Office 365 MFA authentication - Can't hash

[GiggidyGoo123]

I've tried searching but can't seem to find anyone using this method still, we utilise 3CX hosted and have 2 wierd MFA authentication problems -

1) When we are speaking to a client and put them on hold to authenticate Office 365 MFA through telephone their line won't ring, someone else has to authenticate the request.
2) We have an out of hours extention configured which forwards through to a mobile phone number, I've tried it on 2 phones and although it forwards the client on and works great when you then ring the MFA (which also points to the mobile number during out of hours times) it will ring but you can't hash to accept it, it won't accept the input?

I've looked through the 3CX logs but can't see anything as of yet.

Happy to provide whatever config guidance just didn't want to dump everything in here.

 

[SweetAction]

1 is likely either your calls go to a queue (queue members are not rung when on a call) / ringgroup (and ALLOWUSEBUSYOPTFORGROUP=0) / Accept multiple calls is turned off.

2 - are you in a conference? DTMF is inband only when in a conf call.

 

[GiggidyGoo123]

1 is likely either your calls go to a queue (queue members are not rung when on a call) / ringgroup (and ALLOWUSEBUSYOPTFORGROUP=0) / Accept multiple calls is turned off.

2 - are you in a conference? DTMF is inband only when in a conf call.

I think your correct on number 1 however I use queue instead of a ring group so can't use that option set. I used a queue instead of a ring group as we perform reporting and if memory serves correct the ring groups were because of priority group.

No at present the way it configured it we have an out of hours extention staff have added to their account/app alternative as a backup the mobile is set within the extention to forward on.

 

[NickD_3CX]

(and ALLOWUSEBUSYOPTFORGROUP=0)

DO NOT use this parameter, it causes known problems. If it was flawless, it would have been available as a checkbox in the Management Console a long time ago...

 

[GiggidyGoo123]

DO NOT use this parameter, it causes known problems. If it was flawless, it would have been available as a checkbox in the Management Console a long time ago...

Seen the threads about it so didn't plan to, we don't really use ring groups though (bar for all staff) so not gonna work. I'm going to test it a bit more tonight now I have time.

 

[SweetAction]

I think your correct on number 1 however I use queue instead of a ring group so can't use that option set. I used a queue instead of a ring group as we perform reporting and if memory serves correct the ring groups were because of priority group.

Which was the first option in my guess - note a Queue Member will not be offered a call while on a Queue call - (as they are not "available "see: https://www.3cx.com/3cxacademy/videos/advanced/call-queues/ slide 2).

No at present the way it configured it we have an out of hours extention staff have added to their account/app alternative as a backup the mobile is set within the extention to forward on.

So you are forwarding to an external number or to an internal extension with the 3CX app? If an external number and the PBX is still involved, this is a conference of sorts and DTMF (button pushed) will still be INBAND and not go through. See https://www.3cx.com/community/threads/dtmf-tones-in-a-conference.67034/ for more information.

I could be wrong about this, just my guess without seeing captures, etc.

How to check if PBX is still involved easily? Review if the call still show in the active calls screen after it's answered by the external number.

DO NOT use this parameter, it causes known problems. If it was flawless, it would have been available as a checkbox in the Management Console a long time ago...

Sure, I was just listing 3 of the possible common reasons that the second call wasn't being offered to the extension already on a call. In fact I quoted the parameter as off (0).

 

[NickD_3CX]

2) We have an out of hours extention configured which forwards through to a mobile phone number, I've tried it on 2 phones and although it forwards the client on and works great when you then ring the MFA (which also points to the mobile number during out of hours times) it will ring but you can't hash to accept it, it won't accept the input?

If the call flow is:

1. Incoming call to 3CX Extension
2. Extension has "Ring my Mobile simultaneously" checked
3. Mobile phone configured in Extension rings and is answered
4. Mobile user is prompted to input digits

This won't work.
The reason is that when a External Number is called due to "Ring my Mobile simultaneously", the system "intercepts" DTMFs from the External Number due to the Mobile Transfer Agent Service functionality:
https://www.3cx.com/docs/pbx-dial-codes/#h.mlp4gmj167pe
Effectively, nothing reaches the initial caller.

If this is what you are doing, consider disabling "Ring My Mobile Simultaneously" and enabling the "Forward to External Number" in the "Away" profile, then switching the Extension Status to "Away".

 

[GiggidyGoo123]

Which was the first option in my guess - note a Queue Member will not be offered a call while on a Queue call - (as they are not "available "see: https://www.3cx.com/3cxacademy/videos/advanced/call-queues/ slide 2).


So you are forwarding to an external number or to an internal extension with the 3CX app? If an external number and the PBX is still involved, this is a conference of sorts and DTMF (button pushed) will still be INBAND and not go through. See https://www.3cx.com/community/threads/dtmf-tones-in-a-conference.67034/ for more information.

I could be wrong about this, just my guess without seeing captures, etc.

How to check if PBX is still involved easily? Review if the call still show in the active calls screen after it's answered by the external number.


Sure, I was just listing 3 of the possible common reasons that the second call wasn't being offered to the extension already on a call. In fact I quoted the parameter as off (0).

Apologies never saw the notification of further response.

Yeah after trialing a bit I identified the limitation however it seems a little daft of sorts as its considered a very basic function within most systems to have this ability I would of thought a checkbox to allow effective simulatanous calls or not depending on user, I may have to consider the unsupported parameter as its causing problems for us, I'm also looking at parking calls but again not ideal solution to this, for the moment we are just having other staff authenticate other calls as primarily it relates to authentication MFA for client access.

Our out of hours works by basically having a dedicated number inbound just for authentication requests, this is set to forward to an ALL group during office hours and out of hours to direct to the out of hours extention, this extention then has a mobile set for it to forward to. its at the point we get an out of hours calls and try to hash/authenticate once the call has been forwarded.

 

[GiggidyGoo123]

If the call flow is:

1. Incoming call to 3CX Extension
2. Extension has "Ring my Mobile simultaneously" checked
3. Mobile phone configured in Extension rings and is answered
4. Mobile user is prompted to input digits

This won't work.
The reason is that when a External Number is called due to "Ring my Mobile simultaneously", the system "intercepts" DTMFs from the External Number due to the Mobile Transfer Agent Service functionality:
https://www.3cx.com/docs/pbx-dial-codes/#h.mlp4gmj167pe
Effectively, nothing reaches the initial caller.

If this is what you are doing, consider disabling "Ring My Mobile Simultaneously" and enabling the "Forward to External Number" in the "Away" profile, then switching the Extension Status to "Away".

See previous reply to confirm how its setup, happy to change this though however it works well as no one needs to login to the extention we just change the mobile when it changes on the rota to a different number.