Using Multi-Factor Authentication (MFA)
Multi-Factor Authentication or MFA, is a security measure implemented on all Portal users and API-integrated Partners that creates an additional layer of user verification by supplying a six-digit code to an authenticator app of your choice to verify you’re the user logging in or initiating a request/action.
Navigate to the Multi-Factor Authentication Enablement page by clicking Settings in the Admin category of the left-hand navigation panel. Then, click Multi-Factor Authentication Enablement under the Business Details section.
This is a beta feature and will not be required until deployed for general availability. Users with parent entities (Referrers or Facilitators) enrolled in MFA beta will likely be required to enroll.
Note: The page does not dynamically load the entire list of all MFA-enabled users.
By using the search button in the search bar, you can either load with no criteria to populate the entire list, or enter in a specific user you’re looking for to filter.
Note: Facilitators & Referrers utilizing their own MFA configurations in place can use Single Sign-On (SSO) to automatically redirect to the Portal directly from their native application without manual sign-in or authentication required.
Enable MFA for your Portfolio
After navigating to the Multi-Factor Authentication Enablement page, you’ll see a list of existing users in your portfolio and whether or not they have enrolled in and enabled MFA.
Enroll Users in MFA
After enabling the MFA feature for the desired user, the user will be required to enroll in their preferred authenticator app (such as Microsoft/Google Authenticator, Okta Verify, or RSA SecurID) the next time they attempt to log in to the Portal.
Recommended MFA Authenticator Apps
There are many different multi-factor authentication apps available to choose from. Below is a list of trusted authentication apps we recommend for individuals to use in MFA enrollment:
Reset User MFA Setup
In situations where users lose their device that contains the authentication code setup required for MFA, you can disable MFA for that user to allow them to re-enroll. If and when the user is ready to re-enroll, simply re-enable their MFA enrollment and the process shown above will be prompted again for the user to set up MFA.
Below are the recommended steps for each platform user access level to reset their individual MFA setup:
User Type | Reset Steps |
---|---|
Facilitator | Contact a Facilitator-level user with the proper access to reset. |
Referrer | Contact Payrix support via ServiceDesk ticket or your Facilitator. |
Merchant | Contact your Referrer. |
Facilitators & Referrers can manage Merchant-level MFA enablement for convenient support of their portfolios.
Below are the steps a Facilitator or Referrer can take in the Portal to reset another (Merchant) user’s MFA setup:
Disable User MFA Setup
For scenarios where a Facilitator may want to use their own MFA solution or other unique situations you can follow the steps below:
“Login As” Access
After users have become enrolled in Multi-Factor Authentication, they will also be prompted to submit an MFA code when logging in to their child entities' Portal views (e.g. Referrer logging in as one of its Merchants). The same rules will apply that a user can use Remember Me for 30 Days to only be required to authenticate this way one time every 30 days.
Remember Me
After enrolling in MFA, and attempting an additional login to the Portal prompting for the current temporary authenticator code to be entered. Users can toggle a checkbox that says “Remember me for up to 30 days” to ensure that a user are not prompted to enter a temporary authenticator code for MFA the next time they log in within the next 30 days.
Toggle the “Remember Me” checkbox, then enter the authenticator app code. This prevents the selection from not being saved.
Enable the MFA Announcement Lightbox
Multi-Factor Authentication is not yet fully enabled as a requirement for all users and will deployed to all soon. To inform your portfolio users that they will need to enroll in MFA soon. This lightbox will provide the option for the user to begin enrollment steps now, or decline and wait until it is required.
To enable this announcement lightbox, follow the steps below:
Now, the next time a Referrer or Merchant in your portfolio logs into the Portal, they will see a lightbox allowing them to enable and enroll in MFA from directly inside the prompt.