Attach a virtual MFA device to an Alibaba Cloud account-Account Center(Account)-阿里云帮助中心

Attach a virtual MFA device to your Alibaba Cloud account for two-step verification during logon, strengthening account security.

What is MFA and why should I configure it?

MFA (Multi-Factor Authentication) is a best practice for improving account security. It adds an extra layer of protection beyond your username and password.

With MFA enabled, logging on to Alibaba Cloud requires the following two verification steps:

First factor: Enter your username and password.
Second factor: Another verification method, such as the 6-digit dynamic verification code that a virtual MFA device automatically generates every 30 seconds.

With two-factor authentication, even if your password is leaked, anyone without your mobile phone cannot log on to your account. This effectively prevents account theft and greatly improves security.

Which MFA methods do Alibaba Cloud accounts support?

Alibaba Cloud accounts currently support multiple MFA methods, such as text message verification codes. This topic focuses on virtual MFA devices (Virtual MFA Device), which are software-based multi-factor authentication applications. A virtual MFA app follows the TOTP (Time-based One-Time Password, RFC 6238) standard and generates a 6-digit dynamic verification code every 30 seconds for two-factor verification during logon and other critical operations.

Recommended virtual MFA apps

Alibaba Cloud app (recommended): The official app is highly integrated and supports one-stop Alibaba Cloud service management and security authentication.
Google Authenticator: A mainstream TOTP standard app, available for Android and iOS.
Other TOTP-compatible authenticators: such as Microsoft Authenticator and Authenticator (Windows Phone).

Attach a virtual MFA device

This topic uses the Alibaba Cloud app as an example. The steps for other TOTP-compatible apps are similar.

Prerequisites

Before you begin, make sure you meet the following requirements:

Your Alibaba Cloud account has completed identity verification. For more information, see Identity verification overview
You have downloaded and installed the latest version of the Alibaba Cloud app.

Procedure

Log on to the Account Center. Under My Account, select Security. Then, click Virtual MFA next to Bind.
On the Verify Identity page, select a suitable method to complete identity verification.

The available verification methods include phone number verification, Alipay verification and face recognition.
On the Enable MFA page, follow the on-screen instructions to download and install the Alibaba Cloud app or Google Authenticator on your mobile phone. Use the Alibaba Cloud app or Google Authenticator to obtain a verification code, enter the code, and then click Enable.
After the MFA device is attached, refresh the Security page. The status changes to Bound. A Virtual MFA entry now shows an Unbind link. If you need to change the verification method or device, click this link to detach the MFA device.

Detach a virtual MFA device

If you still have access to the MFA application (Alibaba Cloud app or Google Authenticator), detach the virtual MFA device from your PC or the Alibaba Cloud app.
PC client
1. Log on to the Account Center. Under My Account, select Security. Then, click Unbind next to Virtual MFA.
  After the attachment is complete, the Virtual MFA status changes to Attached. If you need to change the method or device, click the corresponding Unbind link to perform the detach operation.
2. Open the Alibaba Cloud app, get the 6-digit verification code, enter it, and click Verify Now.
3. After the MFA device is detached, refresh the Security page. The status changes to Not Attached.
Alibaba Cloud App
If you lost your phone or deleted the MFA application, reinstall the Alibaba Cloud app and use face recognition to detach the virtual MFA device.
Note
Face recognition is available only for verified individual accounts and legal representatives of verified enterprise accounts.
1. Download and install the Alibaba Cloud app. Open the app, tap Log On/Sign Up, accept the terms, and tap One-click Logon With Current Phone Number.
2. On the Verify Virtual MFA Device page, click Detach MFA Device.
3. On the Identity Verification page, click Face Scan Verification. On the ID Verification Service page, click Start Authentication.
4. After the face scan passes, the MFA device is detached.
If the preceding methods do not work and you cannot log on, submit an account appeal to detach the virtual MFA device.