ArcGIS Online

Configure multifactor authentication for ArcGIS logins

Multifactor authentication (MFA) is a security measure that is highly recommended to protect your accounts and sensitive information. MFA provides increased security by requesting additional verification information when members sign in, such as a code obtained from an authenticator app.

By configuring multifactor authentication, you can significantly enhance your organization’s security by preventing unauthorized access even if someone manages to obtain login credentials. Multifactor authentication is an essential, often mandatory, part of your organization’s security needs.

This blog article focuses on configuring multifactor authentication for ArcGIS logins only. For other supported login methods, please check with your identity provider.

About organization logins

Your organization can be configured to allow members to sign in using a variety of methods, such as ArcGIS logins, Security Assertion Markup Language (SAML) logins, OpenID Connect logins, and social logins.

In the Logins section in the Security tab of your organization settings, you can set login options and reorder them. Click Show login screen to view the current settings.

Organization logins
View larger image

Organization settings for multifactor authentication are only for ArcGIS logins and can only be configured by administrators or others with sufficient privileges.  Multifactor authentication for other methods other than ArcGIS logins must be configured via their respective identity providers.

For more information, see Configure security settings: Logins.

Enable multifactor authentication

In the Multifactor authentication section in the Security tab of your organization settings, you can Enable multifactor authentication for your organization.

Enable multifactor authentication

If you have not done so already, when you toggle multifactor authentication you will be prompted to designate at least two administrators who will receive email requests to troubleshoot members’ multifactor authentication issues. You can designate as many administrators as desired, ensuring that larger organizations, especially those covering multiple time zones, will have administrative help available if needed.

Once multifactor authentication has been enabled, you can optionally allow the use of recovery codes for organization members. Recovery codes are one-time use codes that provide second-step verification when members lose access to their authenticator app or security keys.

Without these recovery codes, members must contact organization administrators to sign in if their configured authenticator app or security keys are unavailable. Members using recovery codes are responsible for properly storing the information.

Allow use of recovery codes for MFA

Once Enable multifactor authentication for organization is toggled on, multifactor authentication is optional for members using ArcGIS logins unless enforced (see section below). MFA can be configured by individual organization members if they choose to do so. This setting can be found in the Security tab in the member profile settings. Members can click Enable to set up multifactor authentication for their account.

Member option to enable MFA

Once multifactor authentication has been enabled, administrators will see an MFA adoption status chart, showing how many members have set up multifactor authentication. This provides useful metrics for adoption and for moving forward with enforcement.

MFA adoption status

Enforcing multifactor authentication

Multifactor authentication provides the highest level of security when it is enforced throughout your organization. Enforcement will require all members with ArcGIS logins to adopt multifactor authentication when signing in. Once you enable multifactor authentication you will see an option to enforce it, as well as an option to create a member exemption list that removes listed members from enforcement.

Enforce multifactor authentication

Click Enforce MFA to enforce multifactor authentication for ArcGIS logins.

Enforce multifactor authentication

An information pane will display, underscoring considerations and the immediate implications of multifactor authentication enforcement.

Enforced MFA information pane

Things to consider:

If an exemption list has been configured, additional charts will be displayed, enabling you to track MFA adoption and showing the current status for required and exempt members.

MFA adoption status

Since this option circumvents multifactor authentication, it should be used only when special circumstances exist. For example, when a member needs additional time to procure and set up  a device, is out in the field  and does not have the means to set up MFA, and so forth.

Member experience when multifactor authentication is enforced

When multifactor authentication is enforced, all members using ArcGIS logins will need to use multifactor authentication to sign in to the organization. Members currently signed in with ArcGIS logins that have not set up MFA will be signed out immediately. All members using ArcGIS logins that have not set up multifactor authentication will be guided through the setup process the next time they sign in, and will need to have access to a TOTP authenticator app for completion.

Note that current activities, such as field data collection, map authoring, analysis, and other work may be interrupted. Best practices for ensuring minimal disruption of organization activities are listed in the best practices and considerations section below.

Members with ArcGIS logins signing in again after multifactor authentication has been enforced will see the following message:

MFA notification

Those signing in for the first time after enforced multifactor authentication will be presented with a QR code, used to configure the authenticator application. Use your camera via the authenticator app to complete the configuration.

QR code for authenticator app

Once configured, the authenticator application can be used to generate the required code, providing secure sign in access.

MFA authentication code

After successfully entering the security code, if the option to Allow use of recovery codes for members in the organization has been enabled, members signing in for the first time will be prompted to save the recovery codes (which they must acknowledge) and optionally register a security key.

Save recovery codes and register security key
View larger image

Security keys include USB devices, face recognition, a fingerprint, and other options. Security keys can be used as a second factor during authentication, following the first factor of a valid username and password.

Members are highly encouraged to configure one or more security keys. Security keys are considered the best choice for preventing phishing attacks, also reducing the time for members to authenticate.

Members can also go to the Multifactor Authentication section of their Security tab in their member profile settings to obtain recovery codes or register security keys for the second factor.

Profile security settings
View larger image

Best practices and considerations

When implementing multifactor authentication, the following are suggested:

Test the waters

If you are unsure about the impacts of multifactor authentication across your organization, you can set it up without enforcing it, giving members the option to try it out and the ability to provide feedback. You can gauge adoption via the MFA adoption chart and once you’ve reached a threshold of adoption, can move forward with enforcing multifactor authentication.

Plan in advance

Plan ahead for multifactor authentication, especially if you will enforce it. Enforcing multifactor authentication will automatically sign out any members with ArcGIS logins who have not yet enabled multifactor authentication, interrupting ongoing work and processes including field data workflows and analysis workflows.

To avoid unwanted disruptions, you can temporarily add members to the multifactor authentication exemption list. Members may also be unfamiliar with how MFA works and may need some time to install an authenticator app. Forward planning will minimize any confusion and interruptions.

Communicate your plans

Communicate in advance your intention to implement multifactor authentication and provide a target date. You can leverage the Information banner and Access notice settings to get the word out to members using ArcGIS logins. These settings are found in the Security tab of your organization settings.

Note that information banners are visible to anyone, including visitors to your site. Access notices are only seen when members sign in, therefore may be the better choice. For more information, see Get the word out: Use information banners and access notices in your ArcGIS organization.

Offer TOTP app suggestions

A wide variety of TOTP authenticator apps are available. Organization members may be unfamiliar with the options, so coming up with suggestions (perhaps with the guidance of your IT department) will ease the confusion.

Ensure the highest level of security

Your reasons for implementing multifactor authentication are based upon a need or requirement to increase the security of your organization. With that in mind, enforcing MFA is the logical choice. So is encouraging members to use security keys. Adopting multifactor authentication is a major step towards increased security. Ensuring compliance and best practices for members is a worthy goal when it comes to security. Adopting multifactor authentication is a significant step towards increased security, benefiting both users and organizations.


More information

For more information, see the following:

About the authors

Corporate technology evangelist and advocate at Esri, focusing on ways to broaden access to geographic information and helping customers succeed with the ArcGIS system. On a good day I'm making a map, on a great day I'm on one. Email bszukalski@esri.com or connect on LinkedIn (https://www.linkedin.com/in/bernszukalski/).

Connect:

Senior Principal Product Engineer on the ArcGIS Online development team, leading engineering effort on security, licensing, and ArcGIS Marketplace.

Next Article

What's New for 3D Analyst in ArcGIS Pro 3.3

Read this article