diff --git a/common/client_types.proto b/common/client_types.proto
index 06d98c1..790e31d 100644
--- a/common/client_types.proto
+++ b/common/client_types.proto
@@ -394,6 +394,37 @@ message CodeMfaSetupFinishResponse {
   repeated string recovery_codes = 1;
 }
 
+// [2.2] MFA factor configuration for an enrolled device.
+// Authenticate with the device's polling token and public key.
+message MfaConfigStartRequest {
+  string token = 1;
+  string pubkey = 2;
+}
+
+message MfaConfigStartResponse {
+  string session_token = 1;
+  repeated MfaMethod available_methods = 2;
+  // True when no factor is configured and an email code is the only authorization method.
+  bool email_fallback = 3;
+  int64 deadline_timestamp = 4;
+}
+
+message MfaConfigSendCodeRequest {
+  string session_token = 1;
+}
+
+message MfaConfigSendCodeResponse {}
+
+message MfaConfigAuthorizeRequest {
+  string session_token = 1;
+  MfaMethod method = 2;
+  string code = 3;
+}
+
+message MfaConfigAuthorizeResponse {
+  int64 deadline_timestamp = 1;
+}
+
 // External OIDC authentication flow
 enum AuthFlowType {
   AUTH_FLOW_TYPE_UNSPECIFIED = 0;
diff --git a/v2/proxy.proto b/v2/proxy.proto
index c6a3e9b..c9e4743 100644
--- a/v2/proxy.proto
+++ b/v2/proxy.proto
@@ -117,6 +117,9 @@ message CoreResponse {
     defguard.enterprise.posture.v2.DevicePostureRejection device_posture_rejected = 20;
     PublicSettings public_settings = 21;
     defguard.client_types.ClientMfaStepStartResponse client_mfa_step_start = 22;
+    defguard.client_types.MfaConfigStartResponse mfa_config_start = 23;
+    defguard.client_types.MfaConfigAuthorizeResponse mfa_config_authorize = 24;
+    defguard.client_types.MfaConfigSendCodeResponse mfa_config_send_code = 25;
   }
 }
 
@@ -216,6 +219,9 @@ message CoreRequest {
     AcmeCertificate acme_certificate = 21;
     defguard.enterprise.posture.v2.DevicePostureCheckRequest device_posture_check = 22;
     defguard.client_types.ClientMfaStepStartRequest client_mfa_step_start = 23;
+    defguard.client_types.MfaConfigStartRequest mfa_config_start = 24;
+    defguard.client_types.MfaConfigAuthorizeRequest mfa_config_authorize = 25;
+    defguard.client_types.MfaConfigSendCodeRequest mfa_config_send_code = 26;
   }
 }