Turning on MFA for a Greentree site

For system administrators and super users, turning on multi-factor authentication (MFA) is as easy as ticking a checkbox.

We recommend that you start by turning on MFA for one team of users at a time. That way, only a few users will be affected if any problems come up. Once you’re confident with the process, you can turn on MFA for all users (including the super user).

For sites with eModules, the steps for turning on MFA are the same. For the following eModules you have to turn it on for all users, as teams aren’t available: eTimesheets, eHR, eCRM and eService for Organisation and Contact users.

The first time a user logs in after MFA is turned on, they are prompted to set up their authentication methods. For detailed instructions, see Setting up MFA.

Once users start logging in with MFA, that’s the only way they can log in. If necessary, you can turn off MFA for all users.

Turning on MFA for a team of users

You can either create a new team of users especially for rolling out MFA, or you can turn on MFA for an existing team.

1. Go to System > System Setup > General System Preferences.

2. On the General System Preferences form, go to the Account settings tab.

3. Select the Require Multi Factor Authentication (MFA) checkbox. By default, the For selected teams during rollout option is selected.

   

4. Save your changes.

5. Go to System > System Setup > Team Maintenance.

6. Create a new team of users or select an existing team.

7. If you’re creating a new team specifically for MFA, select the Ignore for security settings checkbox.

8. Select the Require MFA for this team checkbox.

   

9. Save your changes.

10. When you’re ready to turn on MFA for more users, you can add them to the same team you created.

Tracking which users have MFA turned on

You can see if a user has MFA turned the Preferences for user form. To open the form, go to System > System Setup > User Maintenance form, select a user, then click User Preferences.

If a user has MFA turned on, the Is enrolled in MFA checkbox is selected.

Turning on MFA for all users

After you’ve tested turning on MFA for a team of users, you can turn it on for all users.

1. Go to System > System Setup > General System Preferences.

2. On the General System Preferences form, go to the Account settings tab.

3. Under the Require Multi Factor Authentication (MFA) checkbox, select the For all users option.

4. Read the warning that turning on MFA is permanent. If you want to continue, click OK.