Windward Software Wiki

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
===== Introduction =====

We are deploying a **multi-factor authentication** (MFA) and self-service password reset solution for all System Five on Cloud customers.

=== What is this? ===

MFA is a system that combines //something you know// (your password), with //something you have// (an authentication device, normally your phone). This means that to compromise your account, an attacker would need both of these things, dramatically increasing the barrier of entry.

=== Why are we implementing this? ===

MFA is an important line of defense against unauthorized access to our systems. If a hacker manages to obtain your password through a [[https://en.wikipedia.org/wiki/Phishing|phishing attack]], they will have to also answer a multi-factor authentication challenge, which they almost certainly couldn't do.

As a bonus, this added level of security allows us to offer the ability to reset your own password (provided you have access to your second factor) without contacting Support.

=== What do I need? ===

If you have access to a smartphone where you normally use System Five on Cloud, [[https://www.microsoft.com/en-us/account/authenticator|Microsoft Authenticator]] is the best way to get access.

Alternatively, for those who don't have access to or prefer not to use their smartphone, we also offer the ability to send authentication codes by email.

===== Managing MFA =====
==== First-time setup ====

To enroll for MFA, on any computer, go to 
  * North American users: [[http://na.windwardoncloud.com]]
  * Australian users: [[http://au.windwardoncloud.com]]


=== Microsoft Authenticator ===
If you have not already installed Microsoft Authenticator on your phone, install them from here:
**iPhone:**[[https://apps.apple.com/app/microsoft-authenticator/id983156458]]
**Android:**[[https://play.google.com/store/apps/details?id=com.azure.authenticator]]

  - Log in with your username and password.
  - Choose **Microsoft Authenticator** when prompted to add Microsoft Authenticator to your account.
  - Open Microsoft Authenticator on your phone.
  - Choose the plus button in the top right.
  - Tap **Other (Google, Facebook, etc.)**
  - Scan the QR code on your computer screen.
  - On the next page, enter the code below the entry //yourusername@NA// or //yourusername@AU//. You may need to scroll down to see it.
  - Click Confirm, and you are enrolled!
  - [[#Generating Backup Codes|Generate backup codes]] to ensure you can still log in in case you lose your device.

=== Email ===

  - Log in with your username and password.
  - Choose **Email Verification** when prompted.
  - Enter your email address and click **Send Code**
<note important>Ensure noreply@windwardsoftware.com is whitelisted in your spam filter to ensure you receive codes.</note>
  - Enter the code sent in the email.
  - Click **Verify Code**, and you are enrolled!
  - [[#Generating Backup Codes|Generate backup codes]] to ensure you can still log in in case you lose your device.

==== Generating Backup Codes ====
We recommend you generate backup codes for your account. In the event you lose your authenticator, you can use a backup code to log in and change your authenticator. To do this:

  - Log in to [[http://na.windwardoncloud.com|NA]] or [[http://au.windwardoncloud.com|AU]].
  - Enter the code on your authenticator.
  - Under **MFA Recovery**, choose //Generate One-Time Use Backup Verification Codes//.
  - Copy these codes to a safe place.
<note important>We recommend using a password manager to securely store these codes. Be sure not to keep them on the same device you use as an authenticator!</note>

==== Logging in ====
Once you are enrolled in MFA, when you log into an MFA-enabled machine, you will be presented with a window similar to this:
{{:employee:mfa_screen.png?400|}}

Check your email or smartphone app for your 6-digit code and enter it in the box.

{{mfa_code.jpg?400|}}

Enter the 6-digit code displayed underneath and click Continue. Your login will proceed.

==== Resetting your password ====
One benefit to having MFA enabled is you can reset your own password without contacting support. To do so:

  - Go to [[http://na.windwardoncloud.com|NA]] or [[http://au.windwardoncloud.com|AU]].
  - Click "Forgot your password?"
  - Enter your username and the CAPTCHA.
  - Enter the code from your authenticator or email.
  - Enter your new password and the CAPTCHA and click Reset Password.
<note tip>This will also unlock your account if it is locked out.</note>

==== Changing your Authenticator ====
If you need to change which device has your authenticator code, or which email address codes are sent to, you can change that like so:

   - Log in using your username and password. 
   - Enter the code from your authenticator (if possible) or click //Use Backup Code// if you do not.
   - If you are using Microsoft Authenticator:
     - {{:mfa-pencil.jpg?800|}}
     - Click the pencil icon under Microsoft Authenticator 
     - Choose //Change Phone//.
     - Follow the instructions on your new phone.
     - Your new phone is now your active authenticator.
   - If you are using email:
     - Click **Add Email** under email verification
     - Add the new email address and click **Send Code**
     - Enter the code your received to your new email address. Be sure to check your spam.
     - If you no longer have access or wish to receive notifications to your old email address:
       - Click the pencil beside the old email address
       - Choose **Remove Email**.

===== Troubleshooting/FAQ =====
==== I receive "Your account is not enrolled for Multi-Factor Authentication" and cannot log in. ====
If you are receiving this message:

{{mfa_not_enrolled.png?400|}}

then MFA has been enforced on your account but you have not yet set up the service. Please follow the instructions under [[#First-time setup|First-time setup]] to enable login.

==== I've lost access to my authenticator. What do I do? ====
Follow the instructions under [[#Changing your Authenticator]] if you have access to your backup codes. If you don't have backup codes, contact support.

==== I've forgotten my password/My account is locked out. ====
You can unlock your account and change your password yourself! Follow the instructions under [[#Resetting your password]].

==== My app won't let me scan the QR code. ====
  - If you have an iPhone, you may have denied the Authenticator app camera permissions. To fix this, go to Settings -> Privacy -> Camera and make sure Authenticator is set to ON.
  - Sometimes poor lighting or a dirty camera lens can cause the QR code to not scan successfully.  If wiping the lens or improving the lighting does not resolve, you may need to enter the code manually.