How to enable multi-factor authentication for privileged users
How can multi-factor authentication secure privileged user accounts?
While all user accounts must be authenticated before gaining access to enterprise resources, privileged user accounts are of the utmost priority because they pose the greatest risk of confidential data compromise. Multi-factor authentication (MFA) is an effective solution to help protect access to privileged user accounts as it enables additional authentication methods to be implemented besides standard password-based authentication. This eliminates the risk of system takeover due to password compromise. ManageEngine ADSelfService Plus offers MFA for machine, VPN, Outlook Web Access, and enterprise application logins, making it a well-rounded solution to secure privileged user authentication.
How to setup MFA for privileged user accounts using ADSelfService Plus
Step 1: Create a policy for privileged users
Create a self-service policy and select domains, groups, or OUs that the privileged user accounts are a part of.
Step 2: Configure authenticators for MFA
Configure stringent methods such as biometrics, Microsoft Authenticator, and YubiKey Authenticator, and select the policy created in Step 1. Configure settings such as the number of factors and authentication methods for each MFA type.
Step 3: User enrollment
Enable forced user enrollment, send enrollment notifications, or enroll privileged user accounts in the product by importing data from CSV files or databases.
Authentication methods supported for MFA for privileged users
- Security Question & Answer
- Email Verification
- SMS Verification
- Google Authenticator
- Microsoft Authenticator
- Azure AD MFA
- Duo Security
- RSA SecurID
- RADIUS Authentication
- Push Notification Authentication
- Biometric Authentication
- FIDO Passkeys
- QR Code Authentication
- TOTP Authentication
- SAML Authentication
- AD Security Questions
- YubiKey Authentication
- Zoho OneAuth TOTP
- Smart Card Authentication
- Custom TOTP Authenticator
Benefits of deploying MFA for privileged user accounts using ADSelfService Plus
- Granular configuration based on user privilege: Enable stringent authentication methods such as biometrics and YubiKey Authenticator for AD domains, OUs, and groups comprising of users with higher privileges.
- True MFA: Enable a maximum of three authentication factors apart from username and password authentication.
- Mandated product adoption: Ensure users, especially privileged user accounts, are secured by MFA by mandating them to enroll in the product, or bulk enroll all user accounts using external databases or CSV files.
- Automated conditional access: Automatically apply different self-service policies that enable or disable different levels and methods of authenticators based on factors such as time of access, IP address, geolocation, and device type.
New to ADSelfService Plus?
Related Articles
How to enable multi-factor authentication for RDP
Generally, remote employees use Microsoft Remote Desktop Protocol (RDP) to connect to their work devices from an external network, using only a password to authenticate their devices. This makes RDP-based access highly vulnerable to password-based ...Multi-factor authentication techniques in ADSelfService Plus
Let's take a look into the various authentication methods supported by ADSelfService Plus for enterprise multi-factor authentication (MFA). Why should you use MFA? Authentication based solely on usernames and passwords is no longer considered secure. ...How to enable smart card authentication in ADSelfService Plus?
ADSelfService Plus supports smart card authentication which enables users to access the self-service portal securely, without having to enter a password. If your organization already utilizes smart cards, PKI, or certificates as an authentication ...How to set up multi-factor authentication for Linux logins
For its architecture and compatibility, Linux has always been a popular operating system among IT professionals who handle critical workloads in cloud computing environments. However, this widely used OS is also susceptible to data breaches and ...How to set up multi-factor authentication (MFA) for macOS
When employees are forced to manage multiple passwords, they tend to reuse the same password across multiple applications or create simple, easy-to-remember passwords that are not strong enough. This makes them an easy target for attackers who use ...