Documentation forAccess Rights Manager

Enable multi-factor authentication for web client users

Multi-factor authentication (MFA) adds a second verification step when users sign in to the ARM web client. In addition to their credentials, users with MFA enabled must enter a 6-digit code generated by an authenticator app on their mobile device.

MFA applies only to signing in to the web client. It does not apply to the ARM rich client (Configuration application and ARM application).

To set up and sign in to your authenticator app, see Set up and sign in with multi-factor authentication (web client).

How MFA works

ARM uses time-based one-time passwords (TOTP) as defined in RFC 6238:

  • Codes have 6 digits.

  • A new code is generated every 30 seconds.

  • ARM accepts codes up to 30 seconds before or after the current time period to allow for small clock differences.

Supported authenticator apps

Users can use any standard TOTP authenticator app, for example:

  • Microsoft Authenticator

  • Google Authenticator

  • Authy

  • Duo Mobile

In the authenticator app, the ARM account is displayed with your company name.

Because TOTP codes are based on the current time, make sure the clock on the ARM server is accurate and synchronized with a reliable time source. If the server clock is off by more than the allowed tolerance, valid codes are rejected.

Enable or disable MFA for a user

You must be logged in to the web client as an ARM administrator. You can enable or disable MFA on the MFA settings page or on the Users and Role Management page.

On the MFA settings page

  1. Log in to the web client as an ARM administrator.

  2. In the toolbar, click Settings > MFA.

    If Settings is not available, verify that you are logged in as an ARM administrator.

  3. Locate the user and set the MFA status to Enabled or Disabled.

The MFA settings page lists users with the following columns:

Column Description
Company Name The company name of the user.
MFA status Whether MFA is Enabled or Disabled for the user.
Registration status Whether the user has registered an authenticator app.
MFA Registered At The date and time the user registered an authenticator app.
MFA Last Verified At The date and time the user last signed in with a verified MFA code.

On the Users and Role Management page

  1. Log in to the web client as an ARM administrator.

  2. Click Settings > Users and Role Management.

  3. In the MFA column, set MFA to Enabled or Disabled for the user.

After you enable MFA, the user is asked to set up an authenticator app the next time they sign in to the web client.

To further manage users and roles in the web client, see Manage ARM users and roles in the web client.

Administrators can skip MFA setup

When MFA is enabled for a user with an Administrator role, the user can skip the MFA setup at sign-in. Users without an Administrator role cannot skip the setup and must register an authenticator app to sign in.

SolarWinds recommends that administrators complete the MFA setup instead of skipping it.

Reset MFA for a user

You can reset MFA for a user who lost or replaced the device that had the authenticator app installed. After the reset, the user must register their authenticator app again at the next sign-in. Resetting MFA is not an admin-only feature and can be done by any signed-in user.

  1. Log in to the web client and click Settings > MFA.

    If you are signed in as an administrator and resetting on behalf of another user, navigate to Settings > MFA and select the option to reset other users' MFA.

  2. Select the Reset MFA button in the top-right account menu.

  3. When the message "This will require the user to re-register their authenticator." is displayed, confirm the reset.