MFA Admin Guide

The “Get Started with MFA” guide for users can be found here.

Users can choose between the Microsoft Authenticator app, text messages, calls, or depending on the local organisation, a FIDO2 token or an NHS Smartcard. Users should be encouraged to register more than one authentication method to ensure they never lose access to their account, even if something happens to their device.

• Authentication App: Download the Microsoft Authenticator app to your smartphone to verify your sign in or to get a verification code.
• Text message: A text message (SMS) is sent to the mobile phone number registered containing a verification code.
• Call: An automated voice call is made to the mobile phone number registered prompting the user to press # on their keypad.
• FIDO2: Use FIDO2 for MFA to sign in with a choice of security keys available and supported.

Users should enable MFA using mobile app, text message, phone call or FIDO2 token in addition to using an NHS smartcard for security purposes. If using an NHS Smartcard in addition to another MFA option, users won’t be challenged for MFA.

Multi-factor authentication (MFA) is currently being used to protect the NHSmail Portal and all Microsoft Office 365 (O365) applications including Outlook, Teams, OneNote, OneDrive and SharePoint.

The configuration requirements vary, depending on the Outlook version:

• Outlook 2010 does not support MFA.
• Outlook 2013 supports MFA but is not enabled by default. Instructions on how to enable this can be found here.
• All versions of Outlook above 2016 support MFA by default.
  

Users will need to authenticate on each device and browser they log into. For desktop and mobile apps, users will be prompted to authenticate once and then will only be prompted again once a key account detail has changed, e.g. they have reset their password.

This will only differ in cases where a specific MFA licence has been assigned to a user by their local organisation, e.g. EMS E3 Intune or Azure AD Premium P1 (AADP1) Azure AD Premium P2 (AADP2) Conditional Access licences. In such cases, a change in the Conditional Access policy, such as a change in location of log-in, would result in a user getting prompted for MFA again. 

Users are advised to inform their local admin when they have misplaced their device and should be encouraged to register an alternative method of MFA for emergencies, such as an alternative mobile phone number or setting up the Microsoft Authenticator app on another device.

If a user has set up alternative authentication methods, they should be able to select “Sign in another way” when at the MFA prompt screen.

If a user is locked out of their account and cannot access it unless MFA is disabled, e.g. because they don’t have an alternative authentication method, please follow the instructions to disable MFA for another user at the top of this page. Once disabled, MFA should be re-enabled for the account by the local admin

Please direct users to update their MFA details here. On the ‘Security info’ page, they will need to click on change and edit this by adding in their new phone number. This number is independent of the mobile number listed in their NHSmail Portal profile.

No, only UK-based phone numbers are permissible for MFA. The use of mobile phone numbers registered outside of the UK is not permissible, as per this announcement. Users are encouraged to check the number associated with their MFA details here. If this number is a non-UK based phone number, they should delete it and update the field with a UK-based phone number.

If a user has kept the same mobile number and their method of authentication is call or text message, they do not have to do anything. If they have selected the Microsoft Authenticator app as their preferred authentication option, they just need to download the app on their new mobile device and backup the details from their old mobile device. To set up Microsoft Authenticator on a new phone, users need to follow these steps:

• Step 1: Open the Microsoft Authenticator app on old mobile
• Step 2: Tap on the three-dotted icon and go to Settings
• Step 3: Toggle Cloud backup or iCloud backup option
• Step 4: Add a recovery account
• Step 5: Open the Microsoft Authenticator app on the new mobile
• Step 6: Tap on the begin recovery button
• Step 7: Enter the credentials of the recovery account
• Step 8: Reverify accounts to start using them.
  

To monitor adoption of MFA in your local organisation you can generate a mailbox report for your organisation. To do this click “Reports” then “Admin Reports” on the NHS Portal. This will show you the accounts that have MFA enabled and the type of authentication method registered.

If users don’t have a corporate device, it is recommended that they use their personal device as this device is unique to them. This helps ensure their account can only be accessed by the person in possession of their phone. Even if someone has their log in details and password, they won’t be able to log into the NHSmail Portal or access their Microsoft Office 365 account without the user’s personal device.

If mobile devices are not allowed in the workplace, users are advised to contact their local admin to discuss alternatives, such as FIDO2 security tokens. This will be down to local organisation policy. For information about FIDO2, please visit this page. Please visit the NHS Care Identity Sign in Support site for more information.

Users are advised that using MFA on their personal device will ensure their account remains protected and will not result in the collection, storage or tracking of any personally identifiable data.

The Microsoft Authenticator app does not collect or store any personally identifiable data. Keeping user’s NHSmail accounts secure will protect the organisation, their own personal data and patient data. Their personal mobile phone details are not used for any other purpose than protecting their account. Adding the Microsoft Authenticator app to their personal mobile phone this is just a way of confirming who they are. Further information can be found here.

As part of the ongoing efforts to protect the NHSmail platform, multi-factor authentication (MFA) will now be enforced by the NHSmail team on all NHSmail accounts that are identified as compromised. Further information can be found here.

Information regarding the NHSmail Intune Service and specific licence requirements (e.g. EMS E3 Intune, AADP1 or AADP2 licences) can be found here.

For information about FIDO2, please visit this page.

For feedback, please contact us via Your Voice or feedback@nhs.net