The test process will allow you to test the UI changes introduced to MFA by this patch. Prerequisites To test this issue you'll need a Moodle that you have admin access to, can update code on and that is capable of sending emails. You will also need a webauthn compatible token such as a Yubikey, and you will need a mobile device with an authenticator app like "google authenticator" Having an admin account makes it easier to move through all of the test settings. If you don't have cli access to the instance make sure you have access to two separate admin accounts. As part of the testing will lock out a user. Setup More detailed setup instructions for MFA testing can be found in MDL-78509 , the following setup are just the basics and there is some assumed knowledge. Apply the patch and upgrade Log into the site as an admin Navigate to: Site administration > plugins > administration tools > Multi-factor authentication In the factor table enable the following factors in this order (this will help with testing), all factor defaults can be left as they are: E-mail factor Authenticator app Security key Scroll down to "General MFA Settings" Enable the "MFA plugin enabled" Checkbox Set the "Lock out threshold" to 3 In the "Urls which should not redirect the MFA check" text area enter "/user/contactsitesupport.php" Click save changes Navigate to: Site administration > Server > Support contact Set a "support name" Set a "support email" address Ensure "contact site support link" is empty Set the "Support availability" to "Limited to authenticated users" Click save changes While still logged in as an admin, click on the users profile picture from the top nav bar. Click "preferences" Under "User account" click on "Multi-factor authentication" Click "Setup App" and follow the instructions to set up your TOTP authenticator app factor Click "Setup authenticator" to set up your authenticator key, yubikey etc. Log out the administrator user First set of tests Enter the username and password and click login for the admin user you set up the factors for On the 2-step verification page check that the obfuscated email address has the correct start and end character and domain as the email address for your admin account Enter the code from the email that is sent to that address Confirm that upon entering the last digit of the emailed code correctly, the form auto submits. Confirm you are logged in correctly Log out   Enter the username and password and click login for the admin user you set up the factors for On the 2-step verification page click "cancel login" Confirm you are returned to the manual login page without errors shown   Enter the username and password and click login for the admin user you set up the factors for On the 2-step verification page click the contact site support link at the bottom of the page Confirm you are sent to the site contact form in Moodle Click Cancel Confirm you are returned to the 2 step verification page.   On the 2-step verification page, under "Try another way to verify" click "Use authenticator application" Confirm the page reloads and that the verification option is now "Verify it's you by mobile app" Enter the code from your configured mobile app authenticator Confirm that upon entering the last digit of the code correctly, the form auto submits. Confirm you are logged in correctly Log out   Enter the username and password and click login for the admin user you set up the factors for On the 2-step verification page, under "Try another way to verify" click "Use authenticator token" Confirm the page reloads and that the verification option is now "Verify it's you by authenticator token" Click the continue button Confirm you are prompted to use your security key Upon touching your token, confirm you are logged in correctly. Log out Enter the username and password and click login for the admin user you set up the factors for On the 2-step verification page check that the obfuscated email address has the correct start and end character and domain as the email address for your admin account Enter an an incorrect code Confirm you are not logged in and the following form error is displayed "Wrong code. Try again. You have 2 attempts left. " Enter in the wrong code 2 more times Confirm that the form is now locked and you cannot enter/change the code, and the continue button is disabled Under "Try another way to verify" click "Use authenticator application" Confirm the page reloads and that the verification option is now "Verify it's you by mobile app" Confirm under  "Try another way to verify" that the option "Have a code emailed to you" is disabled and has the text "(Unavailable) appended to it Enter an an incorrect code Confirm you are not logged in and the following form error is displayed "Wrong code. Try again. You have 2 attempts left. " Enter in the wrong code 2 more times Confirm that the form is now locked and you cannot enter/change the code, and the continue button is disabled Under "Try another way to verify" click "Use authenticator token" Confirm the page reloads and that the verification option is now "Verify it's you by authenticator token" Click the continue button Interact with your security token Confirm you're logged in. Settings update While logged in as an admin Navigate to: Site administration > plugins > administration tools > Multi-factor authentication Click the checkbox for "Use guidance page" to enable it Add some test content to the "Guidance page content" text area. For example: "This is some test guidance page content" Click save changes Log out as admin Second set of tests Enter the username and password and click login for the admin user you set up the factors for On the 2-step verification page click the "MFA user guide" link at the bottom of the page Confirm you can see the test guidance page content you entered previously Click "Home" from the top navigation bar. Confirm you are returned to the 2 step verification page. Log in using one of the enabled factors Settings update While logged in as an admin Navigate to: Site administration > plugins > administration tools > Multi-factor authentication Disable the "email" and "security key factors" Log out as admin Third set of tests Enter the username and password and click login for the admin user you set up the factors for Confirm that the only option to complete is "Verify it's you by mobile app Enter the wrong code 3 times Confirm that you are presented with the "Unable to authenticate" error. Click the "log out" button   Enter the username and password and click login for the admin user you set up the factors for Confirm that you are presented with the "Unable to authenticate" error. Click the "log out" button (you will now need to reset the factor for that user OR disable the MFA plugin)   NOTE : If you mess things up and locked yourself out, you can disable the whole MFA plugin from the CLI : php admin/cli/cfg.php --component=tool_mfa --name=enabled --set=0