This is the step the whole upgrade exists for. A password can leak in a dozen quiet ways; a code that lives on one person's phone and changes every thirty seconds cannot be emailed, guessed or reused. Enrolling it takes two minutes per user.
In the video, MFA is switched on per account: select the user, use the Add MFA client configuration option, Save, then open the configuration again to get the MFA key or QR code for that user. The user scans it with an authenticator app, and enrolment is done. This page walks through that flow with the details the short video cannot stop for - how to run the enrolment session, what to do when a phone is replaced, and the honest boundaries of what a one time code protects.
Do MFA enrolment with the user and their phone in front of you, one person at a time. Open their account, add the MFA client configuration, save, and bring up the QR code. They scan it with their authenticator app - Google Authenticator, Microsoft Authenticator, or any standard TOTP app; the entry appears with a six digit code that refreshes every 30 seconds. Immediately have them make a test connection and type the code. An enrolment that has not been tested is a lockout scheduled for the worst possible morning.
The QR code and the typed key behind it are the same secret in two costumes. Anyone who photographs that screen owns the second factor for that account, forever, silently. So: never enrol over a screen share recording, never send the QR by WhatsApp "to save time", never store screenshots of enrolment screens in the IT folder. If a secret is ever exposed - a photo surfaces, a phone is lost before enrolment finished - delete the MFA configuration for that user and generate a fresh one. Regenerating is free; a copied factor is forever.
Connection flow after enrolment, as the video verifies: the user opens the OpenVPN client with their config, enters username and password, and is then asked for the one time code. They read the current code from the authenticator app and type it. Three independent things had to be right: a file, a secret they know, and a device they hold. Warn users about the 30 second window - a code typed as it expires simply fails once; wait for the next one instead of retrying the same digits.
Phones get replaced more often than passwords get changed, so decide the procedure now: the user tells you, you open their account, remove the old MFA configuration and add a new one, and they enrol the new phone in person - after you have confirmed it is really them, ideally face to face or on a known number. Until then they cannot connect, and that short inconvenience is the system working as designed. Never "temporarily" switch MFA off for an account because a phone died; that temporary state is precisely what an attacker would ask for.
TOTP codes are maths on the current time, so a phone whose clock is badly wrong produces codes the server rejects. If one user's codes always fail while others work, check the phone's date and time is set automatically before touching the server. Also expect the occasional failure at the boundary between two codes. Build user patience for one retry; build your own patience for checking the simple cause first - in practice it is the phone clock, a mistyped digit, or an enrolment done against the wrong user account.
Adding the MFA client configuration, generating the QR code and the successful first login - the full sequence on screen.
▶️ Watch Full VideoAny standard TOTP app works - Google Authenticator and Microsoft Authenticator are the common choices. The video's flow only needs the app to scan the QR code and show a six digit code that changes every 30 seconds.
Remove the MFA configuration from their account on the server and add a fresh one, then enrol the new phone in person and test a connection before they leave. The old phone's codes stop working the moment the new configuration replaces it.
Do not. The QR code is the secret itself; a forwarded image can be copied endlessly and silently. Enrol with the user present, or accept a short delay until you can. If a QR was ever sent around, regenerate that user's MFA configuration.