> For the complete documentation index, see [llms.txt](https://docs.cw.crisisworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cw.crisisworks.com/system-administration/user-and-contact-administration/mfa-for-system-administrators.md). # MFA for System Administrators Managing multi-factor authentication as a system administrator ## Overview Multi-factor authentication (MFA) provides an additional layer of security when users sign in. As a system administrator, you can: * Help new users enrol in MFA * Reset MFA when a user cannot access their registered method * Generate a temporary code for users who cannot begin enrolment * Check and filter users by their MFA status {% hint style="danger" %} **Important:** Resetting MFA affects account security. Always verify the user’s identity using your organisation’s approved process before resetting MFA or providing a temporary code. {% endhint %} ## Positions The following [positions](https://docs.cw.crisisworks.com/concepts-and-fundamentals/concepts-and-fundamentals#events-users-positions-and-duty) can MFA features with default security policies: * System Admin - User Management * System Admin & Data Entry ### How new users set up MFA When you create a contact and enable a user account, a welcome email is sent to the user. The user will: 1. Open the link in the welcome email. 2. Create a password. 3. Request and enter the verification code. 4. Sign in with their new password. 5. Follow the prompts to secure their account with MFA. The user can register: * An authenticator app * A mobile number to receive SMS verification codes We recommend registering both methods where possible. This gives the user a backup if one method becomes unavailable. A **Skip for now** option may appear during initial sign-in which allows for an initial 24 hour grace period before. The user must enable MFA after this time. ### Reset MFA for a user System Administrators can **Reset MFA** when a user has lost, replaced or can no longer access the device registered for MFA. To reset MFA: 1. Verify the user’s identity using your organisation’s approved process. 2. Sign in as a system administrator for the user’s primary site. 3. Open the user’s record. 4. Select **Reset MFA**. 5. Review the warning and confirm the reset only when you are satisfied that the request is genuine. 6. Provide the generated temporary reset code to the verified user. The temporary code expires after the period displayed on screen. Ask the user to use it within that time. > **Note:** Resetting MFA does not change the user’s password. The user must then: 1. Sign in with their existing username and password. 2. Enter the temporary reset code when prompted. 3. Register a new MFA method. 4. Complete the verification steps and save the new method. ### Help a user who has not enrolled in MFA A user may be unable to sign in if: * They had not enrolled in MFA before it became mandatory; and * Their contact record did not contain a mobile number. The user will be instructed to contact the system administrator at their primary site for a code. To help the user follow the process to [Reset MFA](#reset-mfa-for-a-user). ### Check a user’s MFA status You can view MFA information from the Contact datagrid. 1. Open the Contacts register. 2. Open the column selector. 3. Add the **MFA status** and **Primary site** columns. These columns show whether each user has completed MFA enrolment and identifies the user’s primary site. These fields are also searchable from the 'Additional filters' selector accessible from the search screen. ### Find users with CQL You can also use CQL to search for users according to their MFA status. **Users with MFA enabled (replace 'YourSiteName' with your domain name)** ``` isUser:true is:active authPrimarySite:YourSiteName authMfa:set ``` **Users who have not completed MFA enrolment (replace 'YourSiteName' with your domain name)** ``` isUser:true is:active authPrimarySite:YourSiteName authMfa:unset ``` ### Security guidance When supporting an MFA reset: * Always verify the user’s identity first. * Only administrators for the user’s primary site can complete the reset. * Share temporary codes using an approved secure method. * Never send a temporary code to an unverified recipient. * Ask the user to use the code before the displayed expiry time. * Remind the user that an MFA reset does not change their password. * Encourage the user to register both SMS and an authenticator app. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.cw.crisisworks.com/system-administration/user-and-contact-administration/mfa-for-system-administrators.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.