MFA (Multi-Factor Authentication) can be enabled for:
- All users
- Specific user types
- Individual users
This is managed by administrators in Imageshop.
MFA Registration
When MFA is enabled, affected users will be prompted to register an authentication app the next time they log in to Imageshop after entering their username and password. The user will then see a QR code that must be scanned using an authentication app.
We recommend using:
- Google Authenticator
- Microsoft Authenticator
Other authentication apps that support the TOTP standard will also work, for example:
- LastPass Authenticator
- FreeOTP
Once the QR code has been scanned, the user will see a new entry in the authentication app. The appearance may vary depending on which app is used.
The user must then enter the code from the authentication app into the “Authentication code” field below the QR code. Please note that the authentication code refreshes every 30 seconds. If the code expires before it is entered, the user will receive an error message and must try again.
In such cases, it may be helpful to wait until a new code is generated before attempting again. Also note that the authentication code is specifically tied to the user’s Imageshop account. If the user has multiple accounts registered in the authentication app, separate codes will be generated for each account. Make sure the correct code is used.
Logging in with MFA
Once the user has registered the QR code and entered a valid authentication code, they will be logged in. During future logins, the user will only be asked for the authentication code. The QR code will not be displayed again after the initial registration.
Resetting or Removing MFA
If a user loses access to their authentication app, or if MFA needs to be disabled, an administrator must reset the user’s MFA setup.
To do this:
- Go to the user’s settings
- Scroll down to the 2FA section
- Click “Remove 2FA”
- Confirm the action
The next time the user logs in, the login process will work as normal. If MFA is still required for the user or user type, the system will automatically generate a new QR code, and the registration process must be completed again.