About

Multi-factor authentication (MFA), also called two-factor authentication (2FA), adds a second check to sign-in. Along with their username and password, users enter a code from an authenticator app such as Google Authenticator. It is an extra layer of security for access to ControlMap.

MFA works in two layers:

• Any user can turn on MFA for their own account from My Profile.
• A Super Admin can enforce MFA for the whole company, so it is required rather than optional.

MFA applies to people who sign in with a username and password. The enforcement setting reads "Enforce MFA for any user using username & password to login into ControlMap login."

See who has set up MFA

The Users page shows MFA status for everyone in your company:

1. Open the account menu (top left, under the company name) › Account Settings › Users.
2. Look at the MFA column. A tick means the user has completed MFA setup. A cross means they have not. Hover over the icon to see "MFA complete" or "MFA not complete".

The Sign in column beside it shows how each user signs in, for example Username/Password.

Require MFA for everyone

Only a Super Admin can turn enforcement on or off. A Compliance Manager can see the MFA Settings. card, but its checkbox is greyed out.

1. Go to the account menu › Account Settings › Users.
2. Scroll below the list of users to the MFA Settings. card.
3. Tick Enforce MFA for all users.
4. In the Enforce MFA? message, select Yes. A message says "Successfully updated MFA settings."

The setting is saved as soon as you confirm. You do not need to select Save; that button is for the Sign in settings card below.

Turn off enforcement

1. On the Users page, in the MFA Settings. card, untick Enforce MFA for all users.
2. In the Confirm Disabling MFA message, choose one of:
   • Cancel: keep enforcement on.
   • Disable MFA: stop prompting users for MFA.
   • Disable MFA (include already enrolled users).: stop prompting and also turn MFA off for users who already set it up.

Turn off MFA for one user

A Super Admin can turn off MFA for a single user. This is only available while MFA is not enforced for everyone:

1. Go to the account menu › Account Settings › Users.
2. Select the three-dot Actions menu on the user's row.
3. Select Disable MFA and confirm.

The option appears only for users who have MFA set up.

Set up MFA for your own account

Any user can do this, whatever their role. You need an authenticator app, such as Google Authenticator.

1. Open the account menu (top left, under the company name) › My Profile.
2. In the Two-Factor (MFA) Authentication card, check "Your current 2FA enrollment status:". It shows Enrolled or Not Enrolled.
3. Select My 2FA Settings. A panel called Configure 2FA for your account. opens.
4. Tick Enroll in 2FA. A QR code appears, with a link to instructions for the Google Authenticator app.
5. Scan the QR code with your authenticator app.
6. Type the code from the app into Verification Code.
7. Optional: tick Don't ask for next 30 Days to skip the code on this device for 30 days.
8. Select Enable. A message says "Successfully updated the Two Factor Authorization" and your status changes to Enrolled.

From then on, signing in asks for the code from your authenticator app after your username and password.

To turn MFA off for yourself, open My 2FA Settings again and untick Enroll in 2FA.