Available from 26 November: Customer Administrators will have new controls to enable, disable and reset MFA for users in their organisation.
As a Customer Administrator, you can enable, disable or reset multi-factor authentication (MFA) for users in your organisation.
MFA is mandatory for Customer Administrators who login with an email address and password. It can only be disabled for non-administrator users.
Before you begin
Login with your Customer Administrator account.
Check the user's name, email address and access level before making changes.
Keep MFA enabled wherever possible.
If a user loses access to their verification method, reset their MFA instead of disabling it.
Note: If your organisation uses single sign-on (SSO), your organisation manages authentication and MFA requirements. These controls apply to users who login with an email address and password.
Manage a user's MFA
Login to CreditorWatch.
Open the Users page.
Find the user you want to manage.
Select the appropriate MFA action:
Enable MFA: Turns MFA on. The user will be prompted to set up MFA at login if required.
Disable MFA: Turns MFA off for a non-administrator user.
Reset MFA: Clears the user's registered MFA method so they can set it up again. This does not reset their password or disable MFA.
Enable MFA for a user
On the Users page, find a user whose MFA is disabled.
Select Enable MFA.
Review the confirmation message and confirm the change.
Check that MFA is now enabled.
If the user hasn't set up MFA, they'll be prompted to do so at their next login once MFA enforcement is active.
Disable MFA for a user
Only disable MFA for a non-administrator user if they have an access problem that can't be resolved using an available MFA method. Disabling MFA removes the additional verification step and reduces account protection.
On the Users page, find a user whose MFA is enabled.
Select Disable MFA.
Review the confirmation message and confirm the change.
Check that MFA is now disabled.
Let the user know about the change.
Re-enable MFA when the user can use a supported method again.
Can I disable MFA for a Customer Administrator?
No. MFA is mandatory for Customer Administrators who login with an email address and password.
Customer Administrators can manage users, user roles, MFA, account details, billing details and settings. Mandatory MFA provides additional protection for these higher-risk accounts.
Reset MFA for a user
Reset MFA if a user loses access to their phone or authenticator app, or wants to change their MFA method.
Confirm the request is from the user by following your organisation's identity verification process. Don't ask for their password or verification codes.
On the Users page, find the user and select Reset MFA.
Review the confirmation message and confirm the reset.
Ask the user to login again with their email address and password.
The user will be prompted to set up an MFA method again at their next login once MFA enforcement is active. You don't need to complete the setup for them.
Resetting MFA doesn't reset the user's password or permanently exempt them from MFA.
If the user is temporarily blocked after repeated verification attempts, follow the on-screen instructions instead of assuming an MFA reset will remove the block.
MFA for new users
MFA is enabled by default for new users.
When adding a user, keep MFA enabled unless a non-administrator user requires an exception. New Customer Administrators can't be created with MFA disabled.
Once MFA enforcement is active, users with MFA enabled will complete setup at their first login.
Manage MFA for your own Customer Administrator account
MFA is mandatory for Customer Administrators who login with an email address and password.
Set up your MFA method when prompted and complete verification at login. Only select Remember this device on a private, trusted device.
If you lose access to your MFA method or need to change it, contact our Support Team. Support will verify your identity before arranging an MFA reset.
You'll then set up your MFA method again at your next login.
Change administrator access
If someone no longer needs Customer Administrator permissions, another Customer Administrator can change their access level. You can't lower your own access level.
Before making the change, make sure your organisation will retain at least one Customer Administrator with MFA enabled.
Open the Users page.
Open the administrator's Edit User Details page.
Change their Access level to User, or another appropriate non-administrator role, and save the change.
Check that the access level has been updated.
MFA can then be disabled if the user has a genuine need for an exception.
Don't change someone's access level just to avoid MFA. If they've lost access to their verification method, reset their MFA or contact Support.
Need more help?
Contact our Support Team if:
an MFA action fails
an MFA control isn't available
you need help recovering a Customer Administrator account.
Keep your account secure: Never share passwords, verification codes or authenticator setup QR codes.