New MFA Not Remembering for 30 Days

Amy Shaiman

Greetings,
I have setup the new MFA. I've been noticing (as have some of our users) that we are having to enter MFA daily when logging in, even after selecting the box to remember the MFA authentication for 30 days. Cookies/cache in the Chrome browser are set to save. Are others experiencing this as well?

Thanks,

Amy

Joe Killian

@Amy Shaiman

Our org has the same issue. I assume it's related to the BBID rollout going….not so smooth.

Amy Shaiman

@Joe Killian, thanks for taking the time to reply and confirm. Hopefully Blackbaud will have a solution for this, as logging in is taking much longer with twice as many clicks plus the MFA repeated daily.

Annette Rurka

@Amy Shaiman We also experience the same thing. I assumed some of ours was because some of our users use different computers (remote access versus campus (we're a higher education foundation)). We've never gotten it to ‘honor’ the 30 days for MFA. Thanks, Annette

Amy Shaiman

@Annette Rurka, thanks for taking the time to reply. I too have users on different computers (including myself sometimes) and it is happening even for people who just use one machine. (I took a while to observe the behavior myself to make sure it wasn't just switching browsers or computers.)
Thanks!

John Vogel

Hi @Amy Shaiman, To improve overall security, Blackbaud ID now triggers to enter the MFA OTP again if your IP address changes.

Joe Killian

@John Vogel Outside of an IP Address Change, should a stored cookie/cache browser session now remember the 30 day preference?

John Vogel

Hi @Joe Killian, we track on the server side now so there's no cookie or cache involved now either which also improves security. So as long as you're on the same browser version, OS version, IP address and you've selected the remember my device option then you won't be prompted to complete the MFA step.

Amy Shaiman

Thank you for the update @John Vogel.

Amy Shaiman

Greetings @John Vogel,
I am writing with a follow-up question. If the checkbox remembering the MFA for 30 days is not cache/cookie/etc related but IP address based, those who work without a static IP address are going to have to use MFA on potentially every login where the IP address is different? This is as designed?
Thanks,
Amy

Ken Neff

@John Vogel, this change isn't working well for our organization and is aggravating our Blackbaud users. We are in a campus environment with multiple buildings using different network subnets, DHCP, no static IP addresses. Our users are now having to do MFA upon login multiple times per day. I, myself, just did MFA for the 4th time today just to get to this community post, same computer, same OS, same browser. There has to be a more user-friendly way.

John Vogel

Hi @Amy Shaiman that is correct, a different IP requires reverifying.

John Vogel

Hi @Ken Neff, I always recommend establishing a SSO connection with Blackbaud ID for multiple benefits. Here are some top level benefits:

• IT Admins can centrally manage user identities and ability to authenticate across all apps
• IT Admins can specify the security protocols required for user authentication
• End users have a single account and credentials to manage
  

Joe Killian

@John Vogel

Can you expand a little on this point?

IT Admins can specify the security protocols required for user authentication

Would the org admin be able to change the trigger and/or frequency for MFA prompts?

We were looking to migrate to SSO in our slow season this fall, but may look at expediting if that solve the issues Ken expressed.

John Vogel

Hi @Joe Killian, when you setup a SSO connection with Blackbaud ID then you get to manage all of the authentication controls directly with your IDP. For example, maybe you don't want users to be able to authenticate with SMS for MFA and only use an Authenticator App. Then you can do that. OR maybe you have different password complexity or renewal requirements then you have full control there too. When you establish a SSO connection with Blackbaud ID, we send the user to your IDP to authenticate based on them entering an email with a claimed domain associated with your SSO connection. From there the user authenticates with your IDP and the IDP passes back the signal that the user has successfully authenticated. On Blackbaud's end, it's a blackbox what the user did to authenticate because we have established a trusted relationship for the IDP to handle the authentication steps.