topic Re: 2-Step verification? in Peer-Peer Topics

2-Step verification?

jasoncrcsd — Mon, 11 Sep 2023 14:12:48 GMT

So we have the accounts for staff setup to require MFA. I think we give them a grace perion of a few days etc. But if they don't unlike every other service that would just force them at that login but Google prevents them from loggin in at all. So they have to call, we have to move them to a different OU that doesn't enforce it. Make them set it up then, then move their account back to the correct OU. Is there a better way?

Re: 2-Step verification?

kraybr — Mon, 11 Sep 2023 14:17:13 GMT

Instead of having to move them to a separate OU, I've just established a group that disables the 2FA requirement. This way you don't need to move them, just add them to this group, give them time to update their account, and remove them from the group again. Pretty similar but helps prevent any other OU settings from being lost. No other smooth way around it besides a phone call or email from a supervisor.

Re: 2-Step verification?

Kim_Nilsson — Mon, 11 Sep 2023 14:20:01 GMT

Or send them, or have them pick up, two backup codes, and tell them that they will not get any more.

Re: 2-Step verification?

jasoncrcsd — Mon, 11 Sep 2023 14:41:37 GMT

I wish but the Admin would never allow it. They'd say how can the user teach if they cannot login.

Re: 2-Step verification?

Kelly_McMahon — Mon, 11 Sep 2023 18:48:40 GMT

Yes, this happened to me with some of our new staff this year and the only thing I could do was to move them to a different OU that does not enforce 2FA. I will have to look into the idea of putting them into a group

Re: 2-Step verification?

Kim_Nilsson — Mon, 11 Sep 2023 18:51:52 GMT

Using a group to either include or exclude works very well, and is a fast change, not having to wait for OU propagation.

Re: 2-Step verification?

MattFeider — Mon, 11 Sep 2023 21:45:48 GMT

one better method I have found...

for those staff that haven't setup 2FA and find themselves blocked.

simply go to their account in the admin console, find the area for 2FA, and generate temporary codes...then let them use one to log in and finish the setup. There is a button on each users account to generate the codes

Matt

Re: 2-Step verification?

Kelly_McMahon — Tue, 12 Sep 2023 13:17:34 GMT

I am pretty sure I tried this but since 2FA was not set up, I could not generate codes. You got this to work? Maybe I was doing something wrong.

Re: 2-Step verification?

Kim_Nilsson — Tue, 12 Sep 2023 13:21:24 GMT

A users who has ignored the advice to set up 2FA will be caught out, as the account now has Enforced 2FA and the user doesn't have it. As soon as the enforcement is in play, you can create backup codes.

Re: 2-Step verification?

Kelly_McMahon — Tue, 12 Sep 2023 13:39:29 GMT

Yes, this is what I experienced.

Re: 2-Step verification?

MattFeider — Tue, 12 Sep 2023 13:45:09 GMT

Yes, works well...the only gotcha I have found to be aware of...if said person uses the temporary code in the gmail app on a phone, you may have to repeat as the gmail app doesn't appear to kick off the required process to complete the process and continue to setup 2fa...but if you coach the user to use a browser it does work as expected...after you generate the temporary codes the person is appropriately prompted the next time they attempt a login.

I have found this also works when I create a user in an enforced 2fa OU...and the user doesn't attempt the login in the required time (as the counter seems to start when you create the user, not first login). I ran into new staff members over the summer...I would create them and then too much time passed prior to their first attempt.

Re: 2-Step verification?

MattDPenn — Tue, 12 Sep 2023 16:46:16 GMT

I'd counter with "teachers had several days to do something that only takes a few minutes, they can wait a bit longer to get unstuck". We've rolled out 2FA at my district over the last year and in the interim for those we weren't able to get set up right from the get go (partially due to a weird bug on Google's side that seems resolved now) the backup code solution was my go to for getting them in and finishing the 2FA set up. Granted I'm also a tiny school district so your mileage may vary.

Re: 2-Step verification?

alexgrutza — Thu, 12 Oct 2023 13:23:51 GMT

We're in a similar situation but I'm a little confused.

If we highlight the TLD and select "MFA On", that means entire workspace MFA is On.

If we then select TLD and checkmark the "mfabypass" group, and set the setting to "Off", that would mean "if a user is in our entire domain AND they're in the mfabypass group = MFA Off", but leave the rest of the workspace to "MFA On"?

Re: 2-Step verification?

Kim_Nilsson — Thu, 12 Oct 2023 13:56:22 GMT

Yes, Group overrides OU.