Skip to main content

Multi-Factor Authentication (MFA)

M
Written by Michael Ho

This article outlines the purpose of the Multi-factor Authentication feature and how to access your site when this is enabled.

What is Multi-factor Authentication (MFA)?

Multi-factor authentication (MFA) is a security measure that requires two or more proofs of identity to grant you access. It helps protect against phishing, social engineering, and brute-force password attacks and prevents logins from attackers exploiting weak or stolen credentials.

The first factor of authentication is your username and password; the additional factors are verification codes that can be sent to either your email address or mobile number.

📝

How will this function work if you already have SSO implemented?
ELMO will automatically accept the authentication results from your integrated identity provider, and will not ask the users to go through the ELMO MFA process. We recommend using the MFA mechanism through your identity provider for a consistent user experience.

MFA Configuration

Roles Applicable in MFA

MFA is enabled by default for the following user groups:

  • Company Admin: staff with admin access to change overall system settings

  • HR Manager: HR Administrators, Generalist or other functions that can access employee information (If you have subscribed to our HR Core module)

  • Payroll Admin: Employees who manage Payroll (If you have subscribed to the ELMO Payroll module)

MFA can also be enabled for Managers and Employees. To make MFA required for these groups, please raise a support ticket.

Verification Code Delivery

Verification codes can be sent to either the Email Address or Mobile Number recorded in the user's profile. When both options are selected, users will choose their preferred option during the verification process.

✔️

SMS notifications are recommended for employees using personal email addresses.

📝

Want to use SMS notifications?
SMS is only available to clients with an SMS notification module. Please contact your ELMO Account Manager if you wish to add SMS notifications as part of your ELMO service subscription.

MFA Instruction Message

The instruction message provided for MFA can be customised. The default message is "Please contact your company admin if you need any assistance with MFA". Please raise a support ticket if you wish to modify this.

How to login when MFA is enabled

First-time login after MFA is enabled

1. Navigate to the login page, enter your username and password, and click Login.

Login button

2. If both email and mobile methods are available, choose your preferred verification method then click Continue.

Choose verification method

3. Confirm the email address or mobile number and then click Continue.

Confirm Mobile Number

Confirm Mobile Number

Confirm Email Address

Confirm Email Address

⚠️

Not able to change your email address or mobile number?
If your administrator has allowed it, you can update your details on this screen. Otherwise, you will need to contact your administrator to update them for you.

4. A 6-digit verification code will be sent to your nominated email or mobile.

5. Enter the verification code and click Login.

Enter verification code
Login button after entering code

6. Once the code is verified, you’ll be logged in and directed to the Dashboard.

Subsequent login

1. Navigate to the login page, enter your username and password, and click Login.

Login page

2. Enter the 6-digit verification code sent to your email or mobile, and click Login.

Enter verification code
Login button after entering code

3. Once the code is verified, you’ll be logged in.

Troubleshooting Multi-Factor Authentication (MFA)

Problem: Not Receiving the Verification Code

This is the most common issue and is almost always related to local email settings. If a user is not receiving their MFA code, follow these steps.

  1. Check the Spam or Junk Folder: The first step is always to check the user's spam or junk email folder to ensure the verification email wasn't filtered by mistake.

  2. Contact Your Internal IT Department: If the email isn't in the spam folder, the issue likely lies with your organisation's email security. Due to the security nature of MFA, some email systems may automatically block or quarantine the verification code emails. Please ask your IT department to review your email filters and firewall settings to make sure that emails from ELMO are allowed through.

  3. (Admin Step) Check Notification History: As a Company Admin, you can confirm if the verification email was successfully sent. Navigate to Administration > General > Notification History. Here you can see a log of all system-generated emails, including MFA codes. This information can help your IT team diagnose why the emails may not be arriving.

Problem: Account is Locked

If a user enters the wrong verification code too many times, their account will be temporarily locked for security reasons. As a Company Admin, you can unlock a user's account immediately.

  1. Navigate to Administration > Users.

  2. Search for the locked-out user and click on their name to open their profile.

  3. At the top of the User Profile page, a button to Reset MFA will appear. This button is only visible when a user is actively locked out.

  4. Click Reset MFA to remove the lock. The user can then try to log in again.

Problem: "Invalid Code" Error

This error typically occurs if there's a delay with the email delivery and a user tries to input an old, expired code.

Please advise users to always use the most recent code they have received in their inbox. Each code is unique and expires after a set time. Also, advise them to manually type the code rather than using browser autofill features, which might input a previously used code.

Frequently Asked Questions

How do I enable SMS for MFA?+

SMS for MFA is only available to clients with an SMS notification module. Please contact your ELMO Account Manager to add this to your subscription.

Why can't our users edit their own email or mobile number during verification?+

Users can only edit their contact details if the relevant settings are marked as editable by an administrator. Please raise a support ticket to request this change.

Why has a user not received a verification code?+

Ensure the user's account has been activated and notified. It is also recommended to check with your internal IT team to review any filtering or security settings that might be blocking the emails.

How many times can users resend verification codes?+

A user will be locked out for 6 hours if they request a new code more than 3 times. A user will also be locked out for 10 minutes if they enter an incorrect code 3 times.

What should I do if a user is locked out?+

A Company Admin can reset MFA on a user's account to avoid the lockout period:

1. Navigate to Administration → General → Users.

2. Search for the user and select View Profile

3. From the Action dropdown, click Reset MFA.

4. Confirm the action. The user will be unlocked.

Can the same email or mobile number be used for more than one account?+

Yes, but we recommend using a unique email and mobile number for each account to avoid issues with actions like password resets.

Are there verification options other than email or SMS?+

Currently, only SMS and email are supported.

Did this answer your question?