Second authentication factor (MFA)

The second authentication factor is a Premium plan option, enabled by Omniscol on request. Your school then chooses the roles concerned and the second authentication factors it accepts.

Enabling the second authentication factor

In Administration → Settings, section Security, the Configure button on the Second authentication factor (MFA) line opens the configuration:

• Roles concerned — the roles whose accounts prove a second authentication factor: Administrator, Staff, Teacher. With no role chosen, the option is inactive. Students never have a second authentication factor to prove.
• Accepted second authentication factors — what an account can register: Passkey, Authenticator app or Code by email. At least one.
• Remember the browser — offers, when proving the second authentication factor, to stop asking for it on this browser for the number of days you set, from 1 to 90. The password is still asked for.

Next to the button, a label shows whether the option is active, and for which roles.

As soon as the option is saved, the session of an account of a chosen role, opened without a second authentication factor, is interrupted at its next action: the person signs in again and registers theirs. The applications they had authorized beforehand, an assistant connected through MCP for example, must be authorized again.

At login

After their password, an account of a chosen role goes through a second step.

First login: registering a second authentication factor

At its first login, the account registers a second authentication factor, among those the school accepts:

• Passkey — the Create a passkey button registers a passkey on the device; the device's fingerprint, face or lock code then confirms each login;
• Authenticator app — the person scans a QR code with an authenticator app on their phone, then enters the six-digit code it displays;
• Code by email — the Get a code by email button sends a six-digit code, valid for ten minutes, to the account's email address. An account without an email address cannot choose it.

An account registers a single second authentication factor, and keeps it if the school later stops accepting that type.

Administrators also receive ten backup codes, shown only once. Each one replaces the second authentication factor for a single login, if the device is lost: keep them in a safe place.

Following logins

Each login then asks for the registered second authentication factor: the passkey, the authenticator app's code, or the code sent by email, which is sent automatically. An administrator can also enter a backup code.

If the school allows it, a checkbox lets you stop asking for it on this browser for the set number of days. Another browser still asks for it, as does a login that follows its reset.

With SSO

After signing in through the identity provider (OIDC / SSO), the same step appears on the login page: the second authentication factor is added to SSO.

Resetting a second authentication factor

An account that has lost its second authentication factor — phone changed, passkey deleted — registers a new one after a reset:

• for one account: the Reset the second authentication factor button on its unfolded line, next to Password, in the list of its role: Administrators, Teachers or Staff;
• for all accounts: Reset the second factor of every account, at the bottom of the configuration of the second authentication factor.

Resetting all accounts, like resetting an administrator's account, asks you to confirm your identity. The account registers a new second authentication factor at its next login, and remembered browsers are forgotten. Its sessions already open continue: to interrupt them, deactivate the account.

An administrator who has lost their second authentication factor signs in with a backup code, or another administrator resets it. Omniscol support can reset the last administrator's.

Good to know

• The code by email is the weakest second authentication factor: the password reset goes through the same mailbox. For stronger protection, accept only the passkey and the authenticator app.
• A passkey is tied to the school address it was created on: from another address, it does not work.