Multifactor Authentication

Multifactor Authentication (MFA)

The purpose of using MFA is it adds another method of verification, increasing security. Users will need to input a code well as their username and password when trying to login to a service.

For school's wishing to use Multifactor Authentication and are not getting a prompt for a code, lodge a ticket at support website requesting for Multifactor to be enabled.

Activating MFA

1. Login to dashboard
2. Navigate to Users
3. Either select a user or create a new user
4. Navigate to Recovery Details and click Edit
5. Add a valid phone number into Recovery Phone field
6. Click submit
7. Navigate to Security and click Turn On
8. Click yes,enable Multifactor

Notes

• To be done as an administrator

Set MFA with an Authenticator App with QR code

By using an Authenticator App instead on SMS will allow users to log in if there is no reception for their phone to retrieve code via SMS

1. Go to your school's Cloudwork.ID (looks like https://<schoolname>-id.cloudworkengine.net)
2. Navigate to the top right of the site where your name is
3. Click Settings
4. In Mulftifactor Authentication click Add Authenticator App
5. Using Google Authenticator click on the bottom right, the plus sign
6. Click Scan a QR code
7. Point the camera to the QR code so the red lines line up with the QR code on your school's Cloudwork.ID
8. Input code that is shown on Google Authenticator, to your school's Cloudwork.ID

Notes

• To be done as an individual user
• Users do not need to use Google Authenticator App, there are other apps such as Microsoft Authenticator and Authy 2-Factor Authentication

Set MFA with an Authenticator App with setup key

By using an Authenticator App instead on SMS will allow users to log in if there is no reception for their phone to retrieve code via SMS

1. Go to your school's Cloudwork.ID (looks like https://<schoolname>-id.cloudworkengine.net)
2. Navigate to the top right of the site where your name is
3. Click Settings
4. In Mulftifactor Authentication click Add Authenticator App
5. Next to Camera not working? click here and click show. This will reveal setup key.
6. Using Google Authenticator click on the bottom right, the plus sign
7. Click Enter a setup key
8. Enter the setup key into Google Authenticator
9. Input code that is shown on Google Authenticator, to your school's Cloudwork.ID

Notes

• To be done as an individual user
• Users do not need to use Google Authenticator App, there are other apps such as Microsoft Authenticator and Authy 2-Factor Authentication

Set MFA with SMS

Setting MFA using SMS, will have a one-time code be sent to the user's phone which will allow the user access through MFA

1. Go to your school's Cloudwork.ID (looks like https://<schoolname>-id.cloudworkengine.net)
2. Navigate to the top right of the site where your name is
3. Click Settings
4. In Mulftifactor Authentication click Add a phone
5. Input your phone number
6. Wait for an SMS to come through from Cloudwork
7. On the SMS is a code, input the code onto the Cloudwork.ID page

Notes

• To be done as an individual user

Enabling MFA Whitelist

Using MFA Whitelist for your school's Ip address range will allow users logging in, inside the school to not have to go through MFA. But logging in outside school will have the user go through MFA

1. Login into your school's dashboard
2. Click the menu bar>settings>CloudworkID Settings
   
3. Navigate to Features and click Edit
4. Navigate to Multifactor Authentication Whitelist
5. Enter into the field your school's Ip address or Ip address range

Notes

• To be done as an administrator

MFA for SSO

SSO Services can be set to only allow users to log in if they have MFA enabled.

1. Login to your school's dashboard
2. Navigate to SSO > "Service of choice" > SAML Config Settings > Edit
3. Select the option you want from the Multifactor Authentication dropdown box

Trusted device

As a feature of Multifactor, Users have the option when logging in to select I trust this device, don't ask again. This means for the next 30 days the user will not have to use a code for MFA.

Disabling Trust Device

This feature can disable any user from having the option to trust a device.

1. Login into your school's dashboard
2. Click the menu bar>settings>CloudworkID Settings
   
3. Navigate to Features and click Edit
4. Navigate to Enable Trusted Devices
5. Select the option Do not let users trust device

Enabling users to Manage MFA

This features allows users manage their own MFA setting such as adding their own phone number or app for MFA.

1. Login into your school's dashboard
2. Click the menu bar>settings>CloudworkID Settings
   
3. Navigate to Features and click Edit
4. Under Multifactor Authentication, select from the drop down Users can manage multifactor authentication

Allow users to disable MFA

This feature allows users to Turn MFA off for themselves.

1. Login into your school's dashboard
2. Click the menu bar>settings>CloudworkID Settings
   
3. Navigate to Features and click Edit
4. Under Disable Multifactor, select from the drop down Users can disable multifactor authentication

MFA without storing a mobile phone number

1. login to the CloudworkID service
2. Select Update Recovery Settings
3. Supply a valid mobile phone number and click Submit
4. Enter the verification code and click Submit
5. Click Turn on underneath MFA
6. Enter the verification code and click Submit
7. Click Add Authenticator App
8. On your phone, scan the QR code. Then enter the verification code and click Submit
9. Click the trash icon next to Text Message to .....
10. Click Delete to confirm
11. Click Update recovery settings
12. Clear the form field for Recovery Phone and click submit

The user now has MFA operating, without having their personal mobile tied to their account.

Enable MFA for users as an admin

Enable MFA for SMS via admin

1. Login as an admin to the Cloudwork Dashboard
2. Navigate to Users and click intended user
3. Under Security click Enable SMS
4. If a recovery phone number is not set, one will need to be entered
5. If a recovery phone number is already entered MFA for SMS will be activated

Enable MFA for Authenticator App via admin by scanning QR code

By enabling MFA for Authenticator App via admin, users can have MFA operating, without having their personal mobile tied to their account.

1. Login as an admin to the Cloudwork Dashboard
2. Navigate to Users and click intended user
3. Under Security click Enable App
4. Open up the Authenticator App and scan the QR code
5. Enter the code and MFA for Authenticator App will be activated

Enable MFA for Authenticator App via admin by entering setup key

By enabling MFA for Authenticator App via admin, users can have MFA operating, without having their personal mobile tied to their account. If the personal mobile the user has does not have a working camera a setup key can be inputted instead.

1. Login as an admin to the Cloudwork Dashboard
2. Navigate to Users and click intended user
3. Under Security click Enable App
4. Next to Camera not working? click here Click the show to reveal secret key.
5. Open up the Authenticator App and enter the setup key
6. Enter the code and MFA for Authenticator App will be activate

Turn off MFA via admin

This will turn off MFA via SMS and MFA via App.

1. Login as an admin to the Cloudwork Dashboard
2. Navigate to Users and click intended user
3. Under Security click Turn Off

Notes

• To be done as an administrator

Forcing certain organisation units to use MFA

This setting change can force certain organisational units to use MFA while all other users do not needs to use MFA
How this works is that once the setting is enabled, any user who does not have MFA enabled, will not be allowed to access any service until MFA is turned on.
When users without MFA enabled try to access any service, they will be shown a screen similar to this

Clicking on Click here to enable Mutlifactor Authentication will take users to the CloudworkID Page where they can enabled MFA.
From here users can enable MFA via App with QR Code, App with Setup Key or, SMS

1. Login as an admin to the Cloudwork Dashboard
2. Click the side bar and click settings>Cloudwork.ID Settings
3. On the left side of the screen there are all the org units, select the intended org unit
4. Under feature Click Override Settings then click submit
5. Under Users must enable MFA select yes
6. Click submit

Notes

• To be done as administrator
• When clicking Override Settings, changes to the parent org unit will not affect the children org units.

Advice

• We strongly advise people travelling overseas to use an authenticator app to avoid any issues with SMS delivery.