Manage MFA (Tango portal admins)

Multi-factor authentication (MFA) adds a layer of security to sign-in. MFA is required for username/password and Google account logins and optional for single sign-on (SSO). Tango portal admins choose available MFA methods for users: one-time password, email, or phone.

Note:

All MFA methods are enabled by default.
MFA can be disabled, but to ensure your Tango portal security, you must enable at least one MFA method.
MFA is required for all non-SSO logins. With SSO logins in Tango portal, you may choose to bypass MFA authentication method.

Audience

This guide is intended for Tango portal administrators to manage MFA for their organization’s platform.

Permissions

You must have Entire organization access and permission to manage Platform and account settings to access platform settings and configure multi-factor authentication. See how to edit user permissions in Add, edit, delete users.

Manage MFA methods for the Tango portal

You can manage (enable or disable) MFA methods for all users in your portal. New users must set up MFA for their user profile the first time they log in, or whenever they reset their MFA. See Set up MFA (Tango portal users)).

All MFA methods are enabled by default. You can disable one or more methods if needed. For your portal security, you must keep at least one of the following MFA methods enabled:

MFA method	Description
One-time password	Is recommended and most secure. Uses an authentication app–such as Google Authenticator, Duo Mobile, or any other authentication app–to issue a temporary verification code.
Email	Receive an email message containing a verification code
Phone	Receive a phone message containing a verification code. SMS is available in United States and a number of other countries such as Canada, UK, etc. For a complete list of supported countries, check out the countries list.

To manage MFA methods for the Tango portal:

Sign in to the Tango portal.
Go to Settings on the left navigation menu. If this option is not visible, ensure your role has the right permission enabled. See Grant manage MFA permissions.
Click Multi-factor authentication methods.
Click Disable next to the MFA method you want to turn off.
Click Disable again in the confirmation message box.

The method is turned off for all users. Users who relied on this method must set up a different MFA method the next time they log in.

Note: You must have at least one MFA method enabled.

Grant manage MFA permissions

You must have manage authentication permission to enable or disable the MFA methods in your Tango portal. Follow the instructions below to grant permission to Tango portal admins or specific users. Learn about Tango portal roles in Manage default user roles in Tango.

To grant manage MFA permissions:

Sign in to the Tango portal.
Go to Users on the left menu.
Click the user for whom you'd like to update permissions.
Scroll down to see Platform and account settings.
Move the slider to the Manage position.

Reset MFA for other Tango portal users

As a Tango portal admin or user with manage users permission, you can reset MFA for other Tango portal users. Here’s how:

To reset MFA for other Tango portal users:

Sign in to the Tango portal.
Click Users on the left menu.
Find the user you want to reset, then click the three-dot menu.
Click Reset all multi-factor methods and confirm. It resets all MFA methods and logs the user out of the Tango portal. To log back in, the user must add a method of MFA authentication.
The user has to log in and a verification code is sent to their email address. Once they enter the verification code, they can select a new MFA method. See Get started FAQ for more information.