Turning on MFA for a Greentree site

For system administrators and super users, turning on multi-factor authentication (MFA) is as easy as ticking a checkbox.

For Greentree Desktop sites, we recommend that you start by turning on MFA for one team of users at a time. That way, only a few users will be affected if any problems come up. Once you’re confident with the process, you can turn on MFA for all users (including the super user).

For sites with eModules, WebView or Webstore, you can only turn on MFA for all users, as teams aren’t available. This includes eTimesheets, eHR, eCRM and eService for Organisation and Contact users.

The first time a user logs in after MFA is turned on, they are prompted to set up their authentication methods. For detailed instructions, see Setting up MFA.

Once users start logging in with MFA, that’s the only way they can log in. If necessary, you can turn off MFA for all users.

Turning on MFA for a team of users

You can either create a new team of users especially for rolling out MFA, or you can turn on MFA for an existing team.

1. Go to System > System Setup > General System Preferences.

2. On the General System Preferences form, go to the Account settings tab.

3. Select the Require Multi Factor Authentication (MFA) checkbox. By default, the For selected teams during rollout option is selected.

   

4. Save your changes.

5. Go to System > System Setup > Team Maintenance.

6. Create a new team of users or select an existing team.

7. If you’re creating a new team specifically for MFA, select the Ignore for security settings checkbox.

8. Select the Require MFA for this team checkbox.

   

9. Save your changes.

10. When you’re ready to turn on MFA for more users, you can add them to the same team you created.

Turning on MFA for all users

1. Go to System > System Setup > General System Preferences.

2. On the General System Preferences form, go to the Account settings tab.

3. Under the Require Multi Factor Authentication (MFA) checkbox, select the For all users option.

4. Read the warning that turning on MFA is permanent. If you want to continue, click OK.

   

Tracking who has MFA turned on

Once a user has started signing in with MFA, the Is enrolled in MFA checkbox is selected. The checkbox is displayed on different pages depending on the type of user.

You can’t deselect the checkbox. If you want to turn off MFA, you have to turn it off for all users.

Desktop users

Go to System > System Setup > User Maintenance form, select a user, then click User Preferences.

WebView customers and suppliers

• For customers, go to the WebView tab on the Customer Maintenance form.

  

• For salespeople, go to the Sales Person Maintenance form.

  

WebStore customers

For WebStore customers, instead of the Is enrolled in MFA checkbox, there’s an MFA checkbox on the Web Users tab of the Customer Maintenance checkbox.