Setting up Two-Factor Authentication (TFA) - Microsoft Authenticator

Microsoft Authenticator is a software-based authentication token developed by Microsoft. The token provides a six-digit number that users must enter as the second factor of authentication. You need to install the Microsoft Authenticator app on your smart phone or tablet devices. It generates a six-digit number, which changes every 30 seconds. With the app, you don’t have to wait a few seconds to receive a text message.

Sequence of Events

1. A user tries to access PAM360 web-interface.
2. PAM360 authenticates the user through Active Directory or LDAP or locally (first factor).
3. PAM360 requests for the second factor credential through Microsoft Authenticator.
4. The user has to enter the six-digit token that they see on the Microsoft Authenticator app GUI.
5. PAM360 grants the user access to the web-interface.

This document walks you through the following topics:

1. Configuring TFA in PAM360
2. Enforcing TFA for the Required Users
3. Connecting to PAM360 Web Interface when TFA via Microsoft Authenticator is Enabled

   3.1 Prerequisite

   3.2 Connecting to the PAM360 Web Interface

4. Troubleshooting Tip

1. Configuring TFA in PAM360

1. Navigate to Admin >> Authentication >> TFA.
2. Choose the option Microsoft Authenticator, and click Save.

   

3. Click Confirm to enforce Microsoft Authenticator as the second factor of authentication.

   

2. Enforcing TFA for the Required Users

1. Once you confirm Microsoft Authenticator as the second factor of authentication in the previous step, a new window will prompt you to select the users for whom TFA should be enforced.

   

2. You can enable or disable TFA for a single user or multiple users in bulk from here. To enable TFA for a single user, click on the 'Enable' button beside their respective username. For multiple users, select the required usernames and click on 'Enable' at the top of the user list. Similarly, you can also 'Disable' TFA from here.
3. Close the window.
4. You can also select the users later by navigating to Users >> More Actions >> Two-factor Authentication.

   

5. In the window that opens, select the users for whom you want to enforce Microsoft Authenticator TFA.

3. Connecting to PAM360 Web Interface when TFA via Microsoft Authenticator is Enabled

3.1 Prerequisite

To use Microsoft Authenticator as the second factor of authentication, you should first install the app in your smart phone or tablet.

3.2 Connecting to the PAM360 Web Interface

The users for whom TFA is enabled will have to authenticate twice successively. The first level of authentication will be through the usual authentication, i.e., the users have to authenticate through PAM360's local authentication or AD/LDAP authentication, whichever is enabled.

1. Launch PAM360 web interface, enter the Username and Password (local authentication or AD/LDAP), and click Login.
2. Associating Microsoft Authenticator with your PAM360 account:
   
3. When you are logging in for the first time after enabling TFA through Microsoft Authenticator, you will be prompted to associate it with your account in PAM360. After launching the Microsoft Authenticator app in your mobile device or tablet, click on Add Account or the + button. Choose Other (Google, Facebook, etc.) for the kind of account you're adding, since PAM360 is not a Microsoft extension.
4. Here, you can either scan the QR code displayed in your PAM360 website by scanning the barcode shown in the GUI, or Enter Code Manually.
5. If you choose to enter the code manually, the GUI will prompt you to enter an account name and a security key.
6. Supply an Account name for your PAM360 account in the format– PAM360:account name (for example. PAM360:john@abc.com).
7. Provide an alphanumeric string as your Secret key, and then click Finish.
8. Microsoft Authenticator will now start generating codes periodically, that changes every 30 seconds.
9. You can enter this code in the text box provided in the PAM360 login page for the second level of authentication.

4. Troubleshooting Tip

As mentioned earlier, the Microsoft Authenticator is associated with your PAM360 account. If you ever lose your mobile device/tablet OR if you accidentally delete the Microsoft Authenticator app on your device, you will still be able to get tokens to log in to PAM360. In such scenarios, just click the link "Have trouble using Microsoft Authenticator?" in the PAM360 login screen. You will be prompted to enter your PAM360 username and the email address associated with PAM360. Once done, you will receive instructions to get Microsoft Authenticator again.

If You have Configured High Availability:

Whenever you enable TFA or when you change the TFA type (PhoneFactor, RSA SecurID, One-time password, RADIUS, or Duo) and if you have configured high availability, you need to restart the PAM360 secondary server once.