MFA (English): Forskjell mellom sideversjoner

Fra IThjelp
Ingen redigeringsforklaring
Ingen redigeringsforklaring
 
(16 mellomliggende versjoner av en annen bruker er ikke vist)
Linje 1: Linje 1:
__TOC__
__TOC__
[-Translationwork in progress Sept 2020-]


===Why are we using MFA?===
===Why are we using MFA?===


IT Security has changed quite a bit over the last few years. Among other things, it has become more difficult to detect fraud attempts where usernames and passwords are lost.<br>
IT Security has changed quite a bit over the last few years. Among other things, it has become more difficult to detect fraud attempts where usernames and passwords are lost.<br>
One of the most effective measures is to introduce multi-factor authentication (MFA). UiB is now introducing MFA for all employees and students. This will in the first place<br>
One of the most effective measures is to introduce multi-factor authentication (MFA). UiB is now introducing MFA for all employees and students. This will primarily<br>
be introduced for Office 365-related products and services.<br>
be introduced for Office 365-related products and services.<br>


Linje 12: Linje 10:


MFA stands for Multi Factor Authentication and basically means that you use two factors to confirm your identity when logging in.<br>
MFA stands for Multi Factor Authentication and basically means that you use two factors to confirm your identity when logging in.<br>
One factor is of course your password and the other factor is to confirm via either SMS or an App (Authenticator).<br>
One factor is of course your password and the other factor is to confirm your identity via either SMS or an App (Authenticator).<br>
This means that the data you have access to using your user profile is 99.9% less exposed to the risk of identity theft. <br>
This means that the data you have access to is 99.9% less exposed to the risk of identity theft. <br>


===How do I sign up for MFA?===
===How do I sign up for MFA?===


[[fil:MFA-knapp.png|300px|link=https://forms.office.com/Pages/ResponsePage.aspx?id=vCSKZI2pJUCcYEjBmhQgaUSaNnhGjXpItHDMNajO5dxUQ05TVjE5R0c4NzREN1lLU0UyNzJHVkVMWi4u |alt="Click here to activate MFA for your account"]]
[[fil:MFA-knapp-eng.png|300px|link=https://forms.office.com/Pages/ResponsePage.aspx?id=vCSKZI2pJUCcYEjBmhQgadjzpqjRBg5AhSw9LeZEDmpUMEZRWTdROTJWOFNISVAwVEVEQkNSUkRCQiQlQCN0PWcu |alt="Click here to activate MFA for your account"]]


If you do not already have MFA activated and want to use it, you can fill out the form linked to on the blue button above. Then you will at the next login <br>
If you do not already have MFA activated and want to use it, you can fill out the form linked to on the blue button above. Then you will at the next login <br>
on an Office365 service such as Teams, OneDrive or the Office Portal be prompted to set up MFA. After completing the form, it is recommended to log out of the Office session <br>
to an Office365 service such as Teams, OneDrive or the Office Portal be prompted to set up MFA. After completing the form, it is recommended to log out of the Office session <br>
in the browser by going to the [http://portal.office.com Officeportal], select "Log out /" Sign out "on your profile at the top right - and then Log in again. You should now be asked to set up MFA .<br>
in the browser by going to the [http://portal.office.com Officeportal], select '''Sign out''' on your profile at the top right - and then Log in again. You should now be asked to set up MFA .<br>


===What do I as a user have to do to use MFA properly?===
===How do I use MFA properly?===


The first time you log in after MFA is activated, you must set up the service with your personal contact information. This should be done via PC and you would also need access to your <br>
The first time you log in after MFA is activated, you must set up the service with your personal contact information. This should be done via PC and you would also need access to your <br>
mobile phone. When the service is activated, you will be prompted to add the information. It is possible to use both SMS or an App to confirm <br>
mobile phone. When the service is activated, you will be prompted to add the information. It is possible to use both SMS or an App to confirm your identity. Which of the two you choose<br>
your identity. Which of the two you choose to use is a matter of your own preference, but UiB recommends using the app for this because it is easier to use and faster than typing <br>
to use is a matter of your own preference, but UiB recommends using the app for this because it is easier to use and faster than typing a verification code each time. <br>
a verification code each time. <br>
<br>
<br>
If you want help down the road, you can use the following step-by-step guide to set up the service for your user: https://it.uib.no/Aktivere_MFA (Norwegian)<br>
If you want help down the road, you can use the following step-by-step guide to set up the service for your user: https://it.uib.no/Aktivere_MFA (Norwegian)<br>
Linje 34: Linje 31:
===Conditional access excludes MFA in certain cases===
===Conditional access excludes MFA in certain cases===


* Duration of 30 days per session (Example: Word, PowerPoint, browser). If you use different browsers this will be different sessions. You should therefore be able to get away with one authentication per 30 days, per application. <br>
* Duration of 30 days per session (Example: Word, PowerPoint, browser). If you use different browsers this will be different sessions. You should therefore usually be asked only one authentication per 30 days, per application. <br>
* For machines that are client-driven, we will in the long run require that you use Windows Hello with PIN or biometrics, which together with TPM works as the second factor. <br>
* For client-driven computers, we will in the long run require that you use Windows Hello with PIN or a biometric device, which together with TPM works as the second factor. <br>
 
* Varighet på 30 dager per sesjon (Eksempel: Word, PowerPoint, nettleser). Hvis du bruker ulike nettlesere bli dette ulike sesjoner. Du skal derfor kunne slippe unna med én autentisering per 30 dager, per applikasjon.<br>
* For maskiner som er klientdriftet vil vi på sikt kreve at benytter Windows Hello med PIN eller biometri som sammen med TPM fungerer som den andre faktoren.<br>


===Hvordan endrer jeg standard autentiseringsmetode?===
===How do I change my default authentication method?===


Du kan selv endre hvilken metode som er standard for din bruker. Du kan fint legge til flere metoder slik at du har flere muligheter ved å trykke "Legg til metode".<br>
You can change which method is the default for your user. You can easily add more methods so that you have more options by pressing '''Add method'''. <br>
Dette styrer du via [https://account.activedirectory.windowsazure.com/Proofup.aspx?BrandContextID=O365&ruO365 denne siden]. Trykk Endre for å endre metode:<br>
You can edit this trough [https://account.activedirectory.windowsazure.com/Proofup.aspx?BrandContextID=O365&ruO365 this page]. Press '''Change''' to change method: <br>
[[File:MFA-Endtestd.png|400px]]<br><br>
[[File:MFA-Endtestd-eng.png|400px]]<br><br>
Deretter velger du ønsket metode - i dette eksemplet endrer vi til "Microsoft Authenticator - varsling".<br>
Then select the desired method - in this example we change to "Microsoft Authenticator - notification".<br>
[[File:MFA-Endtestd2.png|400px]]<br><br>
[[File:MFA-Endtestd2-eng.png|400px]]<br><br>
Etterpå kan vi se at standardmetoden nå er endret:<br>
Afterwards we can see that the default method has changed:<br>
[[File:MFA-Endtestd3.png|400px]]
[[File:MFA-Endtestd3-eng.png|400px]]


===Hva hvis jeg glemmer mobiltelefonen hjemme?===
===What if I forget my cell phone at home?===
Du vil sjelden bli spurt om MFA om du sitter på en maskin som er satt opp av IT-avdelingen.<br>
You will rarely be asked about MFA if you are using a computer set up by the IT department.<br>


===Hva hvis jeg mister mobiltelefonen min?===
===What if I lose my cell phone?===
Ta kontakt med [https://it.uib.no/IT_brukerst%C3%B8tte BRITA (Brukerstøtte ved IT-avdelingen)] snarest dersom du mister mobiltelefonen din.<br>
Consult [https://it.uib.no/IT_brukerst%C3%B8tte BRITA (Support from IT-department)] as soon as possible if you lose your mobile phone.<br>
For å reaktivere MFA mot en ny telefon vil du [[#Hva_m.C3.A5_jeg_selv_som_bruker_gj.C3.B8re_for_.C3.A5_ta_i_bruk_MFA_p.C3.A5_en_god_m.C3.A5te.3F|måtte følge veiledningen for førstegangsoppsett på nytt.]]<br>
To reactivate MFA with a new phone you will [[#How_do_I_use_MFA_properly.3F|have to follow the instructions for initial setup over again.]]<br>


===Nyttig info===
===Useful info===
* Kontoer med adminroller har allerede MFA.<br>
* Accounts with admin roles already have MFA.<br>
* Vi anbefaler "Microsoft Authenticator" APP med ett trykks godkjenning for Android og iOS. Google Authenticator fungerer også, men da med sekssfifret kode og ikke ett trykk.<br>
* We recommend using the "Microsoft Authenticator" APP with one-touch authentication for Android and iOS. Google Authenticator also works, but then with six-digit code and not one touch.<br>
* Vi ønsker også å tilby USB-stick som et alternativ til Authenticator App. Gi en lyd hvis du vil være med å teste dette.<br>
* We also want to offer USB stick as an alternative to the Authenticator App. Contact support if you want to test this.<br>
* Endringen er meldt her: https://bs.uib.no/?module=change&action=view&tid=8947<br>
* The change is announced here: https://bs.uib.no/?module=change&action=view&tid=8947<br>
* Om ønskelig kan man også på forhånd bruke denne lenken for å sette opp ønsket metode og også laste ned og konfigurere appen:<br>https://account.activedirectory.windowsazure.com/Proofup.aspx?BrandContextID=O365&ruO365
* If you want to prepare - you can use this link in advance to set up the desired method and also to download and configure the app:<br>https://account.activedirectory.windowsazure.com/Proofup.aspx?BrandContextID=O365&ruO365
* Samme lenke kan også benyttes for å endre standardvalg for godkjenning senere.<br>
* The same link can also be used to change the default selection for approval later.<br>
* Dersom du ønsker å vite mer om MFA [https://www.microsoft.com/nb-no/security/business/identity/mfa kan du lese mer her].
* If you want to know more about MFA [https://www.microsoft.com/nb-no/security/business/identity/mfa you can read more about it here].


[[Kategori:MFA]]
[[Kategori:MFA]]
[[Kategori:Office 365]]
[[Kategori:Office 365]]
[[Kategori:Tjenester fra IT-avdelingen]]
[[Kategori:Tjenester fra IT-avdelingen]]

Siste sideversjon per 14. sep. 2020 kl. 08:47

Why are we using MFA?

IT Security has changed quite a bit over the last few years. Among other things, it has become more difficult to detect fraud attempts where usernames and passwords are lost.
One of the most effective measures is to introduce multi-factor authentication (MFA). UiB is now introducing MFA for all employees and students. This will primarily
be introduced for Office 365-related products and services.

What is MFA?

MFA stands for Multi Factor Authentication and basically means that you use two factors to confirm your identity when logging in.
One factor is of course your password and the other factor is to confirm your identity via either SMS or an App (Authenticator).
This means that the data you have access to is 99.9% less exposed to the risk of identity theft.

How do I sign up for MFA?

"Click here to activate MFA for your account"

If you do not already have MFA activated and want to use it, you can fill out the form linked to on the blue button above. Then you will at the next login
to an Office365 service such as Teams, OneDrive or the Office Portal be prompted to set up MFA. After completing the form, it is recommended to log out of the Office session
in the browser by going to the Officeportal, select Sign out on your profile at the top right - and then Log in again. You should now be asked to set up MFA .

How do I use MFA properly?

The first time you log in after MFA is activated, you must set up the service with your personal contact information. This should be done via PC and you would also need access to your
mobile phone. When the service is activated, you will be prompted to add the information. It is possible to use both SMS or an App to confirm your identity. Which of the two you choose
to use is a matter of your own preference, but UiB recommends using the app for this because it is easier to use and faster than typing a verification code each time.

If you want help down the road, you can use the following step-by-step guide to set up the service for your user: https://it.uib.no/Aktivere_MFA (Norwegian)

Conditional access excludes MFA in certain cases

  • Duration of 30 days per session (Example: Word, PowerPoint, browser). If you use different browsers this will be different sessions. You should therefore usually be asked only one authentication per 30 days, per application.
  • For client-driven computers, we will in the long run require that you use Windows Hello with PIN or a biometric device, which together with TPM works as the second factor.

How do I change my default authentication method?

You can change which method is the default for your user. You can easily add more methods so that you have more options by pressing Add method.
You can edit this trough this page. Press Change to change method:
MFA-Endtestd-eng.png

Then select the desired method - in this example we change to "Microsoft Authenticator - notification".
MFA-Endtestd2-eng.png

Afterwards we can see that the default method has changed:
MFA-Endtestd3-eng.png

What if I forget my cell phone at home?

You will rarely be asked about MFA if you are using a computer set up by the IT department.

What if I lose my cell phone?

Consult BRITA (Support from IT-department) as soon as possible if you lose your mobile phone.
To reactivate MFA with a new phone you will have to follow the instructions for initial setup over again.

Useful info