Skip to content
M↓ View as Markdown ↗

Multi-factor authentication (MFA)

Multi-factor authentication (MFA) protects your Actian AI Analyst account by asking for a one-time code in addition to your password, Google or Microsoft sign-in. Once you enroll, a password alone isn't enough to sign in.

Note

If you sign in through your company's single sign-on (Enterprise SSO), your company's identity provider handles MFA. The Multi-factor authentication section isn't shown to you in AI Analyst.

Turn on MFA

  1. Click your name at the bottom of the sidebar to open the account menu, then click Security. You can also go to Settings → Security (in the personal section, above Administration).
  2. Under Multi-factor authentication, turn on Enable MFA.
  3. Choose a method to enroll. (On self-managed deployments that use Keycloak, you set up MFA at sign-in instead. See the Self-managed deployments note later on this page.)
    • Enroll authenticator app: scan the QR code with an app such as Google Authenticator, Microsoft Authenticator or Authy. If you can't scan it, copy the Secret into your app instead. Enter the six-digit code from the app in Confirmation code and click Confirm.
    • Enroll email: AI Analyst sends a code to the email address shown. Enter the six-digit code in Confirmation code and click Confirm.
  4. If a Recovery code appears, copy it and store it somewhere safe, such as a password manager. It will not be shown again. Then click Done.

From now on, sign-in asks for a code from one of your enrolled methods. The section shows "MFA is on" and lists each method you enrolled.

If you see "That code didn't work. Try again.", check that you entered the latest code from your app or email, and try again.

Manage your methods

On your personal Security page (Settings → Security, not the one under Administration), under Multi-factor authentication, you can:

  • Add another method: click Enroll authenticator app or Enroll email and follow the same steps.
  • Get a new recovery code: click Regenerate recovery code. Copy the new code when it appears, because it is shown only once.
  • Remove a method: click Remove next to the method, then confirm Remove this sign-in method?. Sign-in no longer asks for that method's code. You can enroll it again at any time.

Turn off MFA

  1. Under Multi-factor authentication, turn off Enable MFA.
  2. In Turn off multi-factor authentication?, click Turn off.

This removes all your enrolled methods, and sign-in no longer asks for a code. If your organization requires MFA, you are asked to enroll again the next time you sign in.

Self-managed deployments

On self-managed deployments that sign in through Keycloak (the built-in identity service), you can't enroll an authenticator app or email codes, or regenerate a recovery code, from Settings → Security. Your next sign-in asks you to set up an authenticator app on the Keycloak sign-in page. Email codes and recovery codes aren't available.

On these deployments, removing a method or turning off MFA doesn't remove the second step. Instead, your next sign-in asks you to set up an authenticator app again. The confirmation dialog tells you when this applies.

Require MFA for your organization

Availability

  • Who can do this: members with the Manage organization capability (for the organization).
  • Deployment: Actian SaaS and self-managed deployments that don't use the built-in identity service (Keycloak). Require MFA can't be saved on Keycloak deployments.
  1. Go to Settings → Administration → Security.
  2. Under Authentication, turn on Require MFA.
  3. Click Save.

When Require MFA is on, everyone who signs in with password, Google or Microsoft must enroll in MFA when they sign in. People who already enrolled keep being asked for their code as before. People who sign in through Enterprise SSO aren't affected, because their identity provider handles MFA. See Enterprise SSO.

Other settings on the Security page

The personal Security page also has:

  • Password: click Send reset email to receive a link for choosing a new password. This section appears only if you sign in with a password.
  • Login sessions: the devices that are signed in to your account. Click Revoke to sign a device out. Revoking the session marked (this device) signs you out here.

See Security for details.