Enabling Multi-Factor Authentication in BMS - Connect IT Community

/* * These styles apply ONLY to the header and footer assets. */ * { padding: 0; margin: 0; box-sizing: border-box; } .super-nav { display: flex; justify-content: flex-end; align-items: center; margin: 0 auto; max-width: 1264px; padding-left: 40px; padding-right: 40px; height: 40px; text-align: right; } .super-nav a { color: #34427c; margin-right: 20px; padding: 10px; text-decoration: none; } .super-nav a:hover, .super-nav a:focus { background-color: #f7f9fa; } .footer { background: #f5f5f6; color: #555a62; font-size: 14px; line-height: 1.5; padding: 0; } .footer-image { background-image: url("/themes/kaseya/assets/images/footerImage.png"); height: 500px; background-repeat: no-repeat; background-size: cover; margin-top: -100px; } .footer-wrap { padding-left: 18px; padding-right: 18px; max-width: 1236px; margin: 0 auto; } .footer-main-content { background-color: #000; padding: 100px 0; } .footer .footer-col-title { color: #ffffff; font-weight: 700; font-size: 13px; padding-bottom: 10px; text-transform: uppercase; } .footer .footer-link { color: #9b9ca0; text-decoration: none; } .footer .footer-link:hover, .footer .footer-link:focus, .footer .footer-link:active { text-decoration: underline; } .footer-main-content .footer-link { padding-top: 10px; } .footer-row { display: flex; flex-wrap: wrap; justify-content: space-between; align-items: center; margin: -3px; } .footer-main-content-row { align-items: flex-start; } .footer-bottom-content { padding: 10px; align-items: center; } .footer-col { padding: 0 3px; display: flex; flex-direction: column; } .footer-col-copyRight { justify-content: flex-start; color: #9b9ca0; flex: 1; display: flex; } .footer-last-col { flex-direction: row; } .footer-last-col .footer-link { padding-right: 10px; text-transform: uppercase; } @media screen and (max-width: 768px) { .super-nav { padding-right: 0; } .footer-image { height: 250px; } .footer-main-content { padding: 40px 0; } .footer .footer-col-title { padding-top: 10px; } .footer-row:not(.footer-main-content-row) { display: block; } .footer-col:not(.footer-main-content-col) { width: 100%; text-align: center; padding: 10px 0; } .footer-main-content-col { width: 50%; } .footer-last-col { flex-direction: column; } .footer-last-col .footer-link { padding-bottom: 10px; } } /*# sourceMappingURL=styles.css.map */ Ask the Community Groups

Enabling Multi-Factor Authentication in BMS - Connect IT Community | Kaseya

Introduction

BMS implements Multi-Factor Authentication (MFA) aiding in enhanced security. Administrators can enforce MFA on all users or end users can enable this in their profiles.

You can use any generic authenticator products like Passly, Google Authenticator, Duo, and others. You can use your organization's IDP to implement this extra security or use the built-in service by BMS to enforce MFA.

Prerequisites

An active employee or contact in the system.
An authenticator application on your mobile device.

Features

Enforce MFA for few or all users.
MFA will work in parallel with your current SSO and SAML IDP authentications.
MFA enabled/disabled value columns are listed in Employee and Contact listing pages.
MFA can be disabled for multiple users at once using batch actions under Contacts.

Setup

As an Admin :

1. In BMS, navigate to Admin > My Company > Auth and Provision.
2. Require MFA for non-SSO users: Yes

Existing SSO users:

Enabling MFA for non-sso users button applies MFA on all the login accounts. If the user has an existing SSO, they would still have to log in to their profile and enable MFA. This is a one-time setup for SSO users. MFA will not be asked for any subsequent logins.

SSO Provider interface > BMS App > My profile > Enable MFA > Logout of BMS
SSO Provider interface > BMS App > Loads BMS profile using SAML

Authentication will show MFA enabled, and the user authentication type under HR for this user will be SAML SSO.

As an end-user :

1. Open "My profile page", Enable MFA
2. Once MFA is enabled for an account, you will have to set up your mobile device to help you generate code during your next login.
  - Scan the QR code shown on your screen
  - Generate code, use it in the" Verify MFA Code" box, click Enable.

If your app doesn't support a code scanner you can also use the following steps to configure the code manually.

Click on the "Show secret Key for manual configuration"
On your device, Add a new setup key and use the secret token from BMS.

Once MFA is enabled, you will also see an option to generate an MFA recovery, Click on the link and save the code somewhere secure.

Note: On your next login, you will be prompted for your Username, Password, and authentication code OTP generated by an authenticator application. Change in authentication type requires users to refresh their logged-in session.

Lockout recovery

If you do not have access to your mobile device to generate a code, you can either use the Recovery key or reset your MFA.

Copy the recovery token that you saved from the 'My Profile' page during the MFA setup.
Enter it into the MFA Code field when you log in. This code expires after the first use. You’ll need to get a new recovery code and store it in a secure place for future use.

Reset MFA

Reach out to someone with an Administrator role in the system, and have them reset your MFA.
Reset path : Navigate to Admin > HR >Employees if the user is and employee and Contacts > CRM > Contact> Client portal access for a client portal user.
Choose Reset MFA. You will be asked to set up MFA again on your next login.