Enable multi-factor authentication (MFA)

The platform owner can require multi-factor authentication (MFA) for all users who log in with a password. Users then enter a 6-digit code from an authenticator app, such as Google Authenticator, Microsoft Authenticator, or Authy, at every password login. On the login page and in their profile, users see this as Two-factor authentication.

MFA applies to logins with an email address or a username and a password. It doesn't apply to:

• SSO logins. Your identity provider handles MFA for these.
• Login without a password.
• Auto-login links.
• Logging in as another user.
• Account activation and self-registration.

To stop users from skipping MFA with login without a password or auto-login links, clear Activate login without password and Activate links with an authentication code in the emails in the Access & Security section of the platform's advanced settings.

Before you enable MFA, make sure mobile users have version 8.47.0 or later of the 360Learning app. Older versions cannot log in once MFA is enabled.

Enable MFA

MFA applies from each user's next password login. Users who are already logged in stay logged in.

1. In the left sidebar, hover over the platform group (the one with a golden crown), then click  Settings.
2. In the left sidebar, click Advanced.
3. In the Access & Security section, select Activate multi-factor authentication.
4. Click Enable MFA.

How users log in with MFA

Users can use the authenticator app they already have. Users without one must first install one, such as Google Authenticator, Microsoft Authenticator, or Authy.

The first time they log in with a password after MFA is enabled, users set up their authenticator app:

1. After entering their password, they click Get started.
2. They add their account to their authenticator app: they scan the QR code, click the setup link, or enter the setup code in the app manually. Then they click Continue.
3. They enter the 6-digit code generated by the app, then click Continue.

At every later password login, users enter a new 6-digit code from their app. The platform doesn't remember devices between logins.

Users have 5 minutes to complete the MFA step. After that, they must log in again.

Reset the MFA of a user

Admins of any group the user belongs to can remove a user's authentication method, for example if the user lost access to their authenticator app. The user sets up MFA again at their next password login.

1. At the top of the homepage, click Users.
2. In the left sidebar, click on the group of the user.
3. In the left sidebar, under Current members, click All.
4. On the right of a user, click .
5. In the Authentication section, under Two-factor authentication, click  Remove method.
6. Click Remove method.

Users can also remove their own authentication method from their profile settings. They set up a new one at their next password login.

If the platform owner loses access to their authenticator app and no other admin can reset it, contact 360Learning support.

Disable MFA

Disabling MFA keeps each user's authentication method. If you enable MFA again, users log in with the same authenticator app.

1. In the left sidebar, hover over the platform group (the one with a golden crown), then click  Settings.
2. In the left sidebar, click Advanced.
3. In the Access & Security section, clear Activate multi-factor authentication.
4. Click Disable MFA.