Safeguard for Privileged Passwords On Demand Hosted - Administration Guide

( desktop client) To configure users to use Starling Two-Factor Authentication when logging in to Safeguard for Privileged Passwords

1. Log in to Safeguard for Privileged Passwords as an Authorizer Administrator or User Administrator.
2. Navigate to Administrative Tools | Users.
3. Add or edit users, ensuring the following settings are configured:
   1. Authentication tab:
      • Require Secondary Authentication: Select this check box.

      • Authentication Provider: Select the Starling 2FA service provider.

        NOTE: If the Starling 2FA service provider is not listed, you must first join Safeguard for Privileged Passwords to Starling. For more information, see Starling.

      • Use alternate mobile phone number: Optionally, select this check box and enter an alternate mobile number to be used for two-factor authentication notifications.

        NOTE: If you want to use one-touch approvals, this feature requires a valid mobile phone number for the user. If the user does not have their mobile number published in Active Directory, use this option to specify a valid mobile phone number for the user.

   2. Contact Information tab:
      • Mobile Phone: Enter a valid mobile phone number in E.164 format.
      • Email Address: Enter a valid email address.

Now whenever any of these users attempt to log in to Safeguard for Privileged Passwords, after entering their password, a message appears on the login screen informing them that an additional authentication step is required.

( web client) To configure users to use Starling Two-Factor Authentication when logging in to Safeguard for Privileged Passwords

1. Log in to Safeguard for Privileged Passwords as an Authorizer Administrator or User Administrator.
2. Navigate to User Management | Users.
3. Add or edit users, ensuring the following settings are configured:
   1. Authentication tab:
      • Require Secondary Authentication: Select this check box.

      • Authentication Provider: Select the Starling 2FA service provider.

        NOTE: If the Starling 2FA service provider is not listed, you must first join Safeguard for Privileged Passwords to Starling. For more information, see Starling.

      • Use alternate mobile phone number: Optionally, select this check box and enter an alternate mobile number to be used for two-factor authentication notifications.

        NOTE: If you want to use one-touch approvals, this feature requires a valid mobile phone number for the user. If the user does not have their mobile number published in Active Directory, use this option to specify a valid mobile phone number for the user.

   2. Contact Information tab:
      • Mobile Phone: Enter a valid mobile phone number in E.164 format.
      • Email Address: Enter a valid email address.

Now whenever any of these users attempt to log in to Safeguard for Privileged Passwords, after entering their password, a message appears on the login screen informing them that an additional authentication step is required.