Two-Factor Authentication for Support – Training Sandbox 26

What is two-factor or multi-factor authentication?

Two-factor or multi-factor authentication adds an extra layer of security by requiring users to provide two forms of identification before gaining access to their account. The two forms of identification include something that you already know (such as your password) and something you have (such as a unique verification code).

How do set up two-factor authentication

Support will be required to have a two-step verification process for signing in with their Church username and password. In order to have this process work, support will need to install and use the Okta Verify app. Instructions on how to install and use the app are below.

Before you begin

Installation will be easiest if these first steps 1-6 are done on a computer. After which, you should go to your mobile device. Separate steps are included for Android and Apple devices.

Steps (website)

Sign-in to your account on churchofjesuschrist.org
In the top right corner of the Church’s website, click My Account and Ward, in the drop-down list select Account Settings
On the left side of the page, click Two-Step Verification
At the top of the page, make sure the Opt In to Two-Step Verification checkbox is marked
- If the check box is not marked do the following:
  1. Click the check box next to Opt In to Two-Step Verification
  2. You will be signed out and directed to the sign-in page
  3. Enter your sign-in information
  4. If you are asked for a code, enter the 6-digit code texted to you
- Note: The code is found in the body of the text, not the number that sent the text.
In the Okta Verify App box, click Set Up
A QR code will appear in the box, leave this page up on your computer, you will need it once the app is installed on your phone.
Go to the appropriate instructions for your mobile device:
- Next steps on an Android device
- Steps on an Apple device

Next steps on an Android device

Go to the Google Play Store
In the Search Box, type in Okta Verify (the app’s icon a thin, blue checkmark inside a thick, blue circle)
Tap Install
Once the app is installed, tap Open
When the app is opened, you will see the “Welcome to Okta Verify” screen
In the lower right corner, tap the plus
Allow Okta Verify to take pictures and record video so that you can scan the QR code
Line up your phone until the QR code (from step 6 in website steps above) is in the box on the screen and in focus, when your phone has read the code, green squares will appear in the four corners of the QR code
- Note: the QR code does not have to fill the square, it just has to be inside. If the code is not reading, slowly move the phone around, closer or farther away from the screen until it highlights in green.
When the scan is successful the app will say “Enrolling your device.” When your device is enrolled, the QR code will disappear from the computer screen and your phone screen will change to have a 6-digit code and your username
The process in now complete, you may exit the app
- Note: You will receive an email saying you have enrolled in the two-step authentication process
If needed, review the steps on how to sign in after setting up two-factor authentication

Next steps on an Apple device

To install Okta on an Apple device:

Select App Store.
Select Search.
Enter Okta and select Search.
Get the Okta Verify app.
Select Install.
If you are prompted to sign in with your Apple ID, do so.
When the installation is complete, select Open.

Using Okta Verify on an Apple Device:

Open the Okta Verify app.
The first time you use the Okta app, on the “Welcome to Okta Verify” screen, select Add Account.
When you are prompted to allow camera access and push notifications, click Continue.
Select Allow for notifications and OK for access to the camera.
When you are on the “Add Account Scan code to add your account” screen, on another device, go to the site: account.churchofjesuschrist.org and sign in with your Church account.
On the left side of the screen, select Two-Step Verification.
Next to Okta Verify App, click the Set Up button.
On the Set Up Okta Verify App screen, use the Apple device to take a picture of the barcode.
If needed, review the steps on how to sign in after setting up two-factor authentication.","theme.00000174-744d-dae9-a17e-7cfd63700000.:core:link:Link.hbs.linkStyle":null,"theme.00000174-744d-dae9-a17e-7cfd63700000.:core:enhancement:Enhancement.hbs.enhancementAlignment":null,"theme.00000174-744d-dae9-a17e-7cfd63700000.:core:enhancement:Enhancement.hbs.imageWidthLimiter":null,"_id":"00000194-99fb-d08f-a194-fdff45320000","_type":"809caec9-30e2-3666-8b71-b32ddbffc288"}"how to sign in after setting up two-factor authentication.

After you have set up the push notification process, every time you sign-in to any site using your Church username and password, you will receive a push notification on your phone from Okta in order to sign in.

To verify your identity, do the following:

Enter your Church username and password
When prompted, click Send Push

Note: You can opt to have the push sent automatically by checking the box next to Send Push Automatically below the “Send Push.” You will then get a notification on your phone to complete the push notification process

To complete the process on an Android:

Click Yes, it’s me in Okta notification or you can go into the app and select the same option

Note: If you would rather, you can select Enter Code (just below “Send Push.” You will then need to go into the Okta app and enter the 6-digit code on your screen (this number refreshes every 30 seconds).

What applications require two-factor or multi-factor authentication?

FamilySearch is committed to maintaining the highest standard of protection for its users and ensuring all users' data security. In line with this commitment, FamilySearch is implementing two-factor (2FA), also referred to as multi-factor (MFA), authentication for all users of the applications listed below:

Genesys
Google Workspace
Monday.com
Splashtop
Zendesk

Enable two-factor authentication for Genesys

Single Sign On (SSO)

On the login page, click More Login Options.
Enter FamilySearch for the organization name and click Next.
Select the Americas (US West) region.
Under the Log in with your/another account option, click the identify provider icon.
On the Identity Provider authentication page, enter your sign in credentials (username and password).
After you successfully authenticate, the system automatically signs you in to Genesys Cloud.

Note: When signing in to Genesys Cloud after the initial authentication, the login panel in step 3 appears. To sign in automatically to Genesys Cloud, click the identity provider icon.

Multi-factor authentication

In the Name field, enter the name of your MFA device.
Click Next.
Scan the QR code with your authentication app.
In the Validate field, type or paste the code from your authentication app.
Click Validate.Enable two-factor authentication for Google Workspace

Turn on 2-step verification

With 2-Step Verification, also called two-factor authentication, you can add an extra layer of security to your account in case your password is stolen. After you set up 2-Step Verification, you can sign in to your account with your password and your phone.

Allow 2-step verification

Open your Google Account.
In the navigation panel, select Security.
Under How you sign in to Google, select 2-step verification and click Get started.
Follow the on-screen steps. For simplicity, choose either Google Prompt or Phone Number as your 2-step verification option.

Verify your identity with a second step

After you turn on 2-step verification, you must complete a second step to verify the person signing in is you. To help protect your account, Google asks you to complete a specific second step.

Use Google prompts

It is easier to tap a prompt than enter a verification code. Prompts can also help protect against SIM card swap and other phone number-based hacks.

Google prompts are push notifications you receive on:

Android phones that are signed in to your Google Account.
iPhones with the Smart Lock app, the Gmail app, the Google Photos app, the YouTube app, or Google app signed in to your Google Account.

Based on the device and location information in the notification, you can:

Allow the sign in if you requested it by tapping Yes.
Block the sign in if you did not request it by tapping No.

For added security, Google may ask you for your PIN or other confirmation.

Additional tips

If you do not want to provide a second verification step each time you sign in on your computer or phone, check the box next to Don't ask again on this computer (or Don't ask again on this device for mobile devices).

Note: Only check the box on devices you regularly use and do not share with anyone else.

Enable two-factor authentication for Monday.com

There are two options to sign in with two-factor authentication:

Authentication App
Text Message

Use the authentication app

The first time you sign in, you need to scan the QR code to receive a one time password to sign in.
For subsequent sign ins, you need to enter the new, automatically generated code that appears on the authentication app. The code renews every 30 seconds, so make sure to enter it quickly.

Use text message

The first time you sign in, you need to enter your phone number in order to set up the two-factor authentication.
A code is sent to your mobile phone via text message.
For subsequent sign ins, you need to enter a new code that is sent to your phone via text.

Change the two-factor authentication method

Navigate to your Monday.com profile section.
Click the Two-Factor Authentication tab.
Click the Change Two-Factor Authentication Method button.

What if I need help setting up two-factor authentication for Monday.com?

If you encounter any issues or have any questions about enabling two-factor authentication for Monday.com, please contact Monday.com support, which is available 24/7.

Enable two-factor authentication for Splashtop

Sign in to your Splashtop account.
At the bottom, locate the section labeled Two-Step Verification. Click the Change link.
On the pop up, click the Get Started button.
A list of linked, supported authenticators appears. Choose one, and download it onto your mobile device.
When the download completes, click the Next button.
Follow the instructions to pair your account in the chosen authenticator app. During pairing, you have the option to scan the QR code or enter the secret key. You can either use your phone's camera to scan the code, or manually type in the secret key.
Once you are done scanning or entering the secret key, click the Next button.
On the authenticator app on your phone, the account appears along with a six-digit code that refreshes every 30 seconds. Enter this code in the code box on the website, then click the Check button to make sure your code works.
- If a red X appears next to the check button, there is either a typo, the code has expired, or the pairing process was not successful. Try entering another code to test. If that does not work, delete the account from your authenticator app and repeat from step 5.
- If a green checkmark appears next to the check button, click the Next button.
A list of 10 recovery codes is provided. Please save the recovery codes in a safe place. If you switch phones and forget to export your authenticator, or if you lose your phone, you will not be able to sign in to your account without your recovery codes. After saving, click the checkbox labeled I have printed or saved these codes.
For the backup number, please use a number that can send text messages. Some options include your mobile phone, a work mobile, or a Google Voice number. Enter the number and click the Check button to see if the number is valid.
Once the green checkmark appears, click the OK button to finish the setup process.

Enable two-factor authentication for Zendesk

Sign in to your Zendesk account.
In the upper-right corner, click your profile.
Select Security Settings.
From the two-factor authentication section, select Manage.
Click the Set up 2FA button.
Follow the prompts to set up 2FA with your preferred authentication method. For example, an authenticator app or SMS options.

What if I need help setting up two-factor authentication for Zendesk?

If you encounter any issues or have any questions about enabling two-factor authentication for Zendesk, please contact your homeland support team. One of the team will guide you through the process.

Additional information to clarify two-factor authentication

Will this impact apps or just church account?

Just as background, all workforce enabled accounts across all departments of the church are being required to use MFA (Multi-Factor Authentication) on their church accounts.

Note this only affects users who are workforce enabled. Most missionaries in the Family History Department are workforce enabled currently. This is only a church account change, so it will only affect apps using a church account. In practice this plays out like the following:

Clicking “sign-in with church account” on familysearch.org as an employee after the enforcement begins will require using MFA, whereas using a FamilySearch account login will not.

What about apps we sign into with the same credentials as church account?

As long as the identity provider is not church account, there is no affect from this change. Currently FamilySearch syncs with church account so the credentials are the same, but signing in to FamilySearch with a FamilySearch account would not be affected.

Can apps say they don't need or support multi-factor authentication (MFA) still?

If an application uses church account, and it is being accessed by someone who is workforce enabled, they will have to use MFA. This doesn’t affect FamilySearch apps.