Configure multi-factor authentication (MFA)

How MFA works

After you enable MFA for an office network or for an organization, the system verifies two security factors each time an end user logs on:

• First factor: The username and password of the end user.

• Second factor: The dynamic password generated by a virtual MFA device, or the verification code that the end user receives in an SMS message or in an email.

Supported MFA methods

EDS Enterprise Edition supports the following MFA methods. The enablement scope that you choose determines which methods are available and which end users are affected.

Enable MFA for an office network

Enable MFA at this scope to require a dynamic password from the end users who use one specific office network to log on.

1. Log on to the EDS enterprise console.

2. In the left-side navigation pane, choose Networks & Storage > Office Network.

3. In the top navigation bar, select a region.

4. On the office network page, click the target office network ID.

5. In the Other Information section at the bottom of the page, turn on the MFA switch, and then click OK in the confirmation dialog box.

   Note

   Make sure that client logon verification and the SSO settings are disabled.

   After MFA is enabled, end users must enter a dynamic password when they use this office network to log on to a terminal.

Enable MFA for an organization ID

Enable MFA at this scope to require a second security factor from every end user who uses the organization ID to log on.

1. Log on to the EDS enterprise console.

2. In the left-side navigation pane, choose Users > Logon Settings.

3. On the Logon Security tab, set MFA to Enabled.

4. In the confirmation dialog box, select the authentication method that you want to use.

   • TOTP

     End users enter the dynamic password generated by the Alibaba Cloud app or another common OTP app, such as Google Authenticator.

   • SMS Verification Code

     This method is available for convenience accounts and AD accounts on desktop clients V7.6 or later and mobile clients V7.3 or later.

     Note

     Users without a configured phone number cannot complete authentication.

   • Email Verification Code

     This feature is available for convenience accounts and AD accounts. It is supported only on desktop clients V7.6 or later and mobile clients V7.3 or later.

     Note

     Users without a configured mailbox cannot complete authentication.

After MFA is enabled, end users must enter the dynamic password or verification code that the selected authentication method requires when they use this organization ID to log on to a terminal.

Delete a virtual MFA device

End users bind a virtual MFA device the first time they log on after you enable MFA with TOTP dynamic passwords. If an end user replaces the virtual MFA device, delete the device that is bound to the account of the end user in the console.

Select the procedure that matches the account type of the end user.

After you delete the virtual MFA device, the end user must bind a virtual MFA device again at the next logon.