Notes

This screen answersUS-10

Acceptance criteria

US-10 2FA Login (Microsoft) + Auto-Unlock HIGHEST NEW SCREEN

As a portal user, I want to log in using Microsoft Authenticator or email OTP, so my account is protected beyond a password.

Given a user has Multi-Factor Authenticator enrolled via Microsoft Entra, when they log in with correct credentials, then they are prompted for Authenticator approval or email OTP before access is granted.
Given a user fails MFA 5 times, when the 5th attempt fails, then the account is temporarily locked per security policy. Auto-unlock after 15 min.
After auto-unlock and another 3 failed attempts within 24 hours, account is temporarily locked for admin to unlock. (full admin-unlock go to US-54).
Given MFA is enabled, when an existing user without enrollment logs in, then they are forced through enrollment before proceeding.

Wireframe state

DefaultReset requested

Lost your phone?

Choose how to get back in.

Request sent. Your administrator has the request. When they reset your two-step sign in, you can sign in with your password and set it up again on the new phone.

1. Get a code by emailWe send a 6 digit code to your work email.Send me an email code

2. Use a recovery codeOne of the 10 codes you saved when you set up two-step sign in.Enter a recovery code

3. Ask your administratorThey reset your two-step sign in. You set it up again on your new phone.

Ask for a reset

Request sent

Back to sign in