Turning on MFA for a Greentree site
System administrators and super users can turn on multi-factor authentication (MFA), and it’s as easy as ticking a checkbox.
For Greentree Desktop sites, we recommend that you start by turning on MFA for one team of users at a time. That way, only a few users will be affected if any problems come up. Once you’re confident with the process, you can turn on MFA for all users (including the super user).
For sites with eModules, WebView or Webstore, some users can't be added to teams, which means they won't be required to use MFA unless you turn it on for all users. This includes eTimesheets, eHR, eCRM and eService for Organisation and Contact users.
The first time a user logs in after MFA is turned on, they are prompted to set up their authentication methods. For detailed instructions, see Setting up MFA.
Once users start logging in with MFA, that’s the only way they can log in. If necessary, you can turn off MFA for all users.
Turning on MFA for a team of users
You can either create a new team of users especially for rolling out MFA, or you can turn on MFA for an existing team.
Go to System > System Setup > General System Preferences.
On the General System Preferences form, go to the Account settings tab.
Select the Require Multi Factor Authentication (MFA) checkbox. By default, the For selected teams during rollout option is selected.
Save your changes.
Go to System > System Setup > Team Maintenance.
Create a new team of users or select an existing team.
If you’re creating a new team specifically for MFA, select the Ignore for security settings checkbox.
Select the Require MFA for this team checkbox.
Save your changes.
When you’re ready to turn on MFA for more users, you can add them to the same team you created.
Turning on MFA for all users
Go to System > System Setup > General System Preferences.
On the General System Preferences form, go to the Account settings tab.
Under the Require Multi Factor Authentication (MFA) checkbox, select the For all users option.
Read the warning that turning on MFA is permanent. If you want to continue, click OK.
Tracking who has MFA turned on
Once a user has started signing in with MFA, the Is enrolled in MFA checkbox is selected. The checkbox is displayed on different pages depending on the type of user.
You can’t deselect the checkbox. If you want to turn off MFA, you have to turn it off for all users.
Desktop users
Go to System > System Setup > User Maintenance form, select a user, then click User Preferences.
Browser users
Go to System > System Setup > Mobile Employee Maintenance, and see if the Is enrolled in MFA checkbox is selected.
WebView customers and suppliers
For customers, go to the WebView tab on the Customer Maintenance form.
For salespeople, go to the Sales Person Maintenance form.
WebStore customers
For WebStore customers, instead of the Is enrolled in MFA checkbox, there’s an MFA checkbox on the Web Users tab of the Customer Maintenance checkbox.
