How to: Enable Multi-Factor Authentication for Unqork Environments

Multi-factor authentication (MFA) requires users to verify their identity using a secondary method after entering their credentials. Unqork supports MFA for both Creator and Express user accounts. MFA applies only to local Unqork accounts. SSO users authenticate through their identity provider, which manages MFA independently.

Important: MFA is a global environment setting. It cannot be enabled for individual accounts or roles, and it cannot be enabled for Creator accounts independently of Express accounts.

Before You Begin

If your environment uses Text (SMS) or Phone Call delivery, every user account must have a valid phone number before MFA can be enabled. Any account without a phone number receives an error when attempting to log in after MFA is enabled.

Note: The phone number requirement applies only to Text (SMS) and Phone Call delivery. Email delivery does not require a phone number on the user's account.

To verify that users have phone numbers on their accounts, export a user list from Creator (User) Administration or Express User Administration.

Export Creator user accounts:

1. In the Unqork platform, select Administration from the navigation menu.

2. Select Creator (User) Administration.

3. At the top right of the page, click Export All Creators. A  file containing Creator accounts and their associated data downloads to your machine.

4. Open the file and confirm that all accounts include a valid phone number.

Export Express user accounts:

1. In the Unqork platform, select Administration from the navigation menu.

2. Select Express User Administration.

3. At the bottom of the page, click Export All Express Users. A CSV file containing Express user accounts and their associated data downloads to your machine.

4. Open the file and confirm that all accounts include a valid phone number.

If any accounts are missing phone numbers and your environment uses Text (SMS) or Phone Call delivery, add them before requesting MFA activation.

Add phone numbers to Creator accounts:

Creator accounts do not support bulk import. Update each account individually in Creator (User) Administration.

Add phone numbers to Express user accounts:

Express User Administration supports bulk import. Add a phone column to the exported CSV and populate the missing phone numbers. Re-upload the file using the Upload Users File option in Express User Administration.

Request MFA Activation

After verifying that all user accounts meet the delivery method requirements, submit a support ticket to request MFA activation for your environment.

1. Go to Unqork Support and log in.

2. Click Submit a Request.

3. In the Subject field, enter a description. For example: Enable MFA for Environment: training.unqork.io.

4. From the Request Type drop-down, select Issue.

5. From the Issue Type drop-down, select Environment Management.

6. From the Task Topic drop-down, select Other.

7. In the Description field, include the environment name and URL where MFA should be enabled. For example: Please enable MFA for the following environments: training.unqork.io, training-staging.unqork.io.

8. Click Submit.

Unqork Support contacts you with further directions after receiving the request.

How MFA Works

After MFA is enabled, the login process changes for all local Unqork accounts in the environment.

Login flow:

1. The end-user enters their email address and password on the Unqork login screen.

2. A Verify it's you screen displays the delivery methods enabled for the environment. The end-user selects a method and clicks Send Code. This screen is always shown, even when only one delivery method is enabled.

3. A verification code is sent to the end-user. Codes are six digits and expire after 10 minutes. After three failed attempts, the code is invalidated and the end-user must request a new one.

4. A code entry screen displays. The end-user enters the code and clicks Verify and Login to complete login. If the code does not arrive, the end-user can click Resend Code.

Unqork supports the following MFA delivery methods:

Email Verification Details

When Email is the selected delivery method, Unqork sends a message with the following format:

The email address shown on the delivery method selection screen is partially obfuscated for security. For example, testuser@example.com displays as t*****r@e*****.

Frequently Asked Questions

Can MFA be enabled for Creator and Express accounts independently?

No. Enabling MFA applies it to all local accounts in the environment, both Creator and Express.

Can I use both SSO and Unqork's MFA in the same environment?

Yes. A mix of local Unqork accounts and SSO accounts is supported in the same environment. For example, internal users might authenticate through SSO, where the identity provider handles MFA. External users set up as local Unqork accounts use Unqork's built-in MFA.

Does Unqork's MFA work for SSO users?

No. SSO users authenticate through their identity provider. The identity provider is responsible for MFA for those accounts.

Can the MFA login page be styled?

Only the Express login page can be styled. Submit a support ticket to Unqork Support to request a styled Express login page.

Can I use a custom Express login page with MFA?

No. Custom Express login pages are not compatible with MFA.

What does the MFA verification email look like?

See Email Verification Details above for the default subject and body. Custom email templates are not currently supported.

Limitations

• MFA cannot be enabled independently for Creator and Express accounts. Enabling MFA applies it to both.

• MFA cannot be enabled on a per-user or per-role basis.

• Custom Express login pages are not compatible with MFA.

• MFA does not apply to SSO users. For SSO accounts, the identity provider handles MFA.