Multifactor authentication (MFA) protects your integrator.io sign-in by requiring a six-digit code from an authenticator app in addition to your password. This article explains how MFA applies to your account, how to set up and change your own MFA settings and trusted devices, how MFA works with single sign-on (SSO), and, for account owners and administrators, how to set the company MFA policy, reset MFA for a user, and recover access when you're locked out.
How MFA applies to your account
MFA is required for every user of a paid account who signs in with an email address and password, starting with the first sign-in from a new device. Two groups are exempt:
- Free trial accounts – MFA isn't required until the trial ends. On a free trial account, an owner or admin can require it for an individual user with the Require MFA setting when inviting or editing the user.
- SSO users – Users who sign in through SSO skip the integrator.io MFA prompt, because the identity provider usually performs its own MFA. An owner or admin can still require an integrator.io MFA check after SSO for an individual user with the Require MFA after SSO setting when inviting or editing the user (see Invite and manage users to an account or environment).
There is no account-wide setting that turns the MFA requirement off. Company MFA settings control trusted devices only.
Caution: The account owner must complete their own MFA setup before other users set up theirs. If a user sets up MFA first, their verification code is rejected at every sign-in even though the authenticator app is linked correctly. To fix it, the owner completes their setup, and then turns MFA off and back on for the affected users.
Set up MFA
integrator.io prompts you to set up MFA the first time you sign in with a password on an account that requires it.
- Install an authenticator app, such as Google Authenticator or Microsoft Authenticator, on your mobile device.
- Sign in to integrator.io. When prompted, scan the QR code with the authenticator app, or enter the account name and secret key shown on the page.
- Enter the six-digit code from the app to confirm the link.
The mobile device is now your authentication device. On your next sign-ins you enter the code from the app, unless the computer and browser you're using is a trusted device.
Manage your MFA settings
- Go to Account
, and then select Security.
- Select My MFA settings, and review the status under MFA (Multi-factor authentication).
- Select one of the following:
- Turn off MFA – Turn off MFA for your sign-in. On an account that requires MFA, this doesn't remove the requirement: the next time you sign in, you're returned to MFA setup, and the Security page tells you that you must enable MFA before you can continue in the account.
- Change authenticator – Link a different authenticator app or device. Scan the new QR code or enter the secret key in the new app.
- Reset MFA – Clear your current setup and set it up again. Use this when codes from your current app are rejected. If you belong to more than one account, choose the account in Account to reset MFA.
- Select Save.
Trusted devices and authentication devices
MFA involves two kinds of device, and the Security page treats them differently:
- Authentication device – The mobile device running the authenticator app that shows your six-digit code.
- Trusted device – A specific computer and browser (for example, Chrome on your work laptop) that you've used to pass MFA. While a device is trusted, you aren't asked for a code when you sign in from it. A different browser on the same computer is a separate device.
Whether you can trust a device, and for how long, is set by the account's company MFA policy.
Remove a trusted device
Remove a device you no longer use, or one you don't control, so that the next sign-in from it requires a code.
- Go to Account
- Select My MFA settings.
- Under Trusted device, select Manage devices.
- Next to the device, select Actions
> Delete device, and confirm.
Use MFA with SSO
You can sign in with both SSO and MFA, and your account owner may require both. If your organization uses SSO, set up SSO first and then MFA, and at sign-in complete SSO before entering your MFA code. Where possible, configure MFA in your identity provider as well, so the same policy applies across the applications you sign in to. See Sign in with SSO.
Switch between accounts with different MFA settings
If you belong to more than one account, the MFA prompt depends on the account you switch to:
- Switching from an account that doesn't require MFA to one that does prompts you to set up MFA or enter a code.
- Switching to an account that allows trusted devices doesn't prompt for a code if you're on a device you recently passed MFA on.
- Switching to an account that doesn't allow trusted devices always prompts for a code.
Set the company MFA policy
Prerequisites: You must be the account owner or an administrator.
Company MFA settings apply to every user who signs in to the account with a password.
- Go to Account
- Select Company MFA settings.
- Select Allow trusted devices to let users skip the code on devices they've already passed MFA from. Clear it to require a code at every sign-in.
- In Number of days until MFA is required, enter how many days of inactivity a trusted device can have before the user must enter a code again. If you leave it blank, the default is 90 days.
- Select Save.
MFA is one of the sign-in controls on the Security page. To also restrict the IP addresses users can sign in from, see Assign a network policy.
Reset MFA for a user
Prerequisites: You must be the account owner or an administrator.
Resetting a user's MFA doesn't turn MFA off for them. It clears their authenticator link and removes their trusted devices, so at their next sign-in, from any device, they register an authenticator app again and enter a code. Use it when a user has lost or replaced their authentication device, or when their codes are being rejected.
- Go to Account
- Next to the user, select Actions
- Tell the user to sign in and set up MFA again right away.
If you can't sign in to reset MFA
If your code is rejected or your authentication device is gone, ask the account owner or an administrator to reset your MFA. If you are the owner, or no administrator can help, open a ticket with Celigo Support (see Submit a support ticket) and include:
- Your organization's name
- The company email address of the locked account
- Times you're available for a video call
- A phone number where you can be reached
The MFA reset team verifies your identity on the call before resetting MFA. Have at least two forms of government-issued ID (for example, a driver's license and a passport) and proof that you work for the organization, such as a business card.