Knowledge Details Page 1

MFA (strong authentication) overview

MFA overview

Users connecting from external networks to Electrolux SSO enabled applications or Consultant VPN are required to authenticate using
2-Factor authentication system called MFA (Multi Factor Authentication). This article explains how user can manage their MFA
preferences.

How MFA works

MFA requires user to perform authentication using traditional password (STEP 1) and additional secondary method (STEP 2). By
default MFA will provide One Time Password using SMS to the mobile phone number registered in Active Directory however user can
change the MFA authentication method to meet their preferences. Available authentication methods are:

a. One Time Password delivered via SMS (default method)

b. Phone call based verification
c. Mobile Application (push notification or one time codes)

Options a & b requires correct mobile number (including international prefix) to be present in the BIZ Active Directory.

Setting or changing Mobile number for SMS delivery

User can set their mobile number using the Identity Management Self-Service available on Electrolux internal network only (user
needs to be physically in the office or connected via VPN) :

https://myid.int.electrolux.com/ (Windows - SSO)

https://myid.int.electrolux.com/itim/self?noSPNEGO (MAC – no SSO)

After logon go to “View or change Profile” -> “Contact Information” -> “Mobile” set the mobile number (including International code)
and click OK.

Changing MFA authentication method

Users can change their preferred MFA authentication mode using MFA Self-Service:

https://mfa.int.electrolux.com/MultiFactorAuth/login.aspx

Self-Service is available on Electrolux internal network only (user needs to be physically in the office or connected via VPN). Portal
should be accessed using Chrome as IE has some compatibility issues. Login is based on BIZ password.

MFA Login screen:

After successful login, please click “Change Method” and select the preferred method from the drop down menu.

Run By: Michael Julius 15/02/19 14:07:39 Central European Time

 Knowledge Details Page 2

Mobile App method will require user to download Microsoft Authenticator app to their mobile device – app is available on both Google
Play (Android) and App Store (iOS). After installation user will need to follow the instruction provided on the screen to activate the
app.

MFA Troubleshooting

MFA troubleshooting for ServiceNow is explained below.

Run By: Michael Julius 15/02/19 14:07:39 Central European Time

 Knowledge Details Page 3

Multi Factor Authentication (MFA) on ServiceNow

Description
As of November 19th 2018, Multi Factor Authentication (MFA) is going to be activated on ServiceNow.
This KM is to explain to the Service Desk how to assist the (ServiceNow) user to set/update their Phone number in ServiceNow to receive the
code per SMS while logging into ServiceNow from the Internet.
MFA is not valid when ServiceNow users login from an Electrolux Network or when using VPN

Symptoms
This procedure will mostly be valid for Externals (Consultants) being a ServiceNow user (e.g. Incident Management resolver) and connecting
to ServiceNow from the internet (so without VPN).
In case the Phone number in ServiceNow for the user is wrong/missing then the user will not be able to login and the user is to be instructed
what to do.

Cause
For more about MFA, see also
https://electrolux.sharepoint.com/sites/itservicemanagement/SitePages/Multi-Factor-Authentication-(MFA)-in-ServiceNow.aspx

Resolution
Whenever a ServiceNow user, connecting to ServiceNow from the Internet (so without VPN) has a wrong or missing Phone number then they
will not be able to login using the code send by SMS.
The users Phone number is actually set in Active Directory and this is each night uploaded to ServiceNow.
So in case a user reports he/she cannot login to ServiceNow due to wrong/missing Phone number, then there is NO need to send a ticket to
GL_SM.
Either the user can update the Phone number using TIM Self Service (however that requires a VPN connection):
https://myid.int.electrolux.com/
or the Service Desk will have to assign a ticket to GL_TIM_Administrator asking them to set the Phone number.

Run By: Michael Julius 15/02/19 14:07:39 Central European Time