MFA for System Administrators

Managing multi-factor authentication as a system administrator

Overview

Multi-factor authentication (MFA) provides an additional layer of security when users sign in. As a system administrator, you can:

• Help new users enrol in MFA

• Reset MFA when a user cannot access their registered method

• Generate a temporary code for users who cannot begin enrolment

• Check and filter users by their MFA status

Important: Resetting MFA affects account security. Always verify the user’s identity using your organisation’s approved process before resetting MFA or providing a temporary code.

Positions

The following positions can MFA features with default security policies:

• System Admin - User Management

• System Admin & Data Entry

How new users set up MFA

When you create a contact and enable a user account, a welcome email is sent to the user.

The user will:

1. Open the link in the welcome email.

2. Create a password.

3. Request and enter the verification code.

4. Sign in with their new password.

5. Follow the prompts to secure their account with MFA.

The user can register:

• An authenticator app

• A mobile number to receive SMS verification codes

We recommend registering both methods where possible. This gives the user a backup if one method becomes unavailable.

A Skip for now option may appear during initial sign-in which allows for an initial 24 hour grace period before. The user must enable MFA after this time.

Reset MFA for a user

System Administrators can Reset MFA when a user has lost, replaced or can no longer access the device registered for MFA.

To reset MFA:

1. Verify the user’s identity using your organisation’s approved process.

2. Sign in as a system administrator for the user’s primary site.

3. Open the user’s record.

4. Select Reset MFA.

5. Review the warning and confirm the reset only when you are satisfied that the request is genuine.

6. Provide the generated temporary reset code to the verified user.

The temporary code expires after the period displayed on screen. Ask the user to use it within that time.

Note: Resetting MFA does not change the user’s password.

The user must then:

1. Sign in with their existing username and password.

2. Enter the temporary reset code when prompted.

3. Register a new MFA method.

4. Complete the verification steps and save the new method.

Help a user who has not enrolled in MFA

A user may be unable to sign in if:

• They had not enrolled in MFA before it became mandatory; and

• Their contact record did not contain a mobile number.

The user will be instructed to contact the system administrator at their primary site for a code.

To help the user follow the process to Reset MFA.

Check a user’s MFA status

You can view MFA information from the Contact datagrid.

1. Open the Contacts register.

2. Open the column selector.

3. Add the MFA status and Primary site columns.

These columns show whether each user has completed MFA enrolment and identifies the user’s primary site.

These fields are also searchable from the 'Additional filters' selector accessible from the search screen.

Find users with CQL

You can also use CQL to search for users according to their MFA status.

Users with MFA enabled (replace 'YourSiteName' with your domain name)

isUser:true is:active authPrimarySite:YourSiteName authMfa:set

Users who have not completed MFA enrolment (replace 'YourSiteName' with your domain name)

isUser:true is:active authPrimarySite:YourSiteName authMfa:unset

Security guidance

When supporting an MFA reset:

• Always verify the user’s identity first.

• Only administrators for the user’s primary site can complete the reset.

• Share temporary codes using an approved secure method.

• Never send a temporary code to an unverified recipient.

• Ask the user to use the code before the displayed expiry time.

• Remind the user that an MFA reset does not change their password.

• Encourage the user to register both SMS and an authenticator app.