Notes

This screen answersUS-10

Acceptance criteria

As a portal user, I want to log in using Microsoft Authenticator or email OTP, so my account is protected beyond a password.

Given a user has Multi-Factor Authenticator enrolled via Microsoft Entra, when they log in with correct credentials, then they are prompted for Authenticator approval or email OTP before access is granted.
Given a user fails MFA 5 times, when the 5th attempt fails, then the account is temporarily locked per security policy. Auto-unlock after 15 min.
After auto-unlock and another 3 failed attempts within 24 hours, account is temporarily locked for admin to unlock. (full admin-unlock go to US-54).
Given MFA is enabled, when an existing user without enrollment logs in, then they are forced through enrollment before proceeding.

Wireframe state

DefaultWrong codeSoft lockedHard locked

Confirm it is you

Open Microsoft Authenticator on your phone and enter the 6 digit code for RaneemHCP.

Code not accepted. That code is not right. You have 3 tries left before the account locks for 15 minutes.

Account locked for 15 minutes. Too many wrong codes. Try again in 14:32. After 3 locks in 24 hours an administrator has to unlock the account.

Account locked. This account was locked by an administrator after repeated lockouts. Ask your facility administrator to unlock it.

Authenticator code

The code changes every 30 seconds.

Trust this device for 8 hours