ui/src/shared/components/LocationCard/views/LocationCardMfaMobileView/LocationCardMfaMobileView.tsx
+++ b/new-ui/src/shared/components/LocationCard/views/LocationCardMfaMobileView/LocationCardMfaMobileView.tsx
@@ -17,8 +17,20 @@ import { useMfaMobileConnect } from '../../hooks/useMfaMobileConnect';
 type Screen = 'loading' | 'qr' | 'error';
 
 export const LocationCardMfaMobileView = () => {
-  const { setView, setPostureError, location } = useLocationCardContext();
+  const {
+    setView,
+    setPostureError,
+    location,
+    stepLabel,
+    canPickOtherMethod,
+    stepPlan,
+    mfaToken,
+    setMfaToken,
+  } = useLocationCardContext();
   const { start, startError, qrValue, connectionError } = useMfaMobileConnect(location, {
+    stepPlan,
+    mfaToken,
+    setMfaToken,
     onConnected: () => setView(LocationCardViews.Connected),
     onPostureError: (message) => setPostureError(message ?? null),
     onServiceUnavailable: () => setView(LocationCardViews.ConnectionError),
@@ -51,7 +63,7 @@ export const LocationCardMfaMobileView = () => {
   return (
     <div className="location-card-mfa-mobile">
       <Divider spacing={ThemeSpacing.Md} />
-      <LocationViewHeader title="Two-factor authentication">
+      <LocationViewHeader title={stepLabel ?? 'Two-factor authentication'}>
         {screen === 'loading' && <p>Preparing authentication...</p>}
         {screen === 'qr' && (
           <p>Open your Defguard mobile app and scan the QR code you see bellow.</p>
@@ -71,13 +83,15 @@ export const LocationCardMfaMobileView = () => {
           onClick={() => setView(LocationCardViews.Default)}
         />
         <div className="right">
-          <Button
-            variant={ButtonVariant.Outlined}
-            text="Other methods"
-            onClick={() => {
-              setView(LocationCardViews.MfaSettings);
-            }}
-          />
+          {canPickOtherMethod && (
+            <Button
+              variant={ButtonVariant.Outlined}
+              text="Other methods"
+              onClick={() => {
+                setView(LocationCardViews.MfaSettings);
+              }}
+            />
+          )}
           {screen === 'error' && (
             <Button
               text="Try again"
diff --git a/new-ui/src/shared/components/LocationCard/views/LocationCardMfaOidcView/LocationCardMfaOidcView.tsx b/new-ui/src/shared/components/LocationCard/views/LocationCardMfaOidcView/LocationCardMfaOidcView.tsx
index c206d24a4..d8c751575 100644
--- a/new-ui/src/shared/components/LocationCard/views/LocationCardMfaOidcView/LocationCardMfaOidcView.tsx
+++ b/new-ui/src/shared/components/LocationCard/views/LocationCardMfaOidcView/LocationCardMfaOidcView.tsx
@@ -22,7 +22,8 @@ type Screen = 'idle' | 'polling' | 'error';
 
 export const LocationCardMfaOidcView = () => {
   const { data: appConfig } = useQuery(getAppConfigQueryOptions);
-  const { setView, setPostureError, autoConnectOpenid } = useLocationCardContext();
+  const { setView, setPostureError, autoConnectOpenid, stepLabel } =
+    useLocationCardContext();
   const { start, isStarting, startError, isPolling, pollError } = useMfaOidcConnect();
   const [screen, setScreen] = useState<Screen>('idle');
 
@@ -56,7 +57,7 @@ export const LocationCardMfaOidcView = () => {
   return (
     <div className="location-card-mfa-oidc">
       <Divider spacing={ThemeSpacing.Md} />
-      <LocationViewHeader title="Two-factor authentication">
+      <LocationViewHeader title={stepLabel ?? 'Two-factor authentication'}>
         {screen === 'idle' && (
           <p>
             To connect to the VPN, authenticate via your OpenID provider. A browser window
diff --git a/new-ui/src/shared/components/LocationCard/views/LocationCardMfaSettings/LocationCardMfaSettings.tsx b/new-ui/src/shared/components/LocationCard/views/LocationCardMfaSettings/LocationCardMfaSettings.tsx
index 85fccdc2b..04ec9e913 100644
--- a/new-ui/src/shared/components/LocationCard/views/LocationCardMfaSettings/LocationCardMfaSettings.tsx
+++ b/new-ui/src/shared/components/LocationCard/views/LocationCardMfaSettings/LocationCardMfaSettings.tsx
@@ -2,12 +2,15 @@ import './style.scss';
 import { useMutation } from '@tanstack/react-query';
 import { useMemo, useState } from 'react';
 import { api } from '../../../../rust-api/api';
-import {
-  LocationMfaMode,
-  MfaMethod,
-  type MfaMethodValue,
-} from '../../../../rust-api/types';
+import type { MfaMethodValue } from '../../../../rust-api/types';
 import { ThemeSpacing } from '../../../../types';
+import { isPresent } from '../../../../utils/isPresent';
+import {
+  mfaStepCount,
+  pickableMfaMethods,
+  resolveMfaStepPlan,
+  usableMfaMethods,
+} from '../../../../utils/mfa';
 import { Button } from '../../../Button/Button';
 import { ButtonVariant } from '../../../Button/types';
 import { Checkbox } from '../../../Checkbox/Checkbox';
@@ -20,11 +23,11 @@ import { SizedBox } from '../../../SizedBox/SizedBox';
 import { LocationViewHeader } from '../../components/LocationViewHeader/LocationViewHeader';
 import { MfaSelector } from '../../components/MfaSelector/MfaSelector';
 import { useLocationCardContext } from '../../context/context';
-import { LocationCardViews } from '../../context/types';
+import { LocationCardViews, mfaMethodToLocationCardView } from '../../context/types';
 
 export const LocationCardMfaSettings = () => {
-  const { mutate: setMfaMethod } = useMutation({
-    mutationFn: api.setLocationMfaMethod,
+  const { mutate: setMfaStepPlan } = useMutation({
+    mutationFn: api.setLocationMfaStepPlan,
     meta: {
       invalidate: [['locations']],
     },
@@ -34,79 +37,101 @@ export const LocationCardMfaSettings = () => {
     previousView,
     setView,
     location,
-    mfaMethod: currentMethod,
     setMfaMethod: setContextMethod,
+    stepPlan,
+    stepIndex,
+    setStepPlanOnce,
   } = useLocationCardContext();
 
-  const locationDefaultMfaMethod = location.mfa_method ?? MfaMethod.Totp;
+  const mfaSteps = location.mfa_steps;
+  const isMultiStep = mfaStepCount(location) > 1;
+  const defaultPlan = resolveMfaStepPlan(location);
 
-  const [selectedMethod, setSelectedPref] = useState<MfaMethodValue>(currentMethod);
+  const isEditingDefaults = previousView === LocationCardViews.Default;
 
-  const isFromDefault = previousView === LocationCardViews.Default;
-  const [setAsDefault, setSetAsDefault] = useState(true);
+  const [selectedStepMethods, setSelectedStepMethods] = useState<MfaMethodValue[]>(
+    isEditingDefaults ? defaultPlan : stepPlan,
+  );
+  const [saveAsDefault, setSaveAsDefault] = useState(false);
 
-  const MfaFactorsList = useMemo((): MfaMethodValue[] => {
-    if (location.location_mfa_mode === LocationMfaMode.Internal) {
-      return [MfaMethod.Totp, MfaMethod.Email, MfaMethod.MobileApprove];
+  const editableSteps = useMemo(() => {
+    if (isEditingDefaults) {
+      return mfaSteps.map((step, index) => ({
+        stepIndex: index,
+        methods: pickableMfaMethods(step),
+      }));
     }
-    return [MfaMethod.Oidc];
-  }, [location.location_mfa_mode]);
+    const currentStep = mfaSteps[stepIndex];
+    if (!isPresent(currentStep)) return [];
+    return [{ stepIndex, methods: usableMfaMethods(currentStep) }];
+  }, [isEditingDefaults, mfaSteps, stepIndex]);
+
+  const selectMethodForStep = (targetStepIndex: number, method: MfaMethodValue) => {
+    setSelectedStepMethods((currentPlan) =>
+      currentPlan.map((selected, index) =>
+        index === targetStepIndex ? method : selected,
+      ),
+    );
+  };
 
   const handleSubmit = () => {
-    setContextMethod(selectedMethod);
-    if ((isFromDefault || setAsDefault) && selectedMethod !== locationDefaultMfaMethod) {
-      setMfaMethod({
-        locationId: location.id,
-        mfaMethod: selectedMethod,
-      });
-    }
-    if (isFromDefault) {
+    if (isEditingDefaults) {
+      setMfaStepPlan({ locationId: location.id, mfaStepPlan: selectedStepMethods });
       setView(LocationCardViews.Default);
       return;
     }
-    switch (selectedMethod) {
-      case 'totp':
-        setView(LocationCardViews.MfaTotp);
-        break;
-      case 'email':
-        setView(LocationCardViews.MfaEmail);
-        break;
-      case 'mobileapprove':
-        setView(LocationCardViews.MfaMobile);
-        break;
-      case 'oidc':
-        setView(LocationCardViews.MfaOidc);
-        break;
-      default:
-        setView(LocationCardViews.Default);
+
+    if (!isMultiStep && saveAsDefault) {
+      setMfaStepPlan({ locationId: location.id, mfaStepPlan: selectedStepMethods });
     }
+
+    const methodForCurrentStep = selectedStepMethods[stepIndex];
+    setStepPlanOnce(selectedStepMethods);
+    setContextMethod(methodForCurrentStep);
+    setView(mfaMethodToLocationCardView(methodForCurrentStep));
   };
 
   return (
     <div className="location-card-mfa-settings">
       <Divider spacing={ThemeSpacing.Md} />
       <LocationViewHeader title="Change MFA Method">
-        <p>
-          If you're having issues with your current verification method, you can choose
-          another one or set a new default.
-        </p>
+        {isEditingDefaults && (
+          <p>{`Choose the default verification method for each step of this location.`}</p>
+        )}
+        {!isEditingDefaults && (
+          <p>
+            {isMultiStep
+              ? `If you're having issues with your current verification method, you can choose another one for this login.`
+              : `If you're having issues with your current verification method, you can choose another one or set a new default.`}
+          </p>
+        )}
       </LocationViewHeader>
       <SizedBox height={ThemeSpacing.Xl} />
-      <div className="methods">
-        {MfaFactorsList.map((factor) => (
-          <MfaSelector
-            key={factor}
-            factor={factor}
-            selected={selectedMethod === factor}
-            isDefault={locationDefaultMfaMethod === factor}
-            onClick={() => setSelectedPref(factor)}
-          />
+      <div className="steps">
+        {editableSteps.map(({ methods, stepIndex: index }) => (
+          <div className="step" key={index}>
+            {isMultiStep && isEditingDefaults && (
+              <p className="step-label">Step {index + 1}</p>
+            )}
+            <div className="methods">
+              {methods.map((entry) => (
+                <MfaSelector
+                  key={entry.method}
+                  factor={entry.method}
+                  selected={selectedStepMethods[index] === entry.method}
+                  isDefault={defaultPlan[index] === entry.method}
+                  configured={entry.configured}
+                  onClick={() => selectMethodForStep(index, entry.method)}
+                />
+              ))}
+            </div>
+          </div>
         ))}
       </div>
-      {!isFromDefault && (
+      {!isEditingDefaults && !isMultiStep && (
         <Checkbox
-          active={isFromDefault ? true : setAsDefault}
-          onClick={() => setSetAsDefault((prev) => !prev)}
+          active={saveAsDefault}
+          onClick={() => setSaveAsDefault((current) => !current)}
           text="Set as default MFA method"
         />
       )}
@@ -123,7 +148,7 @@ export const LocationCardMfaSettings = () => {
           <Button
             variant={ButtonVariant.Primary}
             size={'primary'}
-            text="Save changes"
+            text={isEditingDefaults ? 'Save changes' : 'Continue'}
             onClick={handleSubmit}
           />
         </div>
diff --git a/new-ui/src/shared/components/LocationCard/views/LocationCardMfaSettings/style.scss b/new-ui/src/shared/components/LocationCard/views/LocationCardMfaSettings/style.scss
index f1133fe78..354e36b94 100644
--- a/new-ui/src/shared/components/LocationCard/views/LocationCardMfaSettings/style.scss
+++ b/new-ui/src/shared/components/LocationCard/views/LocationCardMfaSettings/style.scss
@@ -18,4 +18,28 @@
     row-gap: var(--spacing-md);
     padding-bottom: var(--spacing-md);
   }
+
+  > .steps {
+    display: flex;
+    flex-flow: column;
+    row-gap: var(--spacing-xl);
+    padding-bottom: var(--spacing-md);
+
+    > .step {
+      display: flex;
+      flex-flow: column;
+      row-gap: var(--spacing-sm);
+
+      > .step-label {
+        font: var(--t-body-xs-400);
+        color: var(--fg-white-70);
+      }
+
+      > .methods {
+        display: flex;
+        flex-flow: column;
+        row-gap: var(--spacing-md);
+      }
+    }
+  }
 }
diff --git a/new-ui/src/shared/components/LocationCard/views/LocationCardMfaTotpView/LocationCardMfaTotpView.tsx b/new-ui/src/shared/components/LocationCard/views/LocationCardMfaTotpView/LocationCardMfaTotpView.tsx
index 5cf19f233..96a27b42d 100644
--- a/new-ui/src/shared/components/LocationCard/views/LocationCardMfaTotpView/LocationCardMfaTotpView.tsx
+++ b/new-ui/src/shared/components/LocationCard/views/LocationCardMfaTotpView/LocationCardMfaTotpView.tsx
@@ -20,11 +20,25 @@ import { LocationCardMfaStartLoader } from '../LocationCardMfaStartLoader/Locati
 const MIN_POSTURE_LOADER_MS = 500;
 
 export const LocationCardMfaTotpView = () => {
-  const { setView, location, setPostureError } = useLocationCardContext();
+  const {
+    setView,
+    location,
+    setPostureError,
+    stepLabel,
+    canPickOtherMethod,
+    stepPlan,
+    mfaToken,
+    setMfaToken,
+    goToStep,
+  } = useLocationCardContext();
   const { verifyCode, isVerifying, verifyError, isStarting, startError } = useMfaConnect(
     location,
     MfaMethod.Totp,
     {
+      stepPlan,
+      mfaToken,
+      setMfaToken,
+      onStepAdvanced: goToStep,
       debounceMs: location.posture_check_required ? MIN_POSTURE_LOADER_MS : 0,
       onConnected: () => setView(LocationCardViews.Connected),
       onSessionExpired: () => setView(LocationCardViews.Default),
@@ -80,7 +94,7 @@ export const LocationCardMfaTotpView = () => {
       }}
     >
       <Divider spacing={ThemeSpacing.Md} />
-      <LocationViewHeader title="Two-factor authentication">
+      <LocationViewHeader title={stepLabel ?? 'Two-factor authentication'}>
         <p>Paste the code from your Authenticator Application.</p>
       </LocationViewHeader>
       <SizedBox height={ThemeSpacing.Xl} />
@@ -103,19 +117,20 @@ export const LocationCardMfaTotpView = () => {
           }}
         />
         <div className="right">
-          <Button
-            text="Other methods"
-            variant={ButtonVariant.Outlined}
-            onClick={() => {
-              setView(LocationCardViews.MfaSettings);
-            }}
-          />
+          {canPickOtherMethod && (
+            <Button
+              text="Other methods"
+              variant={ButtonVariant.Outlined}
+              onClick={() => {
+                setView(LocationCardViews.MfaSettings);
+              }}
+            />
+          )}
           <Button
             text="Verify"
             variant={ButtonVariant.Primary}
             onClick={() => handleVerify(totpCode)}
             loading={isVerifying}
-            disabled={isStarting}
           />
         </div>
       </Controls>
diff --git a/new-ui/src/shared/components/OverviewLocationCard/OverviewLocationCard.tsx b/new-ui/src/shared/components/OverviewLocationCard/OverviewLocationCard.tsx
index 55e11a601..bfd53a6ee 100644
--- a/new-ui/src/shared/components/OverviewLocationCard/OverviewLocationCard.tsx
+++ b/new-ui/src/shared/components/OverviewLocationCard/OverviewLocationCard.tsx
@@ -12,10 +12,13 @@ import { useConnectModal } from '../../../pages/full/OverviewPage/components/Con
 import { api } from '../../rust-api/api';
 import { getAppConfigQueryOptions } from '../../rust-api/query';
 import type { InstanceInfo, LocationInfo } from '../../rust-api/types';
-import { MfaMethod } from '../../rust-api/types';
 import { ThemeSpacing } from '../../types';
 import { isPresent } from '../../utils/isPresent';
-import { shouldStartMfa } from '../../utils/mfa';
+import {
+  hasUnpassableMfaStep,
+  resolveMfaStepPlan,
+  shouldStartMfa,
+} from '../../utils/mfa';
 import { Divider } from '../Divider/Divider';
 import { parseConnectError } from '../LocationCard/api/connectError';
 import { ConnectButton } from '../LocationCard/components/ConnectButton/ConnectButton';
@@ -87,11 +90,12 @@ export const OverviewLocationCard = ({ location, instance }: Props) => {
     }
 
     if (shouldStartMfa(location)) {
+      const stepPlan = resolveMfaStepPlan(location);
       useConnectModal.getState().open({
-        view: mfaMethodToConnectModalView(location.mfa_method ?? MfaMethod.Totp),
+        view: mfaMethodToConnectModalView(stepPlan[0]),
         location,
         autoStartOpenId: appConfig.auto_start_openid_mfa,
-        mfaMethod: location.mfa_method,
+        mfaMethod: stepPlan[0],
       });
       return;
     }
@@ -127,7 +131,7 @@ export const OverviewLocationCard = ({ location, instance }: Props) => {
           <ConnectButton
             active={location.active}
             onClick={handleConnectClick}
-            disabled={isBusy}
+            disabled={isBusy || hasUnpassableMfaStep(location)}
           />
         </div>
       </div>
@@ -156,20 +160,22 @@ export const OverviewLocationCard = ({ location, instance }: Props) => {
                 }}
               />
             )}
-            <LocationCardMfaEdit
-              variant="full"
-              location={location}
-              onEdit={() => {
-                if (isPresent(location)) {
-                  useConnectModal.getState().open({
-                    view: ConnectModalView.MfaSettings,
-                    location: location,
-                    perviousView: null,
-                    mfaMethod: location.mfa_method,
-                  });
-                }
-              }}
-            />
+            {shouldStartMfa(location) && (
+              <LocationCardMfaEdit
+                variant="full"
+                location={location}
+                onEdit={() => {
+                  if (isPresent(location)) {
+                    useConnectModal.getState().open({
+                      view: ConnectModalView.MfaSettings,
+                      location: location,
+                      perviousView: null,
+                      mfaMethod: resolveMfaStepPlan(location)[0],
+                    });
+                  }
+                }}
+              />
+            )}
           </Fragment>
         )}
       </div>
diff --git a/new-ui/src/shared/providers/TauriEventProvider.tsx b/new-ui/src/shared/providers/TauriEventProvider.tsx
index 1b15eda53..0380d41f4 100644
--- a/new-ui/src/shared/providers/TauriEventProvider.tsx
+++ b/new-ui/src/shared/providers/TauriEventProvider.tsx
@@ -15,12 +15,11 @@ import {
   type DeadConnectionDroppedPayload,
   type DeadConnectionReconnectedPayload,
   type LocationInfo,
-  MfaMethod,
   TauriEvent,
   type TunnelsDisabledPayload,
 } from '../rust-api/types';
 import { useAppStore } from '../store/useAppStore';
-import { decideLocationMfaMethod } from '../utils/decideLocationMfaMethod';
+import { resolveMfaStepPlan } from '../utils/mfa';
 
 export const TauriEventProvider = ({ children }: PropsWithChildren) => {
   const navigate = useNavigate();
@@ -69,8 +68,7 @@ export const TauriEventProvider = ({ children }: PropsWithChildren) => {
             };
             void (async () => {
               const appConfig = await api.getAppConfig();
-              const mfaMethod =
-                decideLocationMfaMethod(location, location.mfa_method) ?? MfaMethod.Totp;
+              const mfaMethod = resolveMfaStepPlan(location)[0];
 
               await navigate({ to: '/full/overview' });
               useConnectModal.getState().open({
diff --git a/new-ui/src/shared/rust-api/api.ts b/new-ui/src/shared/rust-api/api.ts
index 98c23ff6f..2c72e052f 100644
--- a/new-ui/src/shared/rust-api/api.ts
+++ b/new-ui/src/shared/rust-api/api.ts
@@ -1,4 +1,5 @@
 import { invoke } from '@tauri-apps/api/core';
+import { isPresent } from '../utils/isPresent';
 import { mfaToApi } from '../utils/mfa';
 import type {
   ActiveConnectionSummary,
@@ -17,6 +18,8 @@ import type {
   LocationStats,
   MfaMethodValue,
   MfaStartResult,
+  MfaStepSession,
+  MfaStepStartResult,
   NewAppVersionInfo,
   ProvisioningConfig,
   RoutingArgs,
@@ -24,7 +27,7 @@ import type {
   SaveDeviceConfigResponse,
   SessionState,
   SessionStatePatch,
-  SetLocationMfaMethodArgs,
+  SetLocationMfaStepPlanArgs,
   StatsArgs,
   TunnelInfo,
   TunnelRequest,
@@ -56,8 +59,8 @@ const getLocationDetails = (args: LocationDetailsArgs): Promise<LocationDetails>
 const updateLocationRouting = (args: RoutingArgs): Promise<Connection> =>
   invoke(TauriCommand.UpdateLocationRouting, args);
 
-const setLocationMfaMethod = (args: SetLocationMfaMethodArgs): Promise<void> =>
-  invoke(TauriCommand.SetLocationMfaMethod, args);
+const setLocationMfaStepPlan = (args: SetLocationMfaStepPlanArgs): Promise<void> =>
+  invoke(TauriCommand.SetLocationMfaStepPlan, args);
 
 const connect = (args: ConnectionArgs): Promise<void> =>
   invoke(TauriCommand.Connect, args);
@@ -196,19 +199,31 @@ const enrollmentFinish = (sessionId: string): Promise<void> =>
 const mfaStart = (
   instanceId: number,
   locationId: number,
-  method: string,
+  methods: MfaMethodValue[],
 ): Promise<MfaStartResult> =>
-  invoke(TauriCommand.MfaStart, { instanceId, locationId, method });
+  invoke(TauriCommand.MfaStart, { instanceId, locationId, methods });
+
+const mfaStepStart = (
+  instanceId: number,
+  token: string,
+  method: MfaMethodValue,
+): Promise<MfaStepStartResult> =>
+  invoke(TauriCommand.MfaStepStart, { instanceId, token, method });
 
-// Completes MFA and brings up the connection in the backend; the preshared key
-// never crosses back to the frontend.
 const mfaFinishCode = (
   instanceId: number,
   locationId: number,
   token: string,
   code: string,
-): Promise<void> =>
-  invoke(TauriCommand.MfaFinishCode, { instanceId, locationId, token, code });
+  stepAttemptId: string | null,
+): Promise<number | null> =>
+  invoke(TauriCommand.MfaFinishCode, {
+    instanceId,
+    locationId,
+    token,
+    code,
+    stepAttemptId,
+  });
 
 const mfaPollOpenId = (
   instanceId: number,
@@ -227,6 +242,30 @@ const mfaConnectMobileApprove = (
 const cancelMfa = (taskId: string): Promise<void> =>
   invoke(TauriCommand.CancelMfa, { taskId });
 
+const startMfaStep = async (
+  instanceId: number,
+  locationId: number,
+  method: MfaMethodValue,
+  stepPlan: MfaMethodValue[],
+  mfaToken: string | null,
+): Promise<MfaStepSession> => {
+  if (isPresent(mfaToken) && stepPlan.length > 1) {
+    const startedStep = await mfaStepStart(instanceId, mfaToken, method);
+    return {
+      token: mfaToken,
+      challenge: startedStep.challenge,
+      stepAttemptId: startedStep.step_attempt_id,
+    };
+  }
+
+  const startedSession = await mfaStart(instanceId, locationId, stepPlan);
+  return {
+    token: startedSession.token,
+    challenge: startedSession.challenge,
+    stepAttemptId: null,
+  };
+};
+
 export const api = {
   closeWelcomeWindow,
   // Instances
@@ -239,7 +278,7 @@ export const api = {
   hasAnyVisibleLocations,
   getLocationDetails,
   updateLocationRouting,
-  setLocationMfaMethod,
+  setLocationMfaStepPlan,
   // Connections
   connect,
   disconnect,
@@ -288,4 +327,5 @@ export const api = {
   mfaPollOpenId,
   mfaConnectMobileApprove,
   cancelMfa,
+  startMfaStep,
 };
diff --git a/new-ui/src/shared/rust-api/types.ts b/new-ui/src/shared/rust-api/types.ts
index f6fc68fd0..46454e6cf 100644
--- a/new-ui/src/shared/rust-api/types.ts
+++ b/new-ui/src/shared/rust-api/types.ts
@@ -91,6 +91,7 @@ export const TauriCommand = {
   EnrollmentFinish: 'enrollment_finish',
   // MFA
   MfaStart: 'mfa_start',
+  MfaStepStart: 'mfa_step_start',
   MfaFinishCode: 'mfa_finish_code',
   MfaPollOpenId: 'mfa_poll_openid',
   MfaConnectMobileApprove: 'mfa_connect_mobile_approve',
@@ -105,7 +106,7 @@ export const TauriCommand = {
   HasAnyVisibleLocations: 'has_any_visible_locations',
   LocationInterfaceDetails: 'location_interface_details',
   UpdateLocationRouting: 'update_location_routing',
-  SetLocationMfaMethod: 'set_location_mfa_method',
+  SetLocationMfaStepPlan: 'set_location_mfa_step_plan',
   // Connections
   Connect: 'connect',
   Disconnect: 'disconnect',
@@ -233,6 +234,15 @@ export type InstanceInfo = {
   openid_display_name: string | null;
 };
 
+export type MfaStepMethod = {
+  method: MfaMethodValue;
+  configured: boolean;
+};
+
+export type MfaStep = {
+  methods: MfaStepMethod[];
+};
+
 export type LocationInfo = {
   id: number;
   instance_id: number;
@@ -247,6 +257,8 @@ export type LocationInfo = {
   location_mfa_mode: LocationMfaMode;
   mfa_method?: MfaMethodValue;
   posture_check_required: boolean;
+  mfa_steps: MfaStep[];
+  mfa_step_plan: MfaMethodValue[];
 };
 
 export type LocationStats = {
@@ -399,9 +411,9 @@ export type UpdateInstanceArgs = {
   response: CreateDeviceResponse;
 };
 
-export type SetLocationMfaMethodArgs = {
+export type SetLocationMfaStepPlanArgs = {
   locationId: number;
-  mfaMethod: MfaMethodValue;
+  mfaStepPlan: MfaMethodValue[];
 };
 
 export type OverviewViewSelection = {
@@ -492,6 +504,17 @@ export type MfaStartResult = {
   challenge: string | null;
 };
 
+export type MfaStepStartResult = {
+  step_attempt_id: string;
+  challenge: string | null;
+};
+
+export type MfaStepSession = {
+  token: string;
+  challenge: string | null;
+  stepAttemptId: string | null;
+};
+
 /** Payload for mfa-openid-error / mfa-mobile-error events. */
 export type MfaErrorPayload = {
   error: string;
diff --git a/new-ui/src/shared/utils/decideLocationMfaMethod.ts b/new-ui/src/shared/utils/decideLocationMfaMethod.ts
deleted file mode 100644
index 247de109e..000000000
--- a/new-ui/src/shared/utils/decideLocationMfaMethod.ts
+++ /dev/null
@@ -1,17 +0,0 @@
-import { type LocationInfo, MfaMethod, type MfaMethodValue } from '../rust-api/types';
-
-export const decideLocationMfaMethod = (
-  location: LocationInfo,
-  currentMethod: MfaMethodValue | null | undefined,
-): MfaMethodValue | null => {
-  switch (location.location_mfa_mode) {
-    case 'disabled':
-      return location.mfa_method ?? null;
-    case 'external':
-      return MfaMethod.Oidc;
-    case 'internal':
-      if (currentMethod === MfaMethod.Oidc || !currentMethod)
-        return location.mfa_method ?? null;
-      return currentMethod;
-  }
-};
diff --git a/new-ui/src/shared/utils/mfa.ts b/new-ui/src/shared/utils/mfa.ts
index c29b07d6c..8e824a5ec 100644
--- a/new-ui/src/shared/utils/mfa.ts
+++ b/new-ui/src/shared/utils/mfa.ts
@@ -1,17 +1,19 @@
 import {
   ConnectionType,
   type LocationInfo,
-  LocationMfaMode,
   MfaMethod,
   type MfaMethodValue,
+  type MfaStep,
+  type MfaStepMethod,
 } from '../rust-api/types';
+import { isPresent } from './isPresent';
 
 const mfaMethodLabels: Record<MfaMethodValue, string> = {
   [MfaMethod.Email]: 'Email',
   [MfaMethod.MobileApprove]: 'Mobile Client',
   [MfaMethod.Oidc]: 'OpenID',
   [MfaMethod.Totp]: 'Authenticator app',
-  [MfaMethod.Biometric]: 'Biometric',
+  [MfaMethod.Biometric]: 'Biometrics',
 };
 
 export const mfaToText = (factor: MfaMethodValue): string => mfaMethodLabels[factor];
@@ -26,12 +28,61 @@ export const mfaMethodApiValues: Record<MfaMethodValue, string> = {
 
 export const mfaToApi = (factor: MfaMethodValue): string => mfaMethodApiValues[factor];
 
+const mfaSteps = (
+  location: Pick<LocationInfo, 'connection_type' | 'mfa_steps'>,
+): MfaStep[] =>
+  location.connection_type === ConnectionType.Tunnel ? [] : location.mfa_steps;
+
 /**
  * Whether connecting this location should trigger the MFA flow: only for
  * server-managed locations (never bare tunnels) that have MFA enabled.
  */
 export const shouldStartMfa = (
-  location: Pick<LocationInfo, 'connection_type' | 'location_mfa_mode'>,
-): boolean =>
-  location.connection_type !== ConnectionType.Tunnel &&
-  location.location_mfa_mode !== LocationMfaMode.Disabled;
+  location: Pick<LocationInfo, 'connection_type' | 'mfa_steps'>,
+): boolean => mfaStepCount(location) > 0;
+
+export const mfaStepCount = (
+  location: Pick<LocationInfo, 'connection_type' | 'mfa_steps'>,
+): number => mfaSteps(location).length;
+
+export const usableMfaMethods = (step: MfaStep): MfaStepMethod[] =>
+  step.methods.filter(
+    (entry) => entry.configured && entry.method !== MfaMethod.Biometric,
+  );
+
+export const pickableMfaMethods = (step: MfaStep): MfaStepMethod[] => {
+  const withoutBiometric = step.methods.filter(
+    (entry) => entry.method !== MfaMethod.Biometric,
+  );
+  return withoutBiometric.length > 0 ? withoutBiometric : step.methods;
+};
+
+export const resolveMfaStepPlan = (
+  location: Pick<LocationInfo, 'connection_type' | 'mfa_steps' | 'mfa_step_plan'>,
+  oneOffPlan: MfaMethodValue[] = [],
+): MfaMethodValue[] =>
+  mfaSteps(location).map((step, index) => {
+    const usableMethods = usableMfaMethods(step);
+    const isUsable = (method: MfaMethodValue) =>
+      usableMethods.some((entry) => entry.method === method);
+
+    const oneOffChoice = oneOffPlan[index];
+    if (isPresent(oneOffChoice) && isUsable(oneOffChoice)) return oneOffChoice;
+
+    const savedChoice = location.mfa_step_plan[index];
+    if (isPresent(savedChoice) && isUsable(savedChoice)) return savedChoice;
+
+    return (usableMethods[0] ?? step.methods[0]).method;
+  });
+
+/**
+ * A step with no usable factor cannot be passed on the desktop. This shouldn't happen
+ * because such configuration won't be sent from core.
+ * TODO: block connecting only until the user can configure the missing factors in place.
+ */
+export const hasUnpassableMfaStep = (
+  location: Pick<LocationInfo, 'connection_type' | 'mfa_steps'>,
+): boolean => mfaSteps(location).some((step) => usableMfaMethods(step).length === 0);
+
+export const mfaStepsToText = (stepCount: number): string =>
+  `${stepCount}-step verification`;
diff --git a/src-tauri/.sqlx/query-56b89ac487ed011e33080a9058700f706a9860e6a6f3070305f8ea85b5ff8efb.json b/src-tauri/.sqlx/query-0857b9594a855229c4444f07b02351ab37a108a36013654abed126ee64da881f.json
similarity index 83%
rename from src-tauri/.sqlx/query-56b89ac487ed011e33080a9058700f706a9860e6a6f3070305f8ea85b5ff8efb.json
rename to src-tauri/.sqlx/query-0857b9594a855229c4444f07b02351ab37a108a36013654abed126ee64da881f.json
index c40c1f567..dbe151db1 100644
--- a/src-tauri/.sqlx/query-56b89ac487ed011e33080a9058700f706a9860e6a6f3070305f8ea85b5ff8efb.json
+++ b/src-tauri/.sqlx/query-0857b9594a855229c4444f07b02351ab37a108a36013654abed126ee64da881f.json
@@ -1,6 +1,6 @@
 {
   "db_name": "SQLite",
-  "query": "SELECT id, instance_id, name, address, pubkey, endpoint, allowed_ips, dns, network_id, route_all_traffic, keepalive_interval, location_mfa_mode \"location_mfa_mode: LocationMfaMode\", service_location_mode \"service_location_mode: ServiceLocationMode\", mfa_method \"mfa_method: _\", posture_check_required FROM location WHERE name = $1 AND service_location_mode <= $2 ORDER BY name ASC",
+  "query": "SELECT id, instance_id, name, address, pubkey, endpoint, allowed_ips, dns, network_id, route_all_traffic, keepalive_interval, location_mfa_mode \"location_mfa_mode: LocationMfaMode\", service_location_mode \"service_location_mode: ServiceLocationMode\", mfa_method \"mfa_method: _\", posture_check_required, mfa_steps \"mfa_steps: _\", mfa_step_plan \"mfa_step_plan: _\" FROM location WHERE name = $1 AND service_location_mode <= $2 ORDER BY name ASC",
   "describe": {
     "columns": [
       {
@@ -77,6 +77,16 @@
         "name": "posture_check_required",
         "ordinal": 14,
         "type_info": "Bool"
+      },
+      {
+        "name": "mfa_steps: _",
+        "ordinal": 15,
+        "type_info": "Text"
+      },
+      {
+        "name": "mfa_step_plan: _",
+        "ordinal": 16,
+        "type_info": "Text"
       }
     ],
     "parameters": {
@@ -97,8 +107,10 @@
       false,
       false,
       true,
+      false,
+      false,
       false
     ]
   },
-  "hash": "56b89ac487ed011e33080a9058700f706a9860e6a6f3070305f8ea85b5ff8efb"
+  "hash": "0857b9594a855229c4444f07b02351ab37a108a36013654abed126ee64da881f"
 }
diff --git a/src-tauri/.sqlx/query-a25979219918af2df8abca48a48d7fba459b79b74d462565088bf27d8e9fcd5d.json b/src-tauri/.sqlx/query-48e11c4f529c9e702ceb4180d1548893e9c4854fd6e4e7a912790d27f1c20c9c.json
similarity index 83%
rename from src-tauri/.sqlx/query-a25979219918af2df8abca48a48d7fba459b79b74d462565088bf27d8e9fcd5d.json
rename to src-tauri/.sqlx/query-48e11c4f529c9e702ceb4180d1548893e9c4854fd6e4e7a912790d27f1c20c9c.json
index 48cdb545a..d1551b0cd 100644
--- a/src-tauri/.sqlx/query-a25979219918af2df8abca48a48d7fba459b79b74d462565088bf27d8e9fcd5d.json
+++ b/src-tauri/.sqlx/query-48e11c4f529c9e702ceb4180d1548893e9c4854fd6e4e7a912790d27f1c20c9c.json
@@ -1,6 +1,6 @@
 {
   "db_name": "SQLite",
-  "query": "SELECT id \"id: _\", instance_id, name, address, pubkey, endpoint, allowed_ips, dns, network_id, route_all_traffic,  keepalive_interval, location_mfa_mode \"location_mfa_mode: LocationMfaMode\", service_location_mode \"service_location_mode: ServiceLocationMode\",\n            mfa_method \"mfa_method: _\", posture_check_required FROM location WHERE id = $1",
+  "query": "SELECT id \"id: _\", instance_id, name, address, pubkey, endpoint, allowed_ips, dns, network_id, route_all_traffic,  keepalive_interval, location_mfa_mode \"location_mfa_mode: LocationMfaMode\", service_location_mode \"service_location_mode: ServiceLocationMode\",\n            mfa_method \"mfa_method: _\", posture_check_required, mfa_steps \"mfa_steps: _\", mfa_step_plan \"mfa_step_plan: _\" FROM location WHERE id = $1",
   "describe": {
     "columns": [
       {
@@ -77,6 +77,16 @@
         "name": "posture_check_required",
         "ordinal": 14,
         "type_info": "Bool"
+      },
+      {
+        "name": "mfa_steps: _",
+        "ordinal": 15,
+        "type_info": "Text"
+      },
+      {
+        "name": "mfa_step_plan: _",
+        "ordinal": 16,
+        "type_info": "Text"
       }
     ],
     "parameters": {
@@ -97,8 +107,10 @@
       false,
       false,
       true,
+      false,
+      false,
       false
     ]
   },
-  "hash": "a25979219918af2df8abca48a48d7fba459b79b74d462565088bf27d8e9fcd5d"
+  "hash": "48e11c4f529c9e702ceb4180d1548893e9c4854fd6e4e7a912790d27f1c20c9c"
 }
diff --git a/src-tauri/.sqlx/query-1c07ca7013959226ca9af064037bb64da07f7023f58ff8678d828a0ba50e2470.json b/src-tauri/.sqlx/query-561bcb97e47bda40f58ea3a99353534a1794aaf8efc7315512a2b1952adc99f1.json
similarity index 83%
rename from src-tauri/.sqlx/query-1c07ca7013959226ca9af064037bb64da07f7023f58ff8678d828a0ba50e2470.json
rename to src-tauri/.sqlx/query-561bcb97e47bda40f58ea3a99353534a1794aaf8efc7315512a2b1952adc99f1.json
index d5164870d..088bcb92d 100644
--- a/src-tauri/.sqlx/query-1c07ca7013959226ca9af064037bb64da07f7023f58ff8678d828a0ba50e2470.json
+++ b/src-tauri/.sqlx/query-561bcb97e47bda40f58ea3a99353534a1794aaf8efc7315512a2b1952adc99f1.json
@@ -1,6 +1,6 @@
 {
   "db_name": "SQLite",
-  "query": "SELECT id \"id: _\", instance_id, name, address, pubkey, endpoint, allowed_ips, dns, network_id, route_all_traffic, keepalive_interval, location_mfa_mode \"location_mfa_mode: LocationMfaMode\", service_location_mode \"service_location_mode: ServiceLocationMode\",\n            mfa_method \"mfa_method: _\", posture_check_required FROM location WHERE instance_id = $1 AND service_location_mode <= $2 ORDER BY name ASC",
+  "query": "SELECT id \"id: _\", instance_id, name, address, pubkey, endpoint, allowed_ips, dns, network_id, route_all_traffic, keepalive_interval, location_mfa_mode \"location_mfa_mode: LocationMfaMode\", service_location_mode \"service_location_mode: ServiceLocationMode\",\n            mfa_method \"mfa_method: _\", posture_check_required, mfa_steps \"mfa_steps: _\", mfa_step_plan \"mfa_step_plan: _\" FROM location WHERE instance_id = $1 AND service_location_mode <= $2 ORDER BY name ASC",
   "describe": {
     "columns": [
       {
@@ -77,6 +77,16 @@
         "name": "posture_check_required",
         "ordinal": 14,
         "type_info": "Bool"
+      },
+      {
+        "name": "mfa_steps: _",
+        "ordinal": 15,
+        "type_info": "Text"
+      },
+      {
+        "name": "mfa_step_plan: _",
+        "ordinal": 16,
+        "type_info": "Text"
       }
     ],
     "parameters": {
@@ -97,8 +107,10 @@
       false,
       false,
       true,
+      false,
+      false,
       false
     ]
   },
-  "hash": "1c07ca7013959226ca9af064037bb64da07f7023f58ff8678d828a0ba50e2470"
+  "hash": "561bcb97e47bda40f58ea3a99353534a1794aaf8efc7315512a2b1952adc99f1"
 }
diff --git a/src-tauri/.sqlx/query-e16f46ba4c2365de31db15551084eddaabf35d813a54eced9d38c951965ce83e.json b/src-tauri/.sqlx/query-84effef815ae3f82276e4ad5a5f6ec1f8180d976de306997946742a8b597a398.json
similarity index 65%
rename from src-tauri/.sqlx/query-e16f46ba4c2365de31db15551084eddaabf35d813a54eced9d38c951965ce83e.json
rename to src-tauri/.sqlx/query-84effef815ae3f82276e4ad5a5f6ec1f8180d976de306997946742a8b597a398.json
index 01577f676..516eed938 100644
--- a/src-tauri/.sqlx/query-e16f46ba4c2365de31db15551084eddaabf35d813a54eced9d38c951965ce83e.json
+++ b/src-tauri/.sqlx/query-84effef815ae3f82276e4ad5a5f6ec1f8180d976de306997946742a8b597a398.json
@@ -1,12 +1,12 @@
 {
   "db_name": "SQLite",
-  "query": "UPDATE location SET instance_id = $1, name = $2, address = $3, pubkey = $4, endpoint = $5, allowed_ips = $6, dns = $7, network_id = $8, route_all_traffic = $9, keepalive_interval = $10, location_mfa_mode = $11, service_location_mode = $12, mfa_method = $13, posture_check_required = $14 WHERE id = $15",
+  "query": "UPDATE location SET instance_id = $1, name = $2, address = $3, pubkey = $4, endpoint = $5, allowed_ips = $6, dns = $7, network_id = $8, route_all_traffic = $9, keepalive_interval = $10, location_mfa_mode = $11, service_location_mode = $12, mfa_method = $13, posture_check_required = $14, mfa_steps = $15, mfa_step_plan = $16 WHERE id = $17",
   "describe": {
     "columns": [],
     "parameters": {
-      "Right": 15
+      "Right": 17
     },
     "nullable": []
   },
-  "hash": "e16f46ba4c2365de31db15551084eddaabf35d813a54eced9d38c951965ce83e"
+  "hash": "84effef815ae3f82276e4ad5a5f6ec1f8180d976de306997946742a8b597a398"
 }
diff --git a/src-tauri/.sqlx/query-e27705d75d504385fbaea05c43eadecccdb12fcb43060dd383e7c9fd1516179e.json b/src-tauri/.sqlx/query-b910d1f333eccacde5476abeae0cdf1ac7d98bb0598b92343e279cd339afdd8a.json
similarity index 61%
rename from src-tauri/.sqlx/query-e27705d75d504385fbaea05c43eadecccdb12fcb43060dd383e7c9fd1516179e.json
rename to src-tauri/.sqlx/query-b910d1f333eccacde5476abeae0cdf1ac7d98bb0598b92343e279cd339afdd8a.json
index 538701cfe..a4b1c5cf6 100644
--- a/src-tauri/.sqlx/query-e27705d75d504385fbaea05c43eadecccdb12fcb43060dd383e7c9fd1516179e.json
+++ b/src-tauri/.sqlx/query-b910d1f333eccacde5476abeae0cdf1ac7d98bb0598b92343e279cd339afdd8a.json
@@ -1,6 +1,6 @@
 {
   "db_name": "SQLite",
-  "query": "INSERT INTO location (instance_id, name, address, pubkey, endpoint, allowed_ips, dns, network_id, route_all_traffic, keepalive_interval, location_mfa_mode, service_location_mode, mfa_method, posture_check_required) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14) RETURNING id \"id!\"",
+  "query": "INSERT INTO location (instance_id, name, address, pubkey, endpoint, allowed_ips, dns, network_id, route_all_traffic, keepalive_interval, location_mfa_mode, service_location_mode, mfa_method, posture_check_required, mfa_steps, mfa_step_plan) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16) RETURNING id \"id!\"",
   "describe": {
     "columns": [
       {
@@ -10,11 +10,11 @@
       }
     ],
     "parameters": {
-      "Right": 14
+      "Right": 16
     },
     "nullable": [
       true
     ]
   },
-  "hash": "e27705d75d504385fbaea05c43eadecccdb12fcb43060dd383e7c9fd1516179e"
+  "hash": "b910d1f333eccacde5476abeae0cdf1ac7d98bb0598b92343e279cd339afdd8a"
 }
diff --git a/src-tauri/.sqlx/query-97a52a8bbf020b77afe5dc427efb66abfdc6b571d1631a4f77fbf4fa5cfbe7e7.json b/src-tauri/.sqlx/query-cc57fb8a4da341dd34639a720a81bd0e736da3f08636061f302425b97fa609c8.json
similarity index 83%
rename from src-tauri/.sqlx/query-97a52a8bbf020b77afe5dc427efb66abfdc6b571d1631a4f77fbf4fa5cfbe7e7.json
rename to src-tauri/.sqlx/query-cc57fb8a4da341dd34639a720a81bd0e736da3f08636061f302425b97fa609c8.json
index e0c2aeee7..292823f5c 100644
--- a/src-tauri/.sqlx/query-97a52a8bbf020b77afe5dc427efb66abfdc6b571d1631a4f77fbf4fa5cfbe7e7.json
+++ b/src-tauri/.sqlx/query-cc57fb8a4da341dd34639a720a81bd0e736da3f08636061f302425b97fa609c8.json
@@ -1,6 +1,6 @@
 {
   "db_name": "SQLite",
-  "query": "SELECT id \"id: _\", instance_id, name, address, pubkey, endpoint, allowed_ips, dns, network_id, route_all_traffic, keepalive_interval, location_mfa_mode \"location_mfa_mode: LocationMfaMode\", service_location_mode \"service_location_mode: ServiceLocationMode\",\n            mfa_method \"mfa_method: _\", posture_check_required FROM location WHERE pubkey = $1",
+  "query": "SELECT id \"id: _\", instance_id, name, address, pubkey, endpoint, allowed_ips, dns, network_id, route_all_traffic, keepalive_interval, location_mfa_mode \"location_mfa_mode: LocationMfaMode\", service_location_mode \"service_location_mode: ServiceLocationMode\",\n            mfa_method \"mfa_method: _\", posture_check_required, mfa_steps \"mfa_steps: _\", mfa_step_plan \"mfa_step_plan: _\" FROM location WHERE pubkey = $1",
   "describe": {
     "columns": [
       {
@@ -77,6 +77,16 @@
         "name": "posture_check_required",
         "ordinal": 14,
         "type_info": "Bool"
+      },
+      {
+        "name": "mfa_steps: _",
+        "ordinal": 15,
+        "type_info": "Text"
+      },
+      {
+        "name": "mfa_step_plan: _",
+        "ordinal": 16,
+        "type_info": "Text"
       }
     ],
     "parameters": {
@@ -97,8 +107,10 @@
       false,
       false,
       true,
+      false,
+      false,
       false
     ]
   },
-  "hash": "97a52a8bbf020b77afe5dc427efb66abfdc6b571d1631a4f77fbf4fa5cfbe7e7"
+  "hash": "cc57fb8a4da341dd34639a720a81bd0e736da3f08636061f302425b97fa609c8"
 }
diff --git a/src-tauri/.sqlx/query-c6a5e793cccc520039e28da8b4fb73e0c79c6a8d671c300ec2ea3eb0d58342b5.json b/src-tauri/.sqlx/query-db446260d0c5aa6b1cbb5fd389c571849de22deddc2564a493c8a998bca3e343.json
similarity index 83%
rename from src-tauri/.sqlx/query-c6a5e793cccc520039e28da8b4fb73e0c79c6a8d671c300ec2ea3eb0d58342b5.json
rename to src-tauri/.sqlx/query-db446260d0c5aa6b1cbb5fd389c571849de22deddc2564a493c8a998bca3e343.json
index 2436bff93..86d2c7908 100644
--- a/src-tauri/.sqlx/query-c6a5e793cccc520039e28da8b4fb73e0c79c6a8d671c300ec2ea3eb0d58342b5.json
+++ b/src-tauri/.sqlx/query-db446260d0c5aa6b1cbb5fd389c571849de22deddc2564a493c8a998bca3e343.json
@@ -1,6 +1,6 @@
 {
   "db_name": "SQLite",
-  "query": "SELECT id, instance_id, name, address, pubkey, endpoint, allowed_ips, dns, network_id, route_all_traffic, keepalive_interval, location_mfa_mode \"location_mfa_mode: LocationMfaMode\", service_location_mode \"service_location_mode: ServiceLocationMode\", mfa_method \"mfa_method: _\", posture_check_required FROM location WHERE service_location_mode <= $1 ORDER BY name ASC",
+  "query": "SELECT id, instance_id, name, address, pubkey, endpoint, allowed_ips, dns, network_id, route_all_traffic, keepalive_interval, location_mfa_mode \"location_mfa_mode: LocationMfaMode\", service_location_mode \"service_location_mode: ServiceLocationMode\", mfa_method \"mfa_method: _\", posture_check_required, mfa_steps \"mfa_steps: _\", mfa_step_plan \"mfa_step_plan: _\" FROM location WHERE service_location_mode <= $1 ORDER BY name ASC",
   "describe": {
     "columns": [
       {
@@ -77,6 +77,16 @@
         "name": "posture_check_required",
         "ordinal": 14,
         "type_info": "Bool"
+      },
+      {
+        "name": "mfa_steps: _",
+        "ordinal": 15,
+        "type_info": "Text"
+      },
+      {
+        "name": "mfa_step_plan: _",
+        "ordinal": 16,
+        "type_info": "Text"
       }
     ],
     "parameters": {
@@ -97,8 +107,10 @@
       false,
       false,
       true,
+      false,
+      false,
       false
     ]
   },
-  "hash": "c6a5e793cccc520039e28da8b4fb73e0c79c6a8d671c300ec2ea3eb0d58342b5"
+  "hash": "db446260d0c5aa6b1cbb5fd389c571849de22deddc2564a493c8a998bca3e343"
 }
diff --git a/src-tauri/Cargo.lock b/src-tauri/Cargo.lock
index 664d45602..0fbc96e4c 100644
--- a/src-tauri/Cargo.lock
+++ b/src-tauri/Cargo.lock
@@ -1484,7 +1484,7 @@ checksum = "092966b41edc516079bdf31ec78a2e0588d1d0c08f78b91d8307215928642b2b"
 
 [[package]]
 name = "defguard-cli"
-version = "2.1.0"
+version = "2.2.0"
 dependencies = [
  "base64 0.22.1",
  "chrono",
@@ -1520,7 +1520,7 @@ dependencies = [
 
 [[package]]
 name = "defguard-client"
-version = "2.1.0"
+version = "2.2.0"
 dependencies = [
  "anyhow",
  "async-stream",
@@ -1600,7 +1600,7 @@ dependencies = [
 
 [[package]]
 name = "defguard-client-common"
-version = "2.1.0"
+version = "2.2.0"
 dependencies = [
  "nix",
  "vergen-git2",
@@ -1608,7 +1608,7 @@ dependencies = [
 
 [[package]]
 name = "defguard-client-config-sync"
-version = "2.1.0"
+version = "2.2.0"
 dependencies = [
  "defguard-client-core",
  "defguard-client-proto",
@@ -1626,7 +1626,7 @@ dependencies = [
 
 [[package]]
 name = "defguard-client-core"
-version = "2.1.0"
+version = "2.2.0"
 dependencies = [
  "base64 0.22.1",
  "block2 0.6.2",
@@ -1670,7 +1670,7 @@ dependencies = [
 
 [[package]]
 name = "defguard-client-posture"
-version = "2.1.0"
+version = "2.2.0"
 dependencies = [
  "defguard-client-core",
  "defguard-client-proto",
@@ -1688,7 +1688,7 @@ dependencies = [
 
 [[package]]
 name = "defguard-client-proto"
-version = "2.1.0"
+version = "2.2.0"
 dependencies = [
  "defguard_wireguard_rs",
  "prost",
@@ -1703,7 +1703,7 @@ dependencies = [
 
 [[package]]
 name = "defguard-client-provisioning"
-version = "2.1.0"
+version = "2.2.0"
 dependencies = [
  "defguard-client-core",
  "log",
@@ -1714,7 +1714,7 @@ dependencies = [
 
 [[package]]
 name = "defguard-client-service"
-version = "2.1.0"
+version = "2.2.0"
 dependencies = [
  "anyhow",
  "async-stream",
@@ -1742,7 +1742,7 @@ dependencies = [
 
 [[package]]
 name = "defguard-client-service-locations"
-version = "2.1.0"
+version = "2.2.0"
 dependencies = [
  "base64 0.22.1",
  "defguard-client-common",
@@ -1767,7 +1767,7 @@ dependencies = [
 
 [[package]]
 name = "defguard-dg"
-version = "2.1.0"
+version = "2.2.0"
 dependencies = [
  "clap",
  "defguard-client-common",
diff --git a/src-tauri/Cargo.toml b/src-tauri/Cargo.toml
index cc25a2a98..de729692f 100644
--- a/src-tauri/Cargo.toml
+++ b/src-tauri/Cargo.toml
@@ -16,7 +16,7 @@ semver = { version = "1.0", features = ["serde"] }
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
 serde_with = "3.11"
-sqlx = { version = "0.8", features = ["chrono", "runtime-tokio", "sqlite", "uuid", "macros"] }
+sqlx = { version = "0.8", features = ["chrono", "json", "runtime-tokio", "sqlite", "uuid", "macros"] }
 thiserror = "2.0"
 tokio = { version = "1", features = ["macros", "rt-multi-thread", "signal"] }
 tonic = { version = "0.14", default-features = false, features = [
@@ -54,7 +54,7 @@ edition = "2021"
 homepage = "https://github.com/DefGuard/client"
 license-file = "../LICENSE.md"
 rust-version = "1.95"
-version = "2.1.0"
+version = "2.2.0"
 
 [package]
 name = "defguard-client"
diff --git a/src-tauri/cli/src/bin/dg.rs b/src-tauri/cli/src/bin/dg.rs
index 28e59a603..3ada25005 100644
--- a/src-tauri/cli/src/bin/dg.rs
+++ b/src-tauri/cli/src/bin/dg.rs
@@ -36,6 +36,7 @@ use tracing_subscriber::EnvFilter;
 
 mod proto {
     pub mod defguard {
+        #[allow(clippy::enum_variant_names)]
         pub mod client_types {
             include!(concat!(env!("OUT_DIR"), "/defguard.client_types.rs"));
         }
diff --git a/src-tauri/client-cli/src/commands/list.rs b/src-tauri/client-cli/src/commands/list.rs
index 9228ebf9f..4f65aa1a1 100644
--- a/src-tauri/client-cli/src/commands/list.rs
+++ b/src-tauri/client-cli/src/commands/list.rs
@@ -20,7 +20,11 @@ const MIN_TUNNEL_NAME_COL_WIDTH: usize = 4;
 
 pub(crate) async fn handle(state: &State) -> Result<ListResult, CliError> {
     let instances = Instance::all(&state.pool).await?;
-    let locations = Location::all(&state.pool, false).await?;
+    let locations = Location::all(&state.pool, false)
+        .await?
+        .into_iter()
+        .filter(|location| location.mfa_steps.len() <= 1)
+        .collect::<Vec<_>>();
     let tunnels = if Instance::tunnels_disabled(&state.pool).await? {
         Vec::new()
     } else {
@@ -242,6 +246,8 @@ mod tests {
             service_location_mode: ServiceLocationMode::Disabled,
             mfa_method: None,
             posture_check_required: false,
+            mfa_steps: Default::default(),
+            mfa_step_plan: Default::default(),
         }
     }
 
diff --git a/src-tauri/client-cli/src/commands/location.rs b/src-tauri/client-cli/src/commands/location.rs
index 139ac4dc7..d83ea966f 100644
--- a/src-tauri/client-cli/src/commands/location.rs
+++ b/src-tauri/client-cli/src/commands/location.rs
@@ -18,7 +18,11 @@ const MIN_ENDPOINT_COL_WIDTH: usize = 8;
 const MIN_INST_COL_WIDTH: usize = 8;
 
 pub(crate) async fn handle_list(state: &State) -> Result<LocationListResult, CliError> {
-    let locations = Location::all(&state.pool, false).await?;
+    let locations = Location::all(&state.pool, false)
+        .await?
+        .into_iter()
+        .filter(|location| location.mfa_steps.len() <= 1)
+        .collect::<Vec<_>>();
 
     let instance_details = Instance::all(&state.pool)
         .await?
@@ -345,6 +349,8 @@ mod tests {
         mfa: bool,
     ) -> Location<Id> {
         Location {
+            mfa_steps: Default::default(),
+            mfa_step_plan: Default::default(),
             id,
             instance_id,
             network_id: 1,
diff --git a/src-tauri/client-cli/src/commands/status.rs b/src-tauri/client-cli/src/commands/status.rs
index 51d73cd28..ee493fe1f 100644
--- a/src-tauri/client-cli/src/commands/status.rs
+++ b/src-tauri/client-cli/src/commands/status.rs
@@ -60,7 +60,7 @@ fn format_status_table(connections: &[ActiveConnectionInfo]) -> String {
         .unwrap_or(MIN_IFACE_COL_WIDTH)
         .max(MIN_IFACE_COL_WIDTH);
 
-    let mut lines = vec![format!("\nActive Connections")];
+    let mut lines = vec!["\nActive Connections".to_string()];
     lines.push(format!(
         "  {:<name_col_width$}  TYPE       {:<iface_col_width$}  TX          RX          {:<9}",
         "NAME", "INTERFACE", "HANDSHAKE"
diff --git a/src-tauri/client-cli/src/mfa.rs b/src-tauri/client-cli/src/mfa.rs
index f61ddb0f7..6f716fe04 100644
--- a/src-tauri/client-cli/src/mfa.rs
+++ b/src-tauri/client-cli/src/mfa.rs
@@ -108,6 +108,7 @@ pub(crate) fn validate_mfa_flags(
 ///
 /// The HTTP calls are handled by `defguard_core::mfa`; this function
 /// handles CLI-specific code sourcing (TTY / --code / --code-command).
+#[allow(deprecated)]
 pub(crate) async fn authorize(
     location: &Location<Id>,
     source: &CodeSource,
@@ -160,6 +161,8 @@ pub(crate) async fn authorize(
         pubkey: wireguard_keys.pubkey,
         method: method as i32,
         posture_data,
+        // empty = legacy path; the CLI has no multi-step MFA
+        selected_methods: Vec::new(),
     };
     let info = mfa::mfa_start(proxy_url.clone(), request)
         .await
@@ -175,6 +178,7 @@ pub(crate) async fn authorize(
         token: info.token,
         code: Some(code.expose_secret().to_string()),
         auth_pub_key: None,
+        step_attempt_id: None,
     };
     let psk = mfa::mfa_finish_code(proxy_url, finish_req)
         .await
@@ -191,6 +195,7 @@ pub(crate) async fn authorize(
 ///
 /// When `json_mode` is true, progress messages on stderr are suppressed so
 /// that `--json` output consumers only see the final result/error.
+#[allow(deprecated)]
 pub(crate) async fn authorize_oidc(
     location: &Location<Id>,
     instance: &Instance<Id>,
@@ -218,6 +223,8 @@ pub(crate) async fn authorize_oidc(
         pubkey: wireguard_keys.pubkey,
         method: MfaMethod::Oidc as i32,
         posture_data,
+        // empty = legacy path; the CLI has no multi-step MFA
+        selected_methods: Vec::new(),
     };
     let info = mfa::mfa_start(proxy_url.clone(), request)
         .await
@@ -259,6 +266,7 @@ pub(crate) async fn authorize_oidc(
 ///
 /// When `json_mode` is true, progress messages on stderr are suppressed so
 /// that `--json` output consumers only see the final result/error.
+#[allow(deprecated)]
 pub(crate) async fn authorize_mobile_approve(
     location: &Location<Id>,
     instance: &Instance<Id>,
@@ -290,6 +298,8 @@ pub(crate) async fn authorize_mobile_approve(
         pubkey: wireguard_keys.pubkey,
         method: MfaMethod::MobileApprove as i32,
         posture_data,
+        // empty = legacy path; the CLI has no multi-step MFA
+        selected_methods: Vec::new(),
     };
     let info = mfa::mfa_start(proxy_url.clone(), request)
         .await
@@ -400,6 +410,8 @@ mod tests {
 
     fn location(name: &str, mode: LocationMfaMode) -> Location<Id> {
         Location {
+            mfa_steps: Default::default(),
+            mfa_step_plan: Default::default(),
             id: 1,
             instance_id: 1,
             network_id: 1,
diff --git a/src-tauri/client-cli/src/resolve.rs b/src-tauri/client-cli/src/resolve.rs
index 645845657..0066347a9 100644
--- a/src-tauri/client-cli/src/resolve.rs
+++ b/src-tauri/client-cli/src/resolve.rs
@@ -206,6 +206,8 @@ mod tests {
             service_location_mode: ServiceLocationMode::Disabled,
             mfa_method: None,
             posture_check_required: false,
+            mfa_steps: Default::default(),
+            mfa_step_plan: Default::default(),
         }
     }
 
diff --git a/src-tauri/client-cli/src/tests_daemon.rs b/src-tauri/client-cli/src/tests_daemon.rs
index 7f298616d..f4b56e770 100644
--- a/src-tauri/client-cli/src/tests_daemon.rs
+++ b/src-tauri/client-cli/src/tests_daemon.rs
@@ -192,6 +192,8 @@ async fn test_active_state_lists_interfaces(pool: DbPool) {
         service_location_mode: ServiceLocationMode::Disabled,
         mfa_method: None,
         posture_check_required: false,
+        mfa_steps: Default::default(),
+        mfa_step_plan: Default::default(),
     }
     .save(&pool)
     .await
diff --git a/src-tauri/client-proto/build.rs b/src-tauri/client-proto/build.rs
index 1529c1578..8eec52a37 100644
--- a/src-tauri/client-proto/build.rs
+++ b/src-tauri/client-proto/build.rs
@@ -26,6 +26,15 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
             ".defguard.client.v1.ServiceLocation.posture_check_required",
             "#[serde(default)]",
         )
+        // [2.2] These repeated fields are absent in responses from pre-2.2 edges.
+        .field_attribute(
+            ".defguard.client_types.DeviceConfig.steps",
+            "#[serde(default)]",
+        )
+        .field_attribute(
+            ".defguard.client_types.ClientMfaStartResponse.rejections",
+            "#[serde(default)]",
+        )
         // Use proto defaults for missing fields in enrollment types that
         // may differ across proxy versions.
         .type_attribute(".defguard.client_types.AdminInfo", "#[serde(default)]")
diff --git a/src-tauri/client-proto/src/lib.rs b/src-tauri/client-proto/src/lib.rs
index 36eb75471..8d082c93a 100644
--- a/src-tauri/client-proto/src/lib.rs
+++ b/src-tauri/client-proto/src/lib.rs
@@ -2,6 +2,7 @@ pub mod conversions;
 pub mod posture_ext;
 
 pub mod defguard {
+    #[allow(clippy::enum_variant_names)]
     pub mod client_types {
         tonic::include_proto!("defguard.client_types");
     }
diff --git a/src-tauri/core/src/database/models/connection.rs b/src-tauri/core/src/database/models/connection.rs
index 9cb87d079..40f79f8c0 100644
--- a/src-tauri/core/src/database/models/connection.rs
+++ b/src-tauri/core/src/database/models/connection.rs
@@ -205,6 +205,8 @@ mod tests {
             service_location_mode: ServiceLocationMode::Disabled,
             mfa_method: None,
             posture_check_required: false,
+            mfa_steps: Default::default(),
+            mfa_step_plan: Default::default(),
         }
         .save(pool)
         .await
diff --git a/src-tauri/core/src/database/models/location.rs b/src-tauri/core/src/database/models/location.rs
index 297ecf179..cab5db6e2 100644
--- a/src-tauri/core/src/database/models/location.rs
+++ b/src-tauri/core/src/database/models/location.rs
@@ -5,7 +5,7 @@ use std::str::FromStr;
 #[cfg(not(target_os = "macos"))]
 use defguard_wireguard_rs::{key::Key, net::IpAddrMask, peer::Peer, InterfaceConfiguration};
 use serde::{Deserialize, Serialize};
-use sqlx::{prelude::Type, query, query_as, query_scalar, SqliteExecutor};
+use sqlx::{prelude::Type, query, query_as, query_scalar, types::Json, SqliteExecutor};
 
 #[cfg(not(target_os = "macos"))]
 use super::wireguard_keys::WireguardKeys;
@@ -17,7 +17,8 @@ use crate::{
     },
     error::Error,
     proto::client_types::{
-        LocationMfaMode as ProtoLocationMfaMode, ServiceLocationMode as ProtoServiceLocationMode,
+        LocationMfaMode as ProtoLocationMfaMode, MfaMethod as ProtoMfaMethod,
+        MfaStep as ProtoMfaStep, ServiceLocationMode as ProtoServiceLocationMode,
     },
 };
 #[cfg(not(target_os = "macos"))]
@@ -90,6 +91,66 @@ impl LocationMfaMethod {
     }
 }
 
+impl From<ProtoMfaMethod> for LocationMfaMethod {
+    fn from(value: ProtoMfaMethod) -> Self {
+        match value {
+            ProtoMfaMethod::Totp => LocationMfaMethod::Totp,
+            ProtoMfaMethod::Email => LocationMfaMethod::Email,
+            ProtoMfaMethod::Oidc => LocationMfaMethod::Oidc,
+            ProtoMfaMethod::Biometric => LocationMfaMethod::Biometric,
+            ProtoMfaMethod::MobileApprove => LocationMfaMethod::MobileApprove,
+        }
+    }
+}
+
+#[derive(Clone, Copy, Debug, Deserialize, Serialize, Eq, Hash, PartialEq)]
+pub struct LocationMfaStepMethod {
+    pub method: LocationMfaMethod,
+    pub configured: bool,
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize, Eq, Hash, PartialEq)]
+pub struct LocationMfaStep {
+    pub methods: Vec<LocationMfaStepMethod>,
+}
+
+impl From<ProtoMfaStep> for LocationMfaStep {
+    fn from(value: ProtoMfaStep) -> Self {
+        Self {
+            methods: value
+                .methods
+                .iter()
+                .map(|entry| LocationMfaStepMethod {
+                    method: entry.method().into(),
+                    configured: entry.configured,
+                })
+                .collect(),
+        }
+    }
+}
+
+#[must_use]
+pub fn legacy_mfa_steps(mode: LocationMfaMode) -> Vec<LocationMfaStep> {
+    let methods = match mode {
+        LocationMfaMode::Disabled => return Vec::new(),
+        LocationMfaMode::Internal => vec![
+            LocationMfaMethod::Totp,
+            LocationMfaMethod::Email,
+            LocationMfaMethod::MobileApprove,
+        ],
+        LocationMfaMode::External => vec![LocationMfaMethod::Oidc],
+    };
+    vec![LocationMfaStep {
+        methods: methods
+            .into_iter()
+            .map(|method| LocationMfaStepMethod {
+                method,
+                configured: true,
+            })
+            .collect(),
+    }]
+}
+
 #[must_use]
 pub fn infer_mfa_method(
     mode: LocationMfaMode,
@@ -124,6 +185,10 @@ pub struct Location<I = NoId> {
     pub mfa_method: Option<LocationMfaMethod>,
     #[serde(default)]
     pub posture_check_required: bool,
+    #[serde(default)]
+    pub mfa_steps: Json<Vec<LocationMfaStep>>,
+    #[serde(default)]
+    pub mfa_step_plan: Json<Vec<LocationMfaMethod>>,
 }
 
 impl fmt::Display for Location<Id> {
@@ -152,7 +217,8 @@ impl Location<Id> {
             network_id, route_all_traffic, keepalive_interval, \
             location_mfa_mode \"location_mfa_mode: LocationMfaMode\", \
             service_location_mode \"service_location_mode: ServiceLocationMode\", \
-            mfa_method \"mfa_method: _\", posture_check_required \
+            mfa_method \"mfa_method: _\", posture_check_required, mfa_steps \"mfa_steps: _\", \
+            mfa_step_plan \"mfa_step_plan: _\" \
             FROM location WHERE service_location_mode <= $1 \
             ORDER BY name ASC",
             max_service_location_mode
@@ -190,7 +256,8 @@ impl Location<Id> {
             network_id, route_all_traffic, keepalive_interval, \
             location_mfa_mode \"location_mfa_mode: LocationMfaMode\", \
             service_location_mode \"service_location_mode: ServiceLocationMode\", \
-            mfa_method \"mfa_method: _\", posture_check_required \
+            mfa_method \"mfa_method: _\", posture_check_required, mfa_steps \"mfa_steps: _\", \
+            mfa_step_plan \"mfa_step_plan: _\" \
             FROM location WHERE name = $1 AND service_location_mode <= $2 ORDER BY name ASC",
             name,
             max,
@@ -208,8 +275,9 @@ impl Location<Id> {
             "UPDATE location SET instance_id = $1, name = $2, address = $3, pubkey = $4, \
             endpoint = $5, allowed_ips = $6, dns = $7, network_id = $8, route_all_traffic = $9, \
             keepalive_interval = $10, location_mfa_mode = $11, service_location_mode = $12, \
-            mfa_method = $13, posture_check_required = $14 \
-            WHERE id = $15",
+            mfa_method = $13, posture_check_required = $14, mfa_steps = $15, \
+            mfa_step_plan = $16 \
+            WHERE id = $17",
             self.instance_id,
             self.name,
             self.address,
@@ -224,6 +292,8 @@ impl Location<Id> {
             self.service_location_mode,
             self.mfa_method,
             self.posture_check_required,
+            self.mfa_steps,
+            self.mfa_step_plan,
             self.id,
         )
         .execute(executor)
@@ -242,7 +312,8 @@ impl Location<Id> {
             network_id, route_all_traffic,  keepalive_interval, \
             location_mfa_mode \"location_mfa_mode: LocationMfaMode\", \
             service_location_mode \"service_location_mode: ServiceLocationMode\",
-            mfa_method \"mfa_method: _\", posture_check_required \
+            mfa_method \"mfa_method: _\", posture_check_required, mfa_steps \"mfa_steps: _\", \
+            mfa_step_plan \"mfa_step_plan: _\" \
             FROM location WHERE id = $1",
             location_id
         )
@@ -266,7 +337,8 @@ impl Location<Id> {
             network_id, route_all_traffic, keepalive_interval, \
             location_mfa_mode \"location_mfa_mode: LocationMfaMode\", \
             service_location_mode \"service_location_mode: ServiceLocationMode\",
-            mfa_method \"mfa_method: _\", posture_check_required \
+            mfa_method \"mfa_method: _\", posture_check_required, mfa_steps \"mfa_steps: _\", \
+            mfa_step_plan \"mfa_step_plan: _\" \
             FROM location WHERE instance_id = $1 AND service_location_mode <= $2 \
             ORDER BY name ASC",
             instance_id,
@@ -286,7 +358,8 @@ impl Location<Id> {
             network_id, route_all_traffic, keepalive_interval, \
             location_mfa_mode \"location_mfa_mode: LocationMfaMode\", \
             service_location_mode \"service_location_mode: ServiceLocationMode\",
-            mfa_method \"mfa_method: _\", posture_check_required \
+            mfa_method \"mfa_method: _\", posture_check_required, mfa_steps \"mfa_steps: _\", \
+            mfa_step_plan \"mfa_step_plan: _\" \
             FROM location WHERE pubkey = $1",
             pubkey
         )
@@ -449,6 +522,19 @@ impl Location<Id> {
         Ok(())
     }
 
+    pub async fn set_mfa_step_plan(
+        pool: &DbPool,
+        location_id: Id,
+        plan: Vec<LocationMfaMethod>,
+    ) -> Result<(), Error> {
+        let mut location = Self::find_by_id(pool, location_id)
+            .await?
+            .ok_or(Error::NotFound)?;
+        location.mfa_step_plan = Json(plan);
+        location.save(pool).await?;
+        Ok(())
+    }
+
     /// Persist the route-all-traffic flag for a location, rejecting the update if
     /// the owning instance's [`ClientTrafficPolicy`] forbids the requested value.
     pub async fn update_routing(
@@ -505,8 +591,9 @@ impl Location<NoId> {
         let id = query_scalar!(
             "INSERT INTO location (instance_id, name, address, pubkey, endpoint, allowed_ips, \
             dns, network_id, route_all_traffic, keepalive_interval, location_mfa_mode, \
-            service_location_mode, mfa_method, posture_check_required) \
-            VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14) \
+            service_location_mode, mfa_method, posture_check_required, mfa_steps, \
+            mfa_step_plan) \
+            VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16) \
             RETURNING id \"id!\"",
             self.instance_id,
             self.name,
@@ -522,6 +609,8 @@ impl Location<NoId> {
             self.service_location_mode,
             self.mfa_method,
             self.posture_check_required,
+            self.mfa_steps,
+            self.mfa_step_plan,
         )
         .fetch_one(executor)
         .await?;
@@ -542,6 +631,8 @@ impl Location<NoId> {
             service_location_mode: self.service_location_mode,
             mfa_method: self.mfa_method,
             posture_check_required: self.posture_check_required,
+            mfa_steps: self.mfa_steps,
+            mfa_step_plan: self.mfa_step_plan,
         })
     }
 }
@@ -571,6 +662,8 @@ impl From<Location<Id>> for Location {
             service_location_mode: location.service_location_mode,
             mfa_method: location.mfa_method,
             posture_check_required: location.posture_check_required,
+            mfa_steps: location.mfa_steps,
+            mfa_step_plan: location.mfa_step_plan,
         }
     }
 }
@@ -615,6 +708,8 @@ mod tests {
             service_location_mode: ServiceLocationMode::Disabled,
             mfa_method: None,
             posture_check_required: false,
+            mfa_steps: Default::default(),
+            mfa_step_plan: Default::default(),
         }
     }
 
diff --git a/src-tauri/core/src/database/models/location_stats.rs b/src-tauri/core/src/database/models/location_stats.rs
index 305157541..40981eefa 100644
--- a/src-tauri/core/src/database/models/location_stats.rs
+++ b/src-tauri/core/src/database/models/location_stats.rs
@@ -279,6 +279,8 @@ mod tests {
             service_location_mode: ServiceLocationMode::Disabled,
             mfa_method: None,
             posture_check_required: false,
+            mfa_steps: Default::default(),
+            mfa_step_plan: Default::default(),
         }
         .save(pool)
         .await
diff --git a/src-tauri/core/src/lib.rs b/src-tauri/core/src/lib.rs
index b9c00fef2..c8418f8dd 100644
--- a/src-tauri/core/src/lib.rs
+++ b/src-tauri/core/src/lib.rs
@@ -7,11 +7,15 @@ use std::{
 
 use chrono::{Duration, NaiveDateTime, Utc};
 use database::models::{
-    location::{infer_mfa_method, Location, LocationMfaMode, ServiceLocationMode},
+    location::{
+        infer_mfa_method, legacy_mfa_steps, Location, LocationMfaMode, LocationMfaStep,
+        ServiceLocationMode,
+    },
     Id,
 };
 use defguard_client_proto::defguard::client_types::DeviceConfig;
 use serde::{Deserialize, Serialize};
+use sqlx::types::Json;
 
 pub mod app_config;
 pub mod connection;
@@ -156,6 +160,7 @@ pub fn into_location(dev_config: DeviceConfig, instance_id: Id) -> Location<NoId
     use LocationMfaMode as MfaMode;
     use ServiceLocationMode as SLocationMode;
 
+    #[allow(deprecated)]
     let location_mfa_mode = match dev_config.location_mfa_mode {
         Some(_location_mfa_mode) => dev_config.location_mfa_mode().into(),
         None =>
@@ -190,13 +195,27 @@ pub fn into_location(dev_config: DeviceConfig, instance_id: Id) -> Location<NoId
         service_location_mode,
         mfa_method: infer_mfa_method(location_mfa_mode, None),
         posture_check_required: dev_config.posture_check_required.unwrap_or_default(),
+        mfa_steps: Json(if dev_config.steps.is_empty() {
+            legacy_mfa_steps(location_mfa_mode)
+        } else {
+            dev_config
+                .steps
+                .into_iter()
+                .map(LocationMfaStep::from)
+                .collect::<Vec<_>>()
+        }),
+        mfa_step_plan: Json::default(),
     }
 }
 
 #[cfg(test)]
+#[allow(deprecated)]
 mod tests {
     use chrono::{Duration, Utc};
-    use defguard_client_proto::defguard::client_types::DeviceConfig;
+    use defguard_client_proto::defguard::client_types::{
+        DeviceConfig, MfaMethod as ProtoMfaMethod, MfaStep as ProtoMfaStep,
+        MfaStepMethod as ProtoMfaStepMethod,
+    };
 
     use super::{get_aggregation, into_location, DateTimeAggregation};
     use crate::database::models::location::{LocationMfaMethod, LocationMfaMode};
@@ -269,6 +288,57 @@ mod tests {
         assert_eq!(location.mfa_method, Some(LocationMfaMethod::Totp));
     }
 
+    #[test]
+    fn test_into_location_legacy_internal_synthesizes_single_step() {
+        let mut cfg = base_dev_config();
+        cfg.location_mfa_mode = Some(crate::proto::client_types::LocationMfaMode::Internal as i32);
+        let location = into_location(cfg, 1);
+        assert_eq!(location.mfa_steps.0.len(), 1);
+        assert_eq!(
+            location.mfa_steps.0[0]
+                .methods
+                .iter()
+                .map(|entry| entry.method)
+                .collect::<Vec<_>>(),
+            vec![
+                LocationMfaMethod::Totp,
+                LocationMfaMethod::Email,
+                LocationMfaMethod::MobileApprove
+            ]
+        );
+        assert!(location.mfa_steps.0[0]
+            .methods
+            .iter()
+            .all(|entry| entry.configured));
+    }
+
+    #[test]
+    fn test_into_location_legacy_disabled_has_no_steps() {
+        let location = into_location(base_dev_config(), 1);
+        assert_eq!(location.location_mfa_mode, LocationMfaMode::Disabled);
+        assert!(location.mfa_steps.0.is_empty());
+    }
+
+    #[test]
+    fn test_into_location_steps_win_over_deprecated_mode() {
+        let mut cfg = base_dev_config();
+        cfg.location_mfa_mode = Some(crate::proto::client_types::LocationMfaMode::Internal as i32);
+        cfg.steps = vec![ProtoMfaStep {
+            methods: vec![ProtoMfaStepMethod {
+                method: ProtoMfaMethod::Oidc as i32,
+                configured: false,
+            }],
+        }];
+        let location = into_location(cfg, 1);
+        assert_eq!(location.mfa_steps.0.len(), 1);
+        assert_eq!(location.mfa_steps.0[0].methods.len(), 1);
+        assert_eq!(
+            location.mfa_steps.0[0].methods[0].method,
+            LocationMfaMethod::Oidc
+        );
+        assert!(!location.mfa_steps.0[0].methods[0].configured);
+    }
+
     #[test]
     fn test_into_location_explicit_mfa_mode() {
         let mut cfg = base_dev_config();
diff --git a/src-tauri/core/src/mfa.rs b/src-tauri/core/src/mfa.rs
index c10f02194..ba6ddcaab 100644
--- a/src-tauri/core/src/mfa.rs
+++ b/src-tauri/core/src/mfa.rs
@@ -7,7 +7,8 @@ use std::time::Duration;
 
 use defguard_client_proto::defguard::client_types::{
     ClientMfaFinishRequest, ClientMfaFinishResponse, ClientMfaStartRequest, ClientMfaStartResponse,
-    MfaMethod,
+    ClientMfaStepStartRequest, ClientMfaStepStartResponse, MfaMethod, MfaStartRejectionReason,
+    MfaStepRejection,
 };
 use futures_util::StreamExt;
 use reqwest::{Client, Response, StatusCode, Url};
@@ -126,12 +127,74 @@ pub async fn mfa_start(
         message: format!("Failed to reach proxy: {e}"),
     })?;
 
+    #[allow(deprecated)]
     let response = match check_mfa_response(response).await {
         Ok(response) => response,
         Err(err) => return Err(rewrap_mobile_start_error(request.method, err)),
     };
+    let start_response: ClientMfaStartResponse =
+        response.json().await.map_err(|e| MfaError::Other {
+            message: format!("Invalid MFA start response: {e}"),
+        })?;
+
+    if let Some(rejection) = start_response.rejections.first() {
+        return Err(MfaError::MfaRejected {
+            message: rejection_message(rejection),
+        });
+    }
+
+    Ok(start_response)
+}
+
+fn rejection_message(rejection: &MfaStepRejection) -> String {
+    let step = rejection.step + 1;
+    match rejection.reason() {
+        MfaStartRejectionReason::MfaStartRejectionMethodNotInStep => format!(
+            "The method chosen for verification step {step} is not allowed. \
+             The location's MFA settings have changed, so pick a method again."
+        ),
+        MfaStartRejectionReason::MfaStartRejectionStepEmptyAfterLicense => format!(
+            "Verification step {step} has no method available on this server. \
+             Contact your administrator."
+        ),
+        MfaStartRejectionReason::MfaStartRejectionStepUnavailable => format!(
+            "The method chosen for verification step {step} cannot be used. \
+             Set it up first, or pick a different one."
+        ),
+        MfaStartRejectionReason::MfaStartRejectionUnspecified => {
+            format!("The server rejected verification step {step}.")
+        }
+    }
+}
+
+pub async fn mfa_step_start(
+    proxy_url: Url,
+    request: ClientMfaStepStartRequest,
+) -> Result<ClientMfaStepStartResponse, MfaError> {
+    let client = build_client();
+
+    let url = proxy_url
+        .join("api/v1/client-mfa/step-start")
+        .map_err(|e| MfaError::Other {
+            message: format!("Failed to build MFA step start URL: {e}"),
+        })?;
+
+    let mut request_builder = client.post(url).json(&request);
+
+    for (header_name, header_value) in standard_headers() {
+        request_builder = request_builder.header(header_name, header_value);
+    }
+
+    let response = request_builder
+        .send()
+        .await
+        .map_err(|e| MfaError::NetworkError {
+            message: format!("Failed to reach proxy: {e}"),
+        })?;
+
+    let response = check_mfa_response(response).await?;
     response.json().await.map_err(|e| MfaError::Other {
-        message: format!("Invalid MFA start response: {e}"),
+        message: format!("Invalid MFA step start response: {e}"),
     })
 }
 
@@ -227,6 +290,7 @@ pub async fn poll_openid_mfa(
         token,
         code: None,
         auth_pub_key: None,
+        step_attempt_id: None,
     };
 
     loop {
@@ -374,9 +438,11 @@ async fn wait_for_mfa_success(
             if let Ok(parsed) = serde_json::from_str::<serde_json::Value>(&text) {
                 if parsed.get("type").and_then(|v| v.as_str()) == Some("mfa_success") {
                     if let Some(key) = parsed["preshared_key"].as_str() {
+                        #[allow(deprecated)]
                         return Ok(ClientMfaFinishResponse {
                             preshared_key: key.to_string(),
                             token: None,
+                            result: None,
                         });
                     }
                 }
@@ -386,6 +452,7 @@ async fn wait_for_mfa_success(
 }
 
 #[cfg(test)]
+#[allow(deprecated)]
 mod tests {
     use reqwest::Url;
     use serde_json::json;
@@ -408,6 +475,7 @@ mod tests {
             pubkey: "pk".into(),
             method: 0, // TOTP
             posture_data: None,
+            selected_methods: Vec::new(),
         }
     }
 
@@ -545,6 +613,7 @@ mod tests {
             pubkey: "pk".into(),
             method: MfaMethod::MobileApprove as i32,
             posture_data: None,
+            selected_methods: Vec::new(),
         };
         match mfa_start(url, request).await.unwrap_err() {
             MfaError::MfaRejected { message } => {
@@ -602,6 +671,7 @@ mod tests {
                 token: "token".into(),
                 code: Some("123456".into()),
                 auth_pub_key: None,
+                step_attempt_id: None,
             },
         )
         .await
@@ -629,6 +699,7 @@ mod tests {
                 token: "token".into(),
                 code: Some("000000".into()),
                 auth_pub_key: None,
+                step_attempt_id: None,
             },
         )
         .await
diff --git a/src-tauri/enterprise/config-sync/src/commands.rs b/src-tauri/enterprise/config-sync/src/commands.rs
index 9f78f72cb..2e5ef0eb6 100644
--- a/src-tauri/enterprise/config-sync/src/commands.rs
+++ b/src-tauri/enterprise/config-sync/src/commands.rs
@@ -121,6 +121,7 @@ pub async fn do_update_instance(
                     current_location.mfa_method,
                 );
                 current_location.posture_check_required = new_location.posture_check_required;
+                current_location.mfa_steps = new_location.mfa_steps;
                 current_location.save(transaction.as_mut()).await?;
                 info!("Location {current_location} configuration updated for instance {instance}");
                 current_location
diff --git a/src-tauri/enterprise/config-sync/src/lib.rs b/src-tauri/enterprise/config-sync/src/lib.rs
index d4475944a..474e05b06 100644
--- a/src-tauri/enterprise/config-sync/src/lib.rs
+++ b/src-tauri/enterprise/config-sync/src/lib.rs
@@ -653,6 +653,8 @@ mod tests {
             service_location_mode: ServiceLocationMode::Disabled,
             mfa_method: None,
             posture_check_required: false,
+            mfa_steps: Default::default(),
+            mfa_step_plan: Default::default(),
         }
         .save(pool)
         .await
diff --git a/src-tauri/enterprise/service-locations/src/lib.rs b/src-tauri/enterprise/service-locations/src/lib.rs
index 93e089156..eb4e12f8f 100644
--- a/src-tauri/enterprise/service-locations/src/lib.rs
+++ b/src-tauri/enterprise/service-locations/src/lib.rs
@@ -64,6 +64,7 @@ pub struct ServiceLocationManager {
 
 /// Runtime state for a connected location.
 #[derive(Clone)]
+#[cfg_attr(not(any(windows, target_os = "linux")), allow(dead_code))]
 struct ConnectedServiceLocation {
     location: ServiceLocation,
     /// Records when a posture-gated service location was authorized for staleness detection.
diff --git a/src-tauri/justfile b/src-tauri/justfile
new file mode 100644
index 000000000..1b2da43b2
--- /dev/null
+++ b/src-tauri/justfile
@@ -0,0 +1,8 @@
+# format Rust project
+format:
+    cargo +nightly --locked fmt --all  # use nightly toolchain for better import handling
+
+# lint Rust project
+lint:
+    cargo clippy --workspace --all-targets --all-features -- -D warnings
+
diff --git a/src-tauri/migrations/20260820120000_add_location_mfa_steps.sql b/src-tauri/migrations/20260820120000_add_location_mfa_steps.sql
new file mode 100644
index 000000000..cad983523
--- /dev/null
+++ b/src-tauri/migrations/20260820120000_add_location_mfa_steps.sql
@@ -0,0 +1,2 @@
+ALTER TABLE location ADD COLUMN mfa_steps TEXT NOT NULL DEFAULT '[]';
+ALTER TABLE location ADD COLUMN mfa_step_plan TEXT NOT NULL DEFAULT '[]';
diff --git a/src-tauri/permissions/default.toml b/src-tauri/permissions/default.toml
index e6aac4cc8..6932824b0 100644
--- a/src-tauri/permissions/default.toml
+++ b/src-tauri/permissions/default.toml
@@ -10,6 +10,7 @@ commands.allow = [
   "enrollment_network_info",
   "enrollment_finish",
   "mfa_start",
+  "mfa_step_start",
   "mfa_finish_code",
   "mfa_poll_openid",
   "mfa_connect_mobile_approve",
@@ -42,7 +43,7 @@ commands.allow = [
   "command_set_app_config",
   "get_provisioning_config",
   "get_platform_header",
-  "set_location_mfa_method",
+  "set_location_mfa_step_plan",
   "open_tray_window",
   "open_full_view_window",
   "swap_to_tray",
diff --git a/src-tauri/proto b/src-tauri/proto
index 7e1c6a5ed..735d72260 160000
--- a/src-tauri/proto
+++ b/src-tauri/proto
@@ -1 +1 @@
-Subproject commit 7e1c6a5ed1336522bff0610edf1e216f7dcde444
+Subproject commit 735d72260ae9d73d5be8a7fe477da8ec7356a681
diff --git a/src-tauri/src/commands.rs b/src-tauri/src/commands.rs
index 0b925d16a..b580aaec3 100644
--- a/src-tauri/src/commands.rs
+++ b/src-tauri/src/commands.rs
@@ -19,7 +19,8 @@ use defguard_client_proto::defguard::client::v1::{
 };
 use defguard_client_proto::defguard::{
     client_types::{
-        AdminInfo, ClientMfaFinishRequest, ClientMfaFinishResponse, ClientMfaStartRequest,
+        mfa_step_result, AdminInfo, ClientMfaFinishRequest, ClientMfaFinishResponse,
+        ClientMfaStartRequest, ClientMfaStepStartRequest, ClientMfaStepStartResponse,
         CodeMfaSetupFinishResponse, CodeMfaSetupStartResponse, DeviceConfigResponse,
         EnrollmentSettings, InitialUserInfo, InstanceInfo as ProtoInstanceInfo, MfaMethod,
     },
@@ -42,7 +43,7 @@ use crate::{
         models::{
             connection::{ActiveConnection, Connection, ConnectionInfo},
             instance::{Instance, InstanceInfo},
-            location::{Location, LocationMfaMethod, LocationMfaMode},
+            location::{Location, LocationMfaMethod, LocationMfaMode, LocationMfaStep},
             location_stats::LocationStats,
             tunnel::{Tunnel, TunnelConnection, TunnelConnectionInfo, TunnelStats},
             wireguard_keys::WireguardKeys,
@@ -585,6 +586,8 @@ pub struct LocationInfo {
     pub location_mfa_mode: LocationMfaMode,
     pub posture_check_required: bool,
     pub mfa_method: Option<LocationMfaMethod>,
+    pub mfa_steps: Vec<LocationMfaStep>,
+    pub mfa_step_plan: Vec<LocationMfaMethod>,
 }
 
 impl LocationInfo {
@@ -639,6 +642,8 @@ pub async fn all_locations(instance_id: Id) -> Result<Vec<LocationInfo>, Error>
             location_mfa_mode: location.location_mfa_mode,
             posture_check_required: location.posture_check_required,
             mfa_method: location.mfa_method,
+            mfa_steps: location.mfa_steps.0,
+            mfa_step_plan: location.mfa_step_plan.0,
         };
         location_info.push(info);
     }
@@ -893,14 +898,14 @@ pub async fn update_location_routing(
 }
 
 #[tauri::command(async)]
-pub async fn set_location_mfa_method(
+pub async fn set_location_mfa_step_plan(
     location_id: Id,
-    mfa_method: LocationMfaMethod,
+    mfa_step_plan: Vec<LocationMfaMethod>,
     handle: AppHandle,
 ) -> Result<(), Error> {
-    debug!("Received command to set MFA method for location {location_id}");
-    Location::set_mfa_method(&DB_POOL, location_id, mfa_method).await?;
-    debug!("MFA method updated for location (ID: {location_id})");
+    debug!("Received command to set MFA step plan for location {location_id}");
+    Location::set_mfa_step_plan(&DB_POOL, location_id, mfa_step_plan).await?;
+    debug!("MFA step plan updated for location (ID: {location_id})");
     handle
         .emit(EventKey::LocationUpdate.into(), ())
         .map_err(tauri_err_to_app_err)?;
@@ -1584,10 +1589,16 @@ fn parse_mfa_method(method: &str) -> Result<MfaMethod, String> {
 pub async fn mfa_start(
     instance_id: Id,
     location_id: Id,
-    method: String,
+    methods: Vec<String>,
 ) -> Result<defguard_client_proto::defguard::client_types::ClientMfaStartResponse, String> {
     debug!("Starting MFA session for location {location_id}");
-    let method = parse_mfa_method(&method)?;
+    let step_methods = methods
+        .iter()
+        .map(|method| parse_mfa_method(method))
+        .collect::<Result<Vec<MfaMethod>, String>>()?;
+    let first_step_method = *step_methods
+        .first()
+        .ok_or_else(|| "MFA method plan is empty".to_string())?;
     let instance = Instance::find_by_id(&*DB_POOL, instance_id)
         .await
         .map_err(|e| e.to_string())?
@@ -1611,25 +1622,54 @@ pub async fn mfa_start(
     } else {
         None
     };
+    #[allow(deprecated)]
     let request = ClientMfaStartRequest {
         location_id: location.network_id,
         pubkey: keys.pubkey,
-        method: method as i32,
+        method: first_step_method as i32,
         posture_data,
+        selected_methods: step_methods
+            .iter()
+            .map(|method| *method as i32)
+            .collect::<Vec<i32>>(),
     };
     mfa::mfa_start(proxy_url, request)
         .await
         .map_err(err_to_json)
 }
 
+#[tauri::command(async)]
+pub async fn mfa_step_start(
+    instance_id: Id,
+    token: String,
+    method: String,
+) -> Result<ClientMfaStepStartResponse, String> {
+    debug!("Starting MFA step for instance {instance_id}");
+    let method = parse_mfa_method(&method)?;
+    let instance = Instance::find_by_id(&*DB_POOL, instance_id)
+        .await
+        .map_err(|e| e.to_string())?
+        .ok_or_else(|| "Instance not found".to_string())?;
+    let proxy_url =
+        Url::parse(&instance.proxy_url).map_err(|e| format!("Invalid proxy URL: {e}"))?;
+    let request = ClientMfaStepStartRequest {
+        token,
+        method: method as i32,
+    };
+    mfa::mfa_step_start(proxy_url, request)
+        .await
+        .map_err(err_to_json)
+}
+
 #[tauri::command(async)]
 pub async fn mfa_finish_code(
     instance_id: Id,
     location_id: Id,
     token: String,
     code: String,
+    step_attempt_id: Option<String>,
     handle: AppHandle,
-) -> Result<(), String> {
+) -> Result<Option<u32>, String> {
     debug!("Finishing MFA with code for instance {instance_id}");
     let instance = Instance::find_by_id(&*DB_POOL, instance_id)
         .await
@@ -1641,11 +1681,37 @@ pub async fn mfa_finish_code(
         token,
         code: Some(code),
         auth_pub_key: None,
+        step_attempt_id,
     };
     let response = mfa::mfa_finish_code(proxy_url, request)
         .await
         .map_err(err_to_json)?;
-    connect_after_mfa(location_id, response.preshared_key, &handle).await
+
+    #[allow(deprecated)]
+    let legacy_preshared_key = response.preshared_key;
+
+    match response.result.and_then(|result| result.outcome) {
+        Some(mfa_step_result::Outcome::Advanced(advanced)) => {
+            debug!(
+                "MFA step passed, advancing to step index {}",
+                advanced.next_step
+            );
+            Ok(Some(advanced.next_step))
+        }
+        Some(mfa_step_result::Outcome::Completed(completed)) => {
+            connect_after_mfa(location_id, completed.preshared_key, &handle).await?;
+            Ok(None)
+        }
+        Some(mfa_step_result::Outcome::AwaitingExternal(_)) => {
+            Err(err_to_json(mfa::MfaError::Other {
+                message: "The server returned an unexpected verification state".to_string(),
+            }))
+        }
+        None => {
+            connect_after_mfa(location_id, legacy_preshared_key, &handle).await?;
+            Ok(None)
+        }
+    }
 }
 
 /// Register a long-running MFA task, run its future in the background, and on
@@ -1688,7 +1754,9 @@ where
         match result {
             Ok(response) => {
                 info!("MFA completed for task {task_id_for_task}");
-                match connect_after_mfa(location_id, response.preshared_key, &listen_handle).await {
+                #[allow(deprecated)]
+                let preshared_key = response.preshared_key;
+                match connect_after_mfa(location_id, preshared_key, &listen_handle).await {
                     Ok(()) => {
                         let _ = listen_handle.emit(complete_event.into(), ());
                     }
diff --git a/src-tauri/src/gui.rs b/src-tauri/src/gui.rs
index 9551ca1b6..8eaac64ed 100644
--- a/src-tauri/src/gui.rs
+++ b/src-tauri/src/gui.rs
@@ -194,7 +194,7 @@ pub fn run_app() {
             get_provisioning_config,
             get_platform_header,
             get_posture_data,
-            set_location_mfa_method,
+            set_location_mfa_step_plan,
             open_tray_window,
             open_full_view_window,
             swap_to_tray,
@@ -211,6 +211,7 @@ pub fn run_app() {
             enrollment_network_info,
             enrollment_finish,
             mfa_start,
+            mfa_step_start,
             mfa_finish_code,
             mfa_poll_openid,
             mfa_connect_mobile_approve,
diff --git a/src-tauri/tauri.conf.json b/src-tauri/tauri.conf.json
index fde6c1b24..998aa3c1c 100644
--- a/src-tauri/tauri.conf.json
+++ b/src-tauri/tauri.conf.json
@@ -67,7 +67,7 @@
   "productName": "Defguard",
   "mainBinaryName": "defguard-client",
   "identifier": "net.defguard",
-  "version": "2.1.0",
+  "version": "2.2.0",
   "app": {
     "security": {
       "capabilities": ["main-capability"],