You are tasked with creating a ThousandEyes transaction test to monitor the login process of a web application that uses SAML-based SSO with MFA. The…

ThousandEyes synthetic tests cannot interact with external, dynamic, time-based one-time password (TOTP) generators like a mobile app. Attempting to automate this step is infeasible and unreliable. The industry-standard best practice for monitoring applications with MFA is to create a dedicated test user account for which MFA is disabled. Alternatively, access can be controlled by whitelisting the IP addresses of the ThousandEyes agents, allowing them to bypass the MFA challenge. This allows the test to focus on application performance without being blocked by an un-automatable security step.

A. The ThousandEyes agent has no mechanism to interface with a user's mobile app to retrieve a dynamically generated OTP. This is technically not possible.

B. OTPs are short-lived (typically 30-60 seconds). Manually updating the test configuration for every test run is impractical for automated monitoring.

C. Webhooks in ThousandEyes are for sending notifications out from the platform, not for pulling real-time data like an OTP into a running test script.

1. Cisco ThousandEyes Documentation, "Working with Transaction Tests," Section: "Authentication". The documentation notes that for complex authentication like MFA/2FA, "the recommended approach is to disable multi-factor authentication for the test user account, or to whitelist the IP addresses of the ThousandEyes agents assigned to the test."

2. Cisco ThousandEyes Documentation, "Transaction Scripting Reference". This reference guide for creating transaction scripts does not include any commands or functions for handling dynamic OTPs, highlighting the limitation.