If you see Multi-Factor Authentication during the login process, then your site administrators have activated this to increase the security of your Asset Bank site.

If you are an Asset Bank admin who would like to have this activated for your site, then please contact support. 

How does it work?

When activated, users have an additional authentication step prior to accessing the site. After entering their email/password combination, they then have to enter an authentication code - this is either emailed to them or they can make use of an Authenticator App to generate the code.

More details

With MFA activated, the login process is as follows:  

First step, email/username and password

Second step, entering an authentication code

Remember me for 30 days

As Asset Bank has a 45 minute session timeout, we have included the option to remember your device for 30 days. This saves you having to re-authenticate every time you log in. (Note, we can change the number of days, see "Configuration" at the bottom of this article.)

Optional step - set up an authenticator app

When setting up MFA for the first time you'll be asked if you want to make use of an Authenticator app to generate the codes. It looks like this:

Optionally set up an authenticator app

This app allows you to generate MFA codes on your mobile device, e.g. your smart phone. Lots of users prefer using this method instead of email, though both work well and are equally secure. 

Examples include:

• Google Authenticator
• Microsoft Authenticator
• LastPass Authenticator

For Asset Bank MFA you can utilise any app that supports the time-based one-time password (TOTP) standards.

Resetting your MFA credentials

If you'd like to wipe your MFA credentials and go through the set-up process again, e.g. to set up an authenticator app or to wipe your remember me token, then you can do this via your profile.

Edit your profile

Then on your profile page scroll to the bottom, check the following box and hit save.

Reset MFA preferences from your profile page

Now when you next login, you'll be asked to set up MFA again.

Which accounts does MFA apply to?

If activated, then MFA will apply to all non-SSO (Single Sign On) user accounts. I.e. accounts where users currently have to log in with email/username and password. This is by design as organisations that utilise SSO can already incorporate MFA into this.

Configuration

We can change the number of days the "remember me" function works for. This saves the user having to use MFA again on the same device for a number of days. The default is 30, but if your internal IT Policy mandates something lower, like 14 or 7 days, then please let us know and we will change this for you.