Configure Multi-Factor Authentication (MFA) in an ArcGIS Enterprise portal using Google Authenticator

Summary

Multifactor authentication (MFA) is a security measure that is highly recommended to protect accounts and sensitive information. MFA provides increased security by requesting additional verification information when members sign in, such as a code obtained from an authenticator app.

This article describes the steps to configure multifactor authentication in an ArcGIS Enterprise portal for ArcGIS logins using Google Authenticator.

Procedure

Configure email settings

1. In the portal, navigate to Organization> Settings> Security> Email settings. Click Manage email settings and add the following items: 
   • SMTP server address: smtp.gmail.com 
   • SMTP port: 587
   • Encryption method: select STARTTLS 
2. Optionally, choose to enable SMTP authentication if required by toggling the SMTP authentication required button.
3. Add the Username from the email address and email address label for the admin user.
4. To provide the password, create an App password. To do that, open the Gmail app in a phone or tablet  and select Manage your Google Account. Search for ‘App Passwords’ and generate a new password. Type in this generated 16-character password in the Password section, as shown in the image below.

5. Click Next, and in the Configure email settings dialog, add an Email recipient to send a test email. Click Finish.

Enable multifactor authentication

1. Navigate to portal Organization> Settings> Security> Multifactor authentication and toggle on Enable multifactor authentication for organization.

2. Once multifactor authentication is toggled on, in the Desiganted administrators dialog, click Add designated administrators and designate at least two administrators to receive email requests to troubleshoot members’ multifactor authentication issues.

Enforce multifactor authentication

From ArcGIS Enterprise Portal 12.0, MFA in an organization can be optionally enforced, a member exemption list can also be created that removes listed members from enforcement. Refer to the document Enforce multifactor authentication. 

• Enforcement requires all members with ArcGIS logins to adopt multifactor authentication when signing in.

Member experience when multifactor authentication is enforced

Members with ArcGIS logins who are signing in again after multifactor authentication has been enforced are presented with a Multifactor Authentication dialog with the message "Your organization requires Multifactor Authentication (MFA)", as shown in the next image:

When signing in for the first time, a user is presented with a QR code used to configure the authenticator application.

1. Download and install the Google Authenticator application from the Play Store/App Store.
2. Click Add a code, and scan the QR code to get the six-digit code,
3. Paste the code into the portal Multifactor Authentication login interface, and click Verify to complete the sign-in.