How-to guideGet a task done

Manage multi-factor authentication

This page explains how to roll out multi-factor authentication (MFA) to your organisation, and how to reset a user’s one-time password when they lose their phone. Storyteq turns MFA on or off for your whole organisation when you ask. You prepare your users for the change and handle their reset requests.

How MFA works, and who it applies to, is covered in Understanding multi-factor authentication.

Turn MFA on or off

MFA applies to every user in your organisation who signs in with an email and password. Users who sign in through your company’s single sign-on aren’t affected. To roll MFA out:

  1. Agree a date for the change with your Storyteq contact.

  2. Send your Storyteq contact the address of the mailbox that should receive reset requests.

    Use a shared inbox that someone monitors, such as your IT helpdesk, rather than one person’s address, so that requests aren’t missed.

    Send the address before MFA is turned on. Until the mailbox is set up, a user who loses their phone can’t request a reset from the sign-in screen.

  3. Tell your users what’s changing and when, and share Sign in with multi-factor authentication with them.

  4. On the agreed date, your Storyteq contact turns MFA on.

    The change can take up to 5 minutes to apply. Each user sets up their authenticator app the next time they sign in. Users who are already signed in aren’t signed out straight away. Within about 5 minutes, when their sign-in refreshes, they’re sent to the MFA step.

To turn MFA off, ask your Storyteq contact. Allow up to 5 minutes for the change to apply. Users then sign in with their email and password only. Their authenticator setup is kept, so if MFA is turned on again later, they carry on with the same entry in their app.

Reset a user’s one-time password

A user who loses their phone, replaces it, or deletes their authenticator app requests a reset from the sign-in screen. Resetting their one-time password (OTP) lets them set up their authenticator again on their next sign-in.

You need the Admin role for Administration Panel to reset a user’s one-time password. The Client Admin role preset includes it. Each role’s permissions are listed in User role presets and permissions.

You can also reset a user’s one-time password without a request, for example when they contact you directly. Confirm who they are, then follow the next steps, finding the user on the User Management page instead of through the email.

Each request arrives in your reset mailbox as an email from support@storyteq.com, with the subject OTP reset requested for followed by the user’s email address. The email names your organisation and the user who made the request.

  1. Confirm that the request is genuine by contacting the user through another channel, such as a phone call, chat, or in person.

    Anyone who can reach the sign-in page can send a request in a user’s name. Resetting without checking lets someone with only a stolen password take over the account.

    Don’t reset the one-time password of someone who has left your organisation. Deactivate their account instead, as described in Deactivate or delete a user.

  2. In the email, select Open this user in the admin portal.

    The User Management page opens, filtered to that user. To find the user without the email, select Administration in the bottom-left navigation, select Users, and search for them.

  3. Open the user’s menu in the Actions column and select Reset OTP.

  4. In the confirmation dialog, select Reset OTP.

    OTP has been reset for appears, followed by the user’s name.

  5. Tell the user they can sign in again.

    Their next sign-in shows the setup screen, where they link their new phone. Codes from the old entry in their authenticator app no longer work.

Request sign-in records

Every sign-in attempt is recorded, including failed attempts and wrong codes, and records are kept for 90 days. Accounts aren’t locked after repeated failed attempts. You can’t open these records in Storyteq CMP. To get an export, ask your Storyteq contact.

Troubleshooting

Each problem below is a common issue with reset requests. Select one to see how to fix it.

Problem: Reset request emails don’t arrive.

Solution: check your mail filtering and spam folder for messages from support@storyteq.com. If nothing is there, confirm with your Storyteq contact which reset mailbox address they have for your organisation.

Problem: OTP reset isn’t set up for your account yet appears when users request a reset.

Solution: your organisation has no reset mailbox yet, so no email was sent. Send the mailbox address to your Storyteq contact. In the meantime, confirm the user’s identity and reset their one-time password from the User Management page, as described in Reset a user’s one-time password.