How to enable two-factor authentication after password logon - Identity as a Service

This topic describes how to use two-factor authentication and how to attach a two-factor authentication method during logon.

Two-factor authentication configuration

IDaaS EIAM supports two-factor authentication after password logon to improve security management and meet compliance requirements. To ensure your security, two-factor authentication is enabled by default.

Enable modes

IDaaS EIAM supports two modes for enabling two-factor authentication.

Mode

Scenarios

Description

Intelligent mode (recommended)

When the system detects the following high-risk logon behaviors, it automatically triggers intelligent mode verification to enhance account security:

Logon from an unusual geographic location. The system detects when a user logs on from an unfamiliar country/region or an unusual IP address range (for example, if a user typically logs on from Beijing but suddenly logs on from overseas).
Logon from an unusual device. Using an unrecorded device (such as a new phone/browser) or logging on to an account for the first time.
High-risk operation behavior. Attempting to access sensitive permissions (such as the administrator console) or frequently modifying account security settings (such as resetting passwords multiple times).
System risk policy match. The system detects the use of anonymity tools such as proxies/VPNs in the current network environment, or successful logon attempts after multiple failed logons within a short period.

After this mode is enabled, IDaaS EIAM determines whether two-factor authentication is required based on the context, reducing user complexity while ensuring security.

Always-on mode

Sensitive business systems with extremely high security requirements.
Scenarios where regulatory compliance requires verification for each logon.
Privileged accounts such as administrator accounts.

Two-factor authentication is required for each sign-in.

Two-factor authentication methods

IDaaS EIAM supports multiple two-factor authentication methods. Administrators can enable multiple methods simultaneously.

Method	Description
OTP dynamic password	Use the Alibaba Cloud app or other common OTP apps (such as Google Authenticator) to enter a 6-digit dynamic password to complete two-factor authentication. Users can attach OTP in the account management section of the IDaaS EIAM application portal. For more information, see User self-service. Administrators can help users detach OTP dynamic passwords. For more information, see OTP-Attached dynamic password.
SMS verification code	A 6-digit verification code is sent to the phone number associated with the IDaaS EIAM account. If the account does not have a phone number, this method cannot be used. SMS is free of charge. You can view the text message content in the SMS template menu.
Email verification code	A 6-digit verification code is sent to the email address associated with the IDaaS EIAM account. If the account does not have an email address, this method cannot be used. You can view the email content in the Email template menu.
WebAuthn	Use a WebAuthn authenticator as a second authentication factor to achieve hardware-level secure and convenient authentication. For more information, see Advanced: WebAuthn secure logon. Administrators can help users register and delete WebAuthn authenticators. For more information, see WebAuthn-Registered authenticators.

Note

If an IDaaS EIAM account does not have an available two-factor authentication method, the account cannot pass two-factor authentication. We recommend that you enable Attach two-factor authentication during logon or ensure that all IDaaS accounts can use at least one two-factor authentication method.

After two-factor authentication is enabled, all IDaaS EIAM accounts can use it. Users can select their preferred method during the two-factor authentication step. See the following figure:

Attach two-factor authentication during logon

By attaching a two-factor authentication method, accounts without a two-factor authentication method can directly attach one during logon if they meet the attachment conditions.

Attachment conditions

An account can attach a two-factor authentication method during logon only when it meets all enabled attachment conditions.

Method	Description
Account has no available two-factor authentication method	This condition is met when the account has not attached any of the enabled two-factor authentication methods. For example, if SMS verification code authentication is enabled but the account only has an email address attached, this condition is met.
Account has no successful logon record	This condition is met if the account has never successfully logged on to IDaaS EIAM. We recommend enabling this condition (or enabling it after existing accounts have completed attachment) to reduce the risk of existing accounts being compromised.
Account created less than n days ago	This means that only new accounts can attach within a certain time period. We recommend enabling this condition to reduce the risk of existing accounts being compromised.

Two-factor authentication methods that can be attached

When an account meets the attachment conditions, if an enabled two-factor authentication method is also an attachable two-factor authentication method, it can be attached.

For example, if an instance has enabled SMS and email verification codes as two-factor authentication methods, but only SMS verification code is enabled as an attachable two-factor authentication method.

If an account has not attached a phone number or email address, it can attach a phone number during logon but cannot attach an email address.