Multifactor authentication (MFA)€¦ · MFA (Multi Factor Authentication) Device Management for...

Version 31 pages

Multifactor authentication (MFA)Gruber Gabriele

Exported on 2020-03-16 12:23:32

Gruber Gabriele – Multifactor authentication (MFA)

Version Table of Contents – 2

Table of ContentsTable of Contents.............................................................................................................................. 2

First Set Up of Multi Factor Authentication ..................................................................................... 7

Step-by-step guide...........................................................................................................................................8

Microsoft Authenticator App - MFA ...............................................................................................................12

(Mobile) Phone Call - MFA ..............................................................................................................................15

Trouble Shooting Guide for MFA .................................................................................................... 18

You have forgotten your mobile device at home .........................................................................................18

Your mobile phone was lost or stolen...........................................................................................................18

You do not get the verification code sent to your mobile device ................................................................18

Why can't I turn two-factor verification off? .................................................................................................19

How To change your phone numbers or add alternative number ..............................................................19

Delete your account or device from the Microsoft Authenticator app........................................................20

To delete your device from your work or school account ............................................................................................ 20

To delete your account from the Microsoft Authenticator app .................................................................................... 20

I got a new mobile device, how do I add it?..................................................................................................20

Require re-register MFA, it should revoke Microsoft Authenticator app, not just phone numbers...........21

Non English characters are not allowed in UPN address, MFA not work ....................................................21

Virtual Desktop Remote Access...................................................................................................... 22

Requirements to use Citrix Services (Citrix Apps and Desktops).................................................................22

Step by step guide to login into the Citrix Portal - including MFA ...............................................................22

Download Citrix Receiver (Workspace App): ................................................................................................26

Chrome and Multi-factor Authentication....................................................................................... 30

Installation guide ...........................................................................................................................................30

1 https://web.microsoftstream.com/video/c52b032d-7f19-4016-ace2-e4f07dcddf9f2 https://alm.andritz.com/confluence/pages/viewpage.action?pageId=685277373



Go to: https://myprofile.microsoft.com/

On this page you can access:

MFA (Multi Factor Authentication)Device Management for MFAPassword service - can be used for changing your windows password

Quick help

To provide a more secure way to access company data from any device Multi-Factor Authentication will be used. This means that MFA will be required to access company data in Office365 from non-company-managed devices.

If you are going enable MFA for the first time for your account please use the following link → First Set Up of Multi Factor Authentication(see page 7)

Training Video: MFA1

MFA will be required for accessing the following applications from a non-company-managed device:

Outlook (Web Access)TeamsOneDrive for Business.... any additional Modern Workplace solutions (e.g. Yammer, Streams)Virtual Desktop remote accessVPN client remote accessmyCWT (Travel platform)

Next to these applications, MFA will be required for Self Service Password Reset2

Accessing related data using internet browser Firefox will require Multifactor Authentication in all cases.

Office 365 activation status

Locations activated for default Office365 services like Email, OneDrive and including Multifactor Authentication:

APAC (eg. China, India)South AmericaNorth AmericaNorthern Europe (e.g. Finland, Norway)sites in Central Europe PRA, GEL, OPO, LEV, WAR, ADB, AMS, KRS, VVY, ZRH, CMO, MNT, NFT

Locations not activated for all default Office 365 services:

GermanyAustriasites in Central Europe:ASC, BUD, BUH, CET, CHA, CLL, DAR, DEH, ELB, GEN, GNB, GRZ, HAG, HBY, HUM, JNB, JON, KAR, KPO, LCV, LEB, LKY, LNZ, MAD, MAR, MIR, MKW, MOU, MXP, NKU, ROT, SCH, SIB, SPI, STP, TIS, VEL, VIE, WDD, WEZ

https://myprofile.microsoft.com/

https://web.microsoftstream.com/video/c52b032d-7f19-4016-ace2-e4f07dcddf9f

https://web.microsoftstream.com/video/c52b032d-7f19-4016-ace2-e4f07dcddf9f

https://alm.andritz.com/confluence/pages/viewpage.action?pageId=685277373

https://alm.andritz.com/confluence/pages/viewpage.action?pageId=685277373



Following information is available from the My Profile page:

Password

Gives you the possibility to change your Windows password, same as you already know it from the logging into Windows.



Devices

Shows you which devices you have set up for MFA. In case your device gets lost or stolen it is possible from this overview to disable the device here. If this happens, please also get in contact with your local IT department.

Security

Gives you an overview about your defined authentication methods. You can change your phone number here with deleting it and adding a new one.



Attention

If you have just set up one authentication method, please add at least one other, so that you have a further possibility to log in if for any reasons your preferred authentication method can not be used (for example if you lose your phone).


Version First Set Up of Multi Factor Authentication – 7

First Set Up of Multi Factor AuthenticationTo provide a more secure way to access company data from any device Multi Factor Authentication will be used. It will be required at first for some Office 365 applications like for example Exchange Online or MS Teams. In the future there are going to be more apps that will depend on multi factor authentication. This later enables Two-Step-verification that helps protecting you by making it more difficult for someone else to sign in to your business account.

Therefore there are different options for multi-factor authentication verification available - please see listed below:

Verification on a mobile app (available on Android or iPhone)

Receive notification for verification: this option uses a notification to the authenticator app on your smartphone or tablet.Use verification code: here, the authentication app generates a verification code that updates every 30 seconds.

Mobile Phone call Phone call places an automated voice call to the phone number you provide. Answer the call and press # in the phone keypad to authenticate.

Office Desk Phone call for verification Places an automated voice call to the phone number you provide. Answer the call and presses # in the phone keypad to authenticate.

Alternative authentication phone recommend that you add a secondary (Personal) phone number, if possible

Smart Card ( *Only for special Users or Non-Company Phone Users)

We strongly recommend that you add a secondary phone number to help prevent being locked out of your account if your primary phone is lost or stolen, or if you get a new phone and no longer have your original, primary phone number.

Please note

We highly recommend to select at least 2 different options.



1.

2.

3.

Step-by-step guideGo to: https://myprofile.microsoft.com/

Login with your ANDRITZ Account

If you have authenticate in on your mobile phone, click NEXT to proceed to set up of MFA.

You will get the information that more information is required from you to set up MFA, please conform with clicking NEXT.

The method you are now going to set up will be your default method.

Please make sure that your phone has a good connection to the internet during the whole authentication process.




a.

You will then automatically get the information to download the Microsoft Authenticator App. If you want to select another method as default, please click on "I want to set up a different method". How the other methods can be set up can be found on the subpages of this site.

Go to the App Store / Play Store on your phone (company and private phone) to download the Microsoft Authenticator App.

Attention

Please keep in mind that you should later on set up at least one additional method of authentication.

3 https://app.adjust.com/e3rxkc_7lfdtm?fallback=https%3A%2F%2Fplay.google.com%2Fstore%2Fapps%2Fdetails%3Fid%3Dcom.azure.authenticator

4 https://app.adjust.com/e3rxkc_7lfdtm?fallback=https%3A%2F%2Fitunes.apple.com%2Fus%2Fapp%2Fmicrosoft-authenticator%2Fid983156458

5 https://docs.microsoft.com/en-us/azure/active-directory/user-help/user-help-auth-app-add-account-manual



i.

ii.

a.b.c.

Google Android: On your Android device, go to Google Play to download and install the Microsoft Authenticator app3

Apple iOS: On your Apple iOS device, go to the App Store to download and install the Microsoft Authenticator app4.

Open the Microsoft Authenticator app, select Add account from the Customize and control icon in the upper-right, and then select Work or school account.Scan the QR code with the App and click NEXT.

Confirm the authentication on your mobile phone.

Note : If your camera is unable to capture the QR code, you can manually add your account information to the Microsoft Authenticator app for two-factor verification. For more information and how to do it, see Manually add your account5.

Review the Accounts screen of the app on your device, to make sure your account is right and that there's an associated six-digit verification code. For additional security, the verification code changes every 30 seconds preventing someone from using a code multiple times.

Setup a second verification method as recommendedOffice Desk Phone call for verificationAlternative authentication phoneVerification on a mobile app (available on Android or iPhone)

https://app.adjust.com/e3rxkc_7lfdtm?fallback=https%3A%2F%2Fplay.google.com%2Fstore%2Fapps%2Fdetails%3Fid%3Dcom.azure.authenticator



https://app.adjust.com/e3rxkc_7lfdtm?fallback=https%3A%2F%2Fitunes.apple.com%2Fus%2Fapp%2Fmicrosoft-authenticator%2Fid983156458



https://docs.microsoft.com/en-us/azure/active-directory/user-help/user-help-auth-app-add-account-manual



6 https://aka.ms/MFASetup.



d. Smart Card ( *Only for special Users or Non-Company Phone Users)

Choose your preferred authentication option. How to set up these optional methods can be checked in the below listed pages.

You can also change your default method be clicking here:

You can change your security settings later by visiting the verification page6.

https://aka.ms/MFASetup.

https://aka.ms/MFASetup.

7 https://alm.andritz.com/confluence/x/TsefK



1.

Further documentation for authentication methods can be found here:

A7uthentication Token(see page 7)Phone Call(see page 15)Authenticator App(see page 12)

Microsoft Authenticator App - MFAThe Microsoft Authenticator app helps you sign-in to your accounts if you use two-factor verification.

You can use the Microsoft Authenticator app in multiple ways, including:

Two-factor verification.The standard verification method, where one of the factors is your password. After you sign-in using your username and password, you can either approve a notification or enter a provided verification code.Phone sign-in. A version of two-factor verification that lets you sign-in without requiring a password, using your username and your mobile device with your fingerprint, face, or PIN.Code generation. As a code generator for any other accounts that support Authenticator apps.

If you have not set the Authenticator app as you default method, here is how you can add it to your methods.

Go to https://myprofile.microsoft.com/ to add an additional authentication method. Therefore you have to click on the Security info section with clicking on "UPDATE INFO".

https://alm.andritz.com/confluence/x/TsefK

https://alm.andritz.com/confluence/x/TsefK


8 https://app.adjust.com/e3rxkc_7lfdtm?fallback=https%3A%2F%2Fplay.google.com%2Fstore%2Fapps%2Fdetails%3Fid%3Dcom.azure.authenticator



2.

3.

4.a.

Choose "Add method".

Select "Authenticator app".

Install the latest version of the Microsoft Authenticator app, based on your operating system:Google Android: On your Android device, go to Google Play to download and install the Microsoft Authenticator app8.




9 https://app.adjust.com/e3rxkc_7lfdtm?fallback=https%3A%2F%2Fitunes.apple.com%2Fus%2Fapp%2Fmicrosoft-authenticator%2Fid983156458

10 https://aka.ms/mfasetup11 https://docs.microsoft.com/en-us/azure/active-directory/user-help/user-help-auth-app-add-account-manual



b.

5.6.7.8.

9.

10.

Apple iOS: On your Apple iOS device, go to the App Store to download and install the Microsoft Authenticator app9.

On your computer, go to the Additional security verification10 page - https://aka.ms/mfasetupCheck the box next to Authenticator app, and then select Configure.The Configure mobile app page appears.Open the Microsoft Authenticator app, select Add account from the Customize and control icon in the upper-right, and then select Work or school account.Use your device's camera to scan the QR code from the configure mobile app screen on your computer, and then choose Done.

Note : If your camera is unable to capture the QR code, you can manually add your account information to the Microsoft Authenticator app for two-factor verification. For more information and how to do it, see Manually add your account.11

Review the Accounts screen of the app on your device, to make sure your account is right and that there's an associated six-digit verification code. For additional security, the verification code changes every 30 seconds preventing someone from using a code multiple times.




https://aka.ms/mfasetup








1.

(Mobile) Phone Call - MFAWith this method you will receive an automatic generated phone call to confirm your log on. Here is a short guide how you can quickly add an additional method.

Go to https://myprofile.microsoft.com/ to add an additional authentication method. Therefore you have to click on the Security info section with clicking on "UPDATE INFO".




2.

3.

4.

5.

Choose "Add method".

Select "Phone". If you have already set up a phone number, you have to choose "Alternate phone" to define an additional phone number.

Type in your phone number.

The program will automatically call your mobile.



6.

7.

Pick up and press # to confirm.

You will now find you phone as an additional method in your overview.


Version Trouble Shooting Guide for MFA – 18

1.

2.

1.

Trouble Shooting Guide for MFA

You have forgotten your mobile device at homeIt happens. You left your mobile device at home and now you can't use your phone to verify you are who you say you are. If you previously added another method to sign in to your account, such as your office phone, you should be able to use that method now.

Sign in to your account normally and choose the Sign in another way link on the Two-factor verification page.

Choose your alternative verification method, and continue with the two-factor verification process.

Your mobile phone was lost or stolenIf you've lost or had your mobile device stolen, you can sign in using a different method. We strongly recommend letting your Help desk know if your phone was lost or stolen, so the appropriate updates can be made to your account.

You do not get the verification code sent to your mobile deviceNot getting your verification code is a common problem and it's typically related to your mobile device and its settings. Some possible things to try:

Restart your mobile device. Sometimes your device just needs a refresh. Restarting your device ends any background processes or services that are currently running and could cause problems, along with refreshing your device's core components, restarting them in case they crashed at some point.

If you don't see the Sign in another way link, it means that you haven't set up any other verification methods. You'll have to contact your administrator for help signing into your account.



2.

3.

4.

5.

6.

1.

2.

Verify your security information is correct. Make sure your security verification method information is accurate, especially your phone numbers. If you put in the wrong phone number, all of your alerts will go to that incorrect number.Verify your notifications are turned on. Make sure your mobile device has notifications turned on and that you've selected a notification method that allows phone calls, your authentication app, and your messaging app (for text messages) to send visible alert notifications to your mobile device.Make sure you have a device signal and Internet connection. Make sure your phone calls and text messages are getting through to your mobile device. Have a friend call you and send you a text message to make sure you receive both. If you don't, first check to make sure your mobile device is turned on.Turn off Do not disturb. Make sure you haven't turned on the Do not disturb feature for your mobile device. When this feature is turned on, notifications aren't allowed to alert you on your mobile device.Check your battery-related settings. This one seems a bit odd on the surface, but if you've set up your battery optimization to stop lesser-used apps from remaining active in the background, your notification system has most-likely been affected. To try to fix this problem, turn off battery optimization for your authentication app and your messaging app, and then try signing in to your account again.

Why can't I turn two-factor verification off?If you're using two-factor verification, ANDRITZ has decided to use this added security feature. Because of that there is no way for you to individually turn it off.

How To change your phone numbers or add alternative numberYou can add new phone numbers, or update existing numbers, from the Additional security verification page.

From the How would you like to respond? section of the Additional security verification page, update the phone number information for your Authentication phone (your primary mobile device) and your Office phone.

Select the box next to the Alternate authentication phone option, and then type in a secondary phone number where you can receive text messages or phone calls if you can't access your primary device.Select Save.

We strongly recommend that you add a secondary phone number to help prevent being locked out of your account if your primary phone is lost or stolen, or if you get a new phone and no longer have your original, primary phone number.



1.

2.

1.

2.3.

Delete your account or device from the Microsoft Authenticator appYou can delete your account from the Microsoft Authenticator app, and you can delete your device from your work or school account. Typically you delete your device to permanently remove a lost, stolen, or old device from your account, and you delete your account to try to fix some connection issues or to address an account change, such as a new user name.

To delete your device from your work or school accountFrom the How would you like to respond? section of the Additional security verification page, select the Set up Authenticator app button.Select Save.

To delete your account from the Microsoft Authenticator appFrom the Microsoft Authenticator app, select the Delete button next to the device you want to delete.

I got a new mobile device, how do I add it?If you've gotten a new mobile device, you'll need to set it up to work with two-factor verification. This is a multi-step solution:

Note:

In-case Old phone is no longer available and it has been the only configured MFA verification method, please open a support ticket.

Ensure to have an alternative 2nd verification method registered. If not, please register it atmyprofile.microsoft.com. Login to myprofile.microsoft.com , sign in with alternative verification method Register "Microsoft Authenticator" for new device using "add method" button

12 http://myprofile.microsoft.com



4. Delete the old, not needed "Microsoft Authenticator" verification method

Require re-register MFA, it should revoke Microsoft Authenticator app, not just phone numbers.When revoking a users MFA sessions and requiring re-registration of MFA, AAD only removes the phone numbers from the users account. It does not remove the associated Authenticator app. There is no method to for a Global Admin to remove the Authenticator app association from the user. The only supported method is for the end user to log-in and remove it from the myprofile.microsoft.com12 page.

Non English characters are not allowed in UPN address, MFA not workThe object failed to be synchronized because the attribute did not meet the validation requirements (format, character set etc.) of Azure AD.

Such as: special German character

To avoid the issue update UPN with English character on premises AD. Once Account has been sync with Azure AD then user can register MFA without any issue.

Example:

http://myprofile.microsoft.com

http://myprofile.microsoft.com

13 https://www.andritz.com/resource/blob/322948/82d46ba081bda0b7ccd31db93522f0a6/gr-mfa-pwreset-for-external-users-data.pdf


Version Virtual Desktop Remote Access – 22

1.

2.

a.

3.

1.

2.

Virtual Desktop Remote Access

Requirements to use Citrix Services (Citrix Apps and Desktops)ANDRITZ Username and Password: Make sure that you've got a valid ANDRITZ Domain user and password. These will be provided by your ANDRITZ internal contact person.

Register for Multifactor Authentication (MFA): Your user account must be enabled for MFA. Please follow the instructions at Multifactor Authentication for Citrix Login13 to activate your account for MFA.

We recommend that you also apply for the Self Service Password reset (enrollment in the same portal as MFA).

Download and install Citrix Receiver (Citrix Workspace App): You can find the download at: https://www.citrix.com/products/receiver.html

Support: Contact the local Helpdesk via your ANDRITZ contact person to open a ticket: Please provide username and a detailed description (best with screenshots) of the issue.

Step by step guide to login into the Citrix Portal - including MFAANDRITZ Group Citrix environment is reachable via:

https://gate.andritz.com After opening https://gate.andritz.com you will be redirected to login.microsoftonline.comPlease login with [email protected]:

https://www.andritz.com/resource/blob/322948/82d46ba081bda0b7ccd31db93522f0a6/gr-mfa-pwreset-for-external-users-data.pdf



https://www.citrix.com/products/receiver.html


https://gate.andritz.com




3. Type in your ANDRITZ password here:



4.

5.

6.

7.

8.

Press next here:

Microsoft Authenticator Guide will appearGo to the Apple App Store or Android Play Store on your phone to download theMicrosoft Authenticator App.

Open the Microsoft Authenticator app, select “Add account” from the “Customize andcontrol" icon in the upper-right, and then select"Work or school account".

Scan the QR code on the web-page with the App and click "NEXT":

Note: If your camera is unable to capture the QR code, you can manually add your accountinformation to the Microsoft Authenticator app for two-factor verification.

Setup of a second verification method is recommended:Office Desk Phone call for verification



9. Please go back to https://gate.andritz.com

Here you can find your Favorites, Desktops or Apps in the blue menu bar:




1.

Download Citrix Receiver (Workspace App):

Citrix Receiver can be downloaded here: https://www.citrix.com/products/receiver.html





2. Click "RUN" to start the installation:



3.

4.

5.

"Start"

Accept the License Agreement and click "Install"

Press "Finish"



6. Go back in the Browser to https://gate.andritz.com



Version Chrome and Multi-factor Authentication – 30

Chrome and Multi-factor AuthenticationIn order to make Google Chrome working with multi-factor authentication, you have to do some additional steps.

You need to have the Chrome extension "Windows 10 accounts" installed; this extension is provided by Microsoft.

Installation guide1 | Go to Google Chrome web store: https://chrome.google.com/webstore/category/extensions

2 | Search for "Windows 10 Accounts" extension or go directly to: https://chrome.google.com/webstore/detail/windows-10-accounts/ppnbnpeolgkicgegkbkbjmhlideopiji

3 | Add extension to Chrome browser

Attention

This additional configuration step will NOT be required anymore in the near future, as this extension will be managed and rolled out by IT globally. Details to be announced.

https://chrome.google.com/webstore/category/extensions

https://chrome.google.com/webstore/detail/windows-10-accounts/ppnbnpeolgkicgegkbkbjmhlideopiji

https://chrome.google.com/webstore/detail/windows-10-accounts/ppnbnpeolgkicgegkbkbjmhlideopiji


Version Chrome and Multi-factor Authentication – 31

4 | Click on the icon and login with your account

5 | If you have successfully logged in, MFA will work with Chrome. MFA challenge will not appear when requesting resources from a managed device; So it behaves same as in Internet Explorer or Edge.

Multifactor authentication (MFA)€¦ · MFA (Multi Factor Authentication) Device Management for...

Documents

Transcript of Multifactor authentication (MFA)€¦ · MFA (Multi Factor Authentication) Device Management for...