Setting Up and Managing Multi-Factor Authentication (MFA) in Merchanter

Merchanter supports Multi-Factor Authentication (MFA), also known as Two-Factor Authentication (2FA), to add an additional layer of security to user logins. When enabled, users are required to provide a verification code from an authenticator app in addition to their username and password to access the system.

This guide covers:

• Enabling MFA for your ledger
• Configuring the associated settings
• Setting up individual user accounts.

For additional security you could also control user access by time of day, for more information look at the guide How to Set Up Time-Based Access Control for Users 

Before You Begin

To make changes to the set up and configuration ensure you are logged into Merchanter with a user account that has the Prime or Admin role. MFA settings are only accessible to users with these privileges.

It is important to understand that once MFA is enabled, users will be unable to log in until they have set up their authenticator app.

It could take a while to set up all users, so for a live system switching this on for the first time it could be a good idea to set this up once people are logged in so it takes affect the next day. 

MFA Configuration Settings

To begin set up and configuration Navigate to Settings → Organisation Settings → Ledger Settings → Ledger Info → Security.

Several settings control how MFA behaves for your users:

• MFA Company Name – Set this to something identifiable and memorable, such as "Merchanter – [Company Name]". This is the name that will appear in the user's authenticator app
• MFA enabled for T25 Admin users - checking this box will apply the MFA to the Ten25 Admin user. Make sure you switch this on last so you don't accidently lock everyone out the system.
• MFA Login Timer – Defines how long the user has to enter their MFA code before being logged out.
• MFA Authentication Attempts – Sets how many attempts a user gets to enter the correct MFA code before the login process restarts.
• Days Before Requiring Re-authentication – Set this to 7 days and the user only needs to provide the MFA code once a week.
• Max Session Length – Defines how long a session can remain active before the user is required to re-authenticate.

Setting Up MFA for a User Account

There are two ways to set up MFA for an individual user.

Option 1 - Setup from the Security Page

Within the Ledger info - Security settings, you will find tabs for managing accounts:

Accounts to Set Up – Displays users who still need MFA configured. 

You can filter by depot name and search by username to help find the user.

Once you have found the correct user, click the Setup button to begin configuration of MFA.

Clicking Setup opens a pop-up window containing a QR code, a field for the authenticator code, and a Test Code button.

There is also Accounts Enabled for MFA tab on this screen– this displays users who have MFA successfully configured and in here is the option to reset and reconfigure MFA for the user in case they have changed authentication device.

Option 2 - Setup from the User Account Record

You can also configure or reset MFA directly from a user's account record. Open the user account in edit mode and locate the MFA options at the bottom of the screen. From here you can set up MFA for the first time or reset it if a user has changed devices.

Scanning the QR Code

After clicking the setup button to complete the configuration of MFA you will see this pop up

1. Open your authenticator app of choice on your mobile device. Common options include Microsoft Authenticator or Google Authenticator.
2. Click the button to add a new account
3. Select the Scan QR Code option.
4. Scan the QR code displayed in Merchanter. This will add the Merchanter account to your authenticator app, which will begin generating time-based codes.
5. Enter the generated code into the field provided in Merchanter and click the test code button before the access code expires.

If the code is correct 

The setup is confirmed. click the Validated button to close the window.

If the code is incorrect

The system will display a message indicating the code was not accepted, and you can try again. Ensure the configuration is complete before moving on or the user may not be able to log in.

Remember to set up the rest of your users as soon as possible.

Logging In With MFA

Once MFA is enabled and the user has been set up, they will be prompted to enter an authenticator code as part of the login process. The code is generated by the authenticator app and changes periodically.

Start as normal by entering your username and password in the log in window.

after clicking sign in the 2FA pop up requests the code from the authenticator app. 

Enter the code from the app into the filed and confirm and you will be logged in to Merchanter

If the user enters an incorrect code, they will be given the configured number of attempts before the login process restarts. This adds protection against brute-force attempts while still allowing for genuine mistakes.

If the Timeout counter reaches zero the user will be taken back to the first log in screen.

Account Recovery

If a user loses access to their authenticator app (for example, by changing phones), an administrator can reset MFA from the main security page or the user's account record. The user will then need to scan a new QR code and complete the setup process again.

this can be done from the Accounts enabled tab in the Ledger info security settings.

Or from the bottom of the user record. 

Click the Reset button and a new QR code will be generated for this user.

Scan the QR Code in the authenticator app and validate the change and you will have reset the users 2FA and they can try logging in.

Please Note. This can also be done from the user account.

Important Considerations

Rollout Requires Planning

Once MFA is switched on, users cannot log in without first having their authenticator app set up. 

For this reason, setup is typically performed by an on-site administrator. Users may need to be present while the administrator sets up each account and the user scans their QR code.

T25 Admin Account

Please note that the T25 Admin account is not currently forced to use MFA. This is a measure to stop accidental lock out of all users. Remember to speak with T25 support after all other other users have been set up so they can switch this on and configure the MFA for Ten25. 

Shared Users.

If a shared user needs MFA all the operators that use that account need to scan the same QR Code to set up the authenticator app and gain access to Merchanter.

Summary

Setting up MFA in Merchanter involves:

• T25 Admin enabling the 2FA switch in Ledger Settings under the Security tab
• Configuring MFA settings such as MFA name, login timer, authentication attempts, re-authentication interval, and session length
• Setting up individual user accounts by scanning a QR code with an authenticator app and validating the code
• Managing MFA through the Security settings or directly from user account records
• Planning the rollout carefully, as users cannot log in until their MFA is configured

MFA provides a valuable additional layer of security, helping protect your system from unauthorised access while ensuring that legitimate users can verify their identity with ease.

Video Guide