To configure security settings, navigate to the top menu and click Security.

Two-Factor Authentication

Two-factor authentication (2FA) or multi-factor authentication (MFA) as it’s sometimes called, is an additional layer of security for your login. Against the backdrop of an ever-changing security situation, securing login only through passwords is not enough. With 2FA, users provide two different authentication factors to verify themselves. Besides the first typical factor i.e., the password, users can provide a second factor such as a one-time password (OTP) to login to AD Connect Sync Plus Portal. 2FA makes user accounts more secure and minimizes the chances of cyber-attacks.

To ensure two-factor authentication, navigate to the top menu and click Security >> Two-Factor Authentication. 

• Enable 2FA: If you want to enable 2FA, select the Yes check box.
  
  
  Enabling/Disabling 2FA or changing OTP Delivery Mode will expire your current session and you will have to log in again.
• OTP Expiry Time: If 2FA is enabled, AD Connect Sync Plus Portal admins will not be able to login without a valid OTP. After it is received, it remains valid for a certain time. If it is not used within that time, it expires. Here you may specify (in minutes), the time limit to its expiry.
• OTP Delivery Mode: AD Connect Sync Plus Portal admins and users can receive their OTP through Email, Google Authenticator, or SMS. Here you may choose the mode through which they will receive their OTP. Enabling any of the modes here will ensure their display across all your admins and users, allowing them in turn to choose the appropriate one. Disabling an already enabled mode will remove 2FA for users using it.
  • Email: OTP can be received via Email. In case this option is selected, OTP will be received on the Email specified in the admin's Active Directory profile.
    
    
    This mode cannot be enabled if the Active Directory profile for the admin is incomplete.
  • Google Authenticator: Google Authenticator is a mobile app. OTP can be received on users’ Google Authenticator app.
  • SMS: OTP can be received via SMS. In case this option is selected, OTP will be received through an SMS sent to the phone number specified in the user's Active Directory profile.
    
    
    This mode cannot be enabled if the Active Directory profile for the admin is incomplete.

System Auth Settings

AD Connect Sync Plus Portal provides a secure web Interface to be accessed by the Portal Admin, Entity Admin, and Service Desk officers. All the Admins and users (i.e., Portal, Entity Admins and Service Desk officers) will be authenticated from the Portal’s Active Directory. This is the same Active Directory, the setting for which is taken during the installation of the AD Connect Sync Plus Portal. All admins and users (i.e., Portal, Entity Admins and Service Desk officers) will be created as security groups in this Portal’s Active Directory and members of these groups can log in to AD Connect Sync Plus Portal with their credentials. These settings provide the Domain Controller details for the Portal’s Active Directory that authenticates all Admins and users.

To configure system authentication settings, navigate to the top menu and click Security >> System Auth Settings.

• Domain Controller: The Domain Controller associated with Active Directory that authenticates panel users (Portal Admins, Entity Admins and Service Desk officers). The Domain Controller information is provided at the time of installation. There can be more than one Domain Controller for high availability. If one of the Domain Controllers goes down due to a disaster, AD Connect Sync Plus Portal automatically fails over to the second Domain Controller, ensuring constant authentication.
• Domain Admin: The domain\administrator account for the Domain associated with the Domain Controller
• Password: Password for the domain\admin.
• Root Organizational Unit: The root OU under which admin security groups (Portal Admins and Entity Admins) are created. Any members of these groups can log in with their respective AD credentials.
• Admin Auth Group: The security group of which the Portal Admin (global admin) is a member.
• Azure AD Auth: Companies may require user authentication through Azure. AD Connect Sync Plus allows users to log in and get authenticated through Azure. To enable Azure Active Directory authentication, select the Enable checkbox.
• Tenant ID: This is a unique identifier used to identify a specific directory (tenant) within the Azure AD.
• Client ID: This is a unique identifier used to identify, authenticate, and grant tokens to a specific application within the Azure AD. It is also used by Azure AD to authorize requests made by that application.