MFA for administrators

Owner: Mira Holm · Epic: ENG-1431 · Shipped: Thursday 11 June · Shaped in Emargen as "MFA for administrators"

Why

An administrator can change who may open what for a whole organisation. A password alone is not enough. Marlow Cold Chain asked for it (SUP-834), and every security questionnaire asks.

What we built

• Every portal administrator who signs in with a password must use a second factor: a code from an authenticator app (TOTP).
• From 11 June, an administrator without MFA is asked to set it up at their next sign-in and can't continue until they have.
• Ten recovery codes, shown once at set-up.
• If an administrator loses their phone, another administrator of the same organisation resets their MFA. If there is no other, ACME support does it after checking who they are with the customer's sponsor.
• Administrators who sign in through Entra ID or Okta use their company's MFA. We don't add a second one.

What we left out

• SMS as a second factor: weaker, and costs us per message.
• Hardware keys (FIDO2). "Hardware keys for administrators" became an idea in October, after Halden asked.
• MFA for everyone: customers who want it get it through their own single sign-on.

Rollout

• 4 June: email to every administrator with a week's notice.
• 11 June: required.
• By 15 June: 186 administrators across our customers had set it up. Four needed a reset from support in the first week.