CCH Axcess™ Workflow: Multi-Factor Authentication 2-Step Verification - Frequently Asked Questions
- Article Type:
- Documentation
- Last Modified:
- 11/05/2022
Objectives
Listed below are some of the most frequently asked questions about 2-Step Verification in CCH Axcess™ Workflow.
Environment
- CCH Axcess Workflow
- Multi Factor Authentication
Details
Workflow MFA / 2-Step Verification FAQs
1. When can the firms start enabling MFA or the 2-step verification process?The 2-Step verification in CCH Axcess Workflow will be available starting 08/09 (2021-4.1 release)! Once a firm is ready to be enabled for the 2-step verification process and if each of the firm’s users that need to access Workflow has a valid email address please create a Support Case and we can implement it within 24 hours.
2. Can my firm disable 2-Step Verification?
To provide maximum security and comply with pending IRS requirements, 2-Step Verification is required for all firms. This option will become mandatory(required) from January 2022; however, firms can opt into being using it as of the 08/09 (2021-4.1 release)! If your firm would like to take advantage of the new 2-step verification process, please create a Support Case and we can implement it within 24 hours.
3. How often must I complete the 2-Step Verification process?
If your firm allows you to set devices as trusted devices, you can reduce how frequently you complete 2-Step Verification by selecting Trust this device when you log in to Workflow. You should not select this option if you are logging in to a shared or public computer. If this option is selected, you must complete a 2-Step Verification:
The first time you log in to Workflow using a unique device and browser combination.
After you have cleared the cookies in your browser on a trusted device
After resetting your password
On a schedule that is set by your Workflow administrator in the login setup options for your firm, in this case, it is 30 days by default.
If your firm does not allow you to set up trusted devices or if you do not select Trust this device, you must complete verification each time you log in.
4. If we set this up now, do we need to do it every day, or is it like Axcess where it will be once every 30 days?
If you select the ‘Trust this device’ checkbox when you log in to Workflow, then the setup needs to be done only after 30 days, like Axcess.
5. Why am I prompted to complete 2-Step Verification every time I log in, even after selecting Trust this device?
Your browser might be configured to delete cookies automatically. Disabling this option often solves the problem. Consult the documentation for your browser to learn how to change this option. If you are not comfortable updating these settings, contact your firm's IT team for assistance.
All users have the option to receive verification codes either over an email or a verified phone number. Multi-Factor Authentication (MFA) will be required for all firms in January 2022. In the future, the passcode will be delivered only to a verified phone number via text, and email addresses will no longer be allowed for the same. In preparation for this please ensure that all user profiles include the users’ phone numbers. We will provide additional info regarding the appropriate steps to prepare in subsequent communications.
7. Will the Workflow passwords expire like they do in CCH every 60 days or will that not change?
With the MFA opt-in, there is no change with the Workflow Password policy.
8. We log into Workflow via SSO. Will we be affected by this?
SSO and MFA are exclusive. A firm can only have one set at the same time, either SSO or MFA. Once the firm admin enables MFA for the firm, automatically SSO will be disabled and vice-versa.
With this initial opt-in release of MFA, users will have two options to receive the passcode on either user’s email address or a verified phone number. However, Multi-Factor Authentication (MFA) will be required for all firms in January 2022. In the future, the ability to receive passcodes via e-mail will be removed and verified phone numbers will become the only way of receiving the passcodes. In preparation for this please ensure that all user profiles include the user's phone numbers that are text eligible. We will provide additional info regarding the appropriate steps to prepare in subsequent communications.
With this initial opt-in release of MFA, we are using the user’s email address or a verified phone number to send the passcode. We will provide additional info regarding the other options like the authenticator to deliver the passcodes via text in subsequent communications.
11. Can the number be their work direct line, or does it have to be a cell?
The number should be a text eligible number. We will provide additional guidance in subsequent communications.
12. We would like to add multi-factor authentication to our user log-in process. I have gone in and added all our active users' cell phone numbers.
Multi-Factor Authentication (MFA) will be required for all firms in January 2022. Additionally, with this, the ability to receive passcodes via e-mail will be removed and replaced with phone numbers. In preparation for this please ensure that all user profiles include the users' phone numbers.
13. What is the next step in the process of getting this done, and what does the timeline of implementation looks like as we would like to let our employees know when this feature will be turned on?
The 2-Step verification in Workflow will be available starting 08/09 (2021-4.1 release)! Once a firm is ready to be enabled for the 2-step verification process and if each of the firm’s users that need to access Workflow has a valid email address please create a Support Case and we can implement it within 24 hours.
Additionally, Multi-Factor Authentication (MFA) will be required for all firms in January 2022. Additionally, with this, the ability to receive passcodes via e-mail will be removed and replaced with phone numbers. In preparation for this please ensure that all user profiles include the users' phone numbers.
14. We noticed that after we updated the cell phone numbers for our users, the cell phone numbers (which are personal numbers) are shown in the email template. Is there an option for you to create a default email without the person's cell phone number, which was added solely for the 2-step verification?
MFA can send the passcodes via voice messages to the desk phones. In January 2022, the MFA login process will allow users to select/enter a phone number to receive the MFA passcode.
15. Will there be a separate cell phone field, or will we use the existing phone field? If using the existing ones, we already have some with office numbers in them – how do we easily fix them?
The user’s profile will continue to have only one phone field. In January 2022, after the upgrade, the users will be allowed to log in for the first time via email-based MFA. During this login, the users will have an opportunity to input a phone number that is text/voice mail eligible Upon successful verification this number will also be updated on the user's profile.
16. In Axcess when it went to MFA, we spent a bunch of time putting in cell phone numbers ahead of time, but none would work and everyone had to enter their phone numbers again. So those users have all of the phone numbers listed twice, which is somewhat annoying. So will this work the same way – do we need to enter them in advance, or can the users do it when logging in the first time?
The user’s profile will continue to have only one phone field. In January 2022, after the upgrade, the users will be allowed to log in for the first time via email-based MFA. During this login, the users will have an opportunity to input a phone number that is text/voice mail eligible Upon successful verification this number will also be updated on the user's profile.
17. Is it possible for staff to start using MFA at different times?
When the firm is enabled with MFA all the users in the firm will be challenged with MFA at the same time.
18. Will the firms that are already doing the two-step authentication using Single-Sign-On/ SAML in conjunction with Duo Mobile 2FA, OKTA, and Right Networks be exempt from the Workflow MFA requirements?
Firms currently using SSO will be able to continue using SSO without being challenged with MFA.
19. Is it possible to import phone numbers into Workflow?
No, phone numbers will need to be entered for each user via the User’s profile.
Additional Information
N/A
| Solution Id | 000254472/CCH-Axcess-Workflow-Multi-Factor-Authentication-2-Step-Verification-Frequently-Asked-Questions |
|---|---|
| Direct Link |
