users on v20 being enrolled in 2FA without setup

[orange2]

2FA has enabled itself without the users apparently being prompted to set it up. This is a virgin v20 install not an upgrade from v18. Is that correct?

 

[orange2]

And can Authy be used or is it only the MS app?

 

[Alphabetic]

Cant speak for the auto enroll but you can use any authenticator app to scan the QR code.

 

[orange2]

Cant speak for the auto enroll but you can use any authenticator app to scan the QR code.

The QR in the welcome email?

 

[Alphabetic]

No, to set up 2FA (in v20) you can get a QR code. Otherwise in V18 its SSO with 365 or Google. the QR code youre referring to is to configure the 3cx app.

 

[orange2]

No, to set up 2FA (in v20) you can get a QR code. Otherwise in V18 its SSO with 365 or Google. the QR code youre referring to is to configure the 3cx app.

How do you GET that QR? It's been enabled without warning!

 

[DimitrisL_3CX]

Hello @orange2,

When creating a User, the 2FA is by default enabled. On the login page of the user, once you have entered the credentials it will popup a new window with the QR code to be used. You can download a two factor authenticator app like Microsoft Authenticator or Google Authenticator for iOS or Android. Then you will be required to enter the security code.



You can remove the 2FA in the General Tab of the User by unticking the box "Enable 2FA"
Admin >> Users >> select user >> General >> Enable 2FA

 

[orange2]

Hello @orange2,

When creating a User, the 2FA is by default enabled. On the login page of the user, once you have entered the credentials it will popup a new window with the QR code to be used. You can download a two factor authenticator app like Microsoft Authenticator or Google Authenticator for iOS or Android. Then you will be required to enter the security code.

View attachment 40742

You can remove the 2FA in the General Tab of the User by unticking the box "Enable 2FA"
Admin >> Users >> select user >> General >> Enable 2FA

Dimitris: that's my point: they have never been asked for that via the pop-up to which you refer. So they cannot set it up. I have had to disable 2FA on every user. If I re-enable should they get a pop-up? This is all MacOS - do browser pop-ups need to be enabled? If so that is probably not the best way to handle the 2FA enrollment process.Surely it should be a step in the first login process in the main browser window, similarly to how 365 handles it.

 

[Alphabetic]

I must say that i've not seen extensions auto enrolling in to 2FA so I suspect you pressed the 2fa button to turn it on for all users?

 

[orange2]

I must say that i've not seen extensions auto enrolling in to 2FA so I suspect you pressed the 2fa button to turn it on for all users?

Definitely not! And it's happened in both of the 2 new instances that I set up.

 

[DimitrisL_3CX]

@orange2


Are you using Safari?
If you use Chrome browser do you have the same issue? Make sure to enable the notifications in Chrome.
You can just enable the 2FA to one extension to test it, before enabling it for all users.
Once enabled, after you login you should see the screenshot shared in the previous reply.

 

[orange2]

I will check which browsers and redirect them! I had instructed them to use Chrome, but what users ever take any notice of this sort of thing?! Thanks

 

[scarafiotti]

I also found myself enabling 2FA on my administrative account without request (3CX V20).
Too bad that using the QR code displayed, both Google Authenticator and Keeper (password management) show me an (identical) code but it doesn't work for activation...
So I can't log in to the switchboard as administrator...

 

[Philippk123]

i have the same problem. do you have the problem solved?

 

[rotim]

When you click +Add User, the 2FA option is automatically checked on.
You have to uncheck it manually on every new user you create.
I also rather see this being auto disabled and enabled when we specifically ask for it.