This guide covers the Multi-Factor Authentication (MFA) feature in NowSignage, enhancing account security. It explains how to enable MFA, use it, and provides troubleshooting tips to ensure a smooth experience.
Table of Contents: (click to scroll to a specific section)
WARNING:
Do not activate this setting unless you intend to configure MFA. If you turn it on and then off during testing, MFA will still be activated on the account.
Enabling MFA for Standard Users:
If you are a standard user (not an account owner) and need to enable Multi-Factor Authentication (MFA) on your NowSignage account, follow these steps:
1.Log in to your NowSignage account
2.Access Your Account Settings
•Click on your profile icon in the top-right corner.
•Select “My Details” from the dropdown menu.
3.Enable MFA
•Navigate to the Security section.
•Locate the Multi-Factor Authentication (MFA) option.
•Click “Enable MFA” and follow the on-screen instructions.
4.Set Up an Authentication Method
- A QR code will be displayed, which users can scan with a compatible authenticator app, such as Google Authenticator, Microsoft Authenticator, Or Authy.
- Alternatively, users have the option to manually input the provided setup key into their authenticator app.
- The app will generate a one-time passcode (OTP), which must be entered to complete the setup.
- Once configured, MFA will be required for all future logins.
If you need to disable this in the future, please click 'disable MFA' in the 'security' area of your account:
Enforcing MFA for All Users (Account Owners Only)
Caution: Access to the MFA settings is restricted to Account Owners only. Users with roles below 'Account Owner' do not have the necessary permissions to modify these settings.
Steps to Implement (6):
- Log in to your NowSignage account using your username and password.
- Click on your profile icon in the top-right corner of the screen.
- Select My Account from the dropdown menu.
- In the top menu bar, navigate to Users and Roles.
- Select MFA Configuration.
6. Click Enable MFA.
User Experience After Enabling MFA:
Once MFA is enabled, users will experience one of the following two scenarios when logging in:
Scenario 1: First-Time Setup After MFA is Enabled:
- Upon their next login into the NowSignage CMS, users will be prompted to set up MFA using an authenticator app.
- A QR code will be displayed, which users can scan with a compatible authenticator app, such as Google Authenticator, Microsoft Authenticator, Or Authy.
- Alternatively, users have the option to manually input the provided setup key into their authenticator app.
- The app will generate a one-time passcode (OTP), which must be entered to complete the setup.
- Once configured, MFA will be required for all future logins.
Scenario 2: MFA Enabled While User is Logged In:
- If an Account Owner enables MFA while a user is currently logged into NowSignage, the user will be automatically taken to the MFA setup page.
- The user cannot continue using the CMS until they have successfully set up MFA.
- The process for setting up MFA remains the same as scenario 1 —scanning the QR code or manually entering the setup key into an authenticator app. This will also require the user to confirm their current password.
- Once the setup is complete, they will regain full access to the platform.
Disabling MFA as a Mandatory Requirement for All Users (Account Owners Only):
If you need to disable MFA as a mandatory requirement for all users in your account, follow these steps:
1.Log into NowSignage using your account credentials as an 'Account Owner'.
2.Go to “My Account” in the top navigation bar.
3.Select “Users and Roles” and then click on “MFA Configuration”.
4.Disable MFA – If MFA is enabled, you will see an option to disable it. Click the disable button to turn it off.
5.MFA will now be disabled for all users on the account unless re-enabled.
Important: If you disable MFA as a mandatory requirement for all users, any users who have already set up MFA will need to also disable this within their account security settings.
How to Exclude Specific Users from MFA (Optional):
To exclude a user from Multi-Factor Authentication (MFA):
1.Navigate to the MFA Configuration settings.
2.Click on the Manage button under the “Exclude specific users from Multi-Factor Authentication” section.
3.A list of users in your account will be displayed. You can use the search bar to find a specific user.
4.Next to each user, there is a lock icon. Click on the lock to toggle between locked (MFA required) and unlocked (MFA not required).
5.Once the icon shows an unlocked padlock, the user will no longer be required to use MFA when signing in.
FAQs:
1. What authenticator apps can be used?
You can use any of the following authenticator apps to set up MFA:
•Google Authenticator (Android/iOS)
•Microsoft Authenticator (Android/iOS)
•Authy (Android/iOS/Desktop)
•1Password (Built-in OTP feature)
•LastPass Authenticator
2. How do I get access if I lose my MFA method?
If you lose access to your MFA method (e.g., lost phone or deleted authenticator app), follow these steps:
1.Use a backup code – When you first set up MFA, you are prompted to save backup codes. If you have these saved, enter one of the codes to regain access.
2.Contact your account administrator – If you don’t have a backup code, your administrator can reset your MFA settings.
3.Reach out to NowSignage support – If you are the account owner and cannot regain access, contact NowSignage support for further assistance.
3. Why Can’t I Enable MFA if SSO is Enabled on My Account?
When Single Sign-On (SSO) is enabled for your NowSignage account, it takes over the authentication process, including any security features like Multi-Factor Authentication (MFA). SSO providers typically offer their own built-in MFA options, which means that MFA is already being handled externally by the SSO system.
Because the SSO service is responsible for securing the login process, there is no need for NowSignage’s MFA to be enabled as well. Enabling MFA in NowSignage would create redundancy in security measures, and for this reason, MFA cannot be activated while SSO is active on the account.
If you wish to use NowSignage’s MFA, you would need to disable SSO first. However, if you’re using SSO, it’s recommended to rely on the MFA features provided by your SSO provider for optimal security.