How to Setup Multi-Factor Authentication (MFA) for your Qlik Account and Cloud Analytics

[Andre_Sostizzo]

Multi-factor authentication (MFA) is an extra layer of security added to your Qlik Account.

It:

• Is Optional for Service Account Owner (SAO)
• Is Optional for Invitees and Tenant Admins
• Can be disabled at any time

Mandating the use of MFA for your users requires a subscription which allows the use of a third party IdP (Identity Provider). 

MFA is not supported in legacy Qlik Sense on-premise installations. See Configuring security > Authentication.
 

Resolution

1. Install a Multi-Factor Authentication (MFA) app on your phone, such as Google Authenticator, LastPassAuthenticator, Microsoft Authenticator, or similar.

   Using only a QR reader will not work. An MFA Authenitcator app is required.

2. Log in to your Qlik Portal (see How to Access My Qlik Portal for details)
3. Navigate to Password & Security
4. Scroll to Multi-factor authentication and click Set up
   
   
   
   
5. Confirm the on-screen instructions to Log out
   
   
   
   
6. Scan the QR code with your MFA Authenticator and enter the Authenticator's one-time code
   
   
   
   
7. Save the provided Recovery Code, confirm by ticking the checkbox, and click Continue

   This code is mandatory in case you need to recover your account. A new one will be generated after use; always save the most recent one.

   
   
   
8. An Authenticator app has been successfully activated
   
   
   

If Multi-factor Authentication needs to be disabled at any point, see How to Reset or Disable MFA (Multi-Factor Authentication) for Qlik Cloud Analytics.

Frequently Asked Questions

Q: What happens if SAO is locked out due to a device change or loss?
A: The SAO can use the Recovery Code generated while setting up MFA.

Q: What happens if SAO loses the MFA recovery link or code or does not save the newly generated one?
A: Contact Qlik Customer Support to reset MFA.

Q: Can a user set up MFA without a mobile?
A: Yes. Authenticators have Desktop options.
 

Related content:

SAML configuration with Okta (Qlik Help)
Qlik Sense SAML: Okta Configuration (YouTube)

[Notwo]

When will you make it possible to enforce Multi-Factor Authentication for all users in my Qlik Sense account? The security governance of MFA is very weak if it is up to the individual business user to enable MFA on their account as an optional feature. Like all our other SaaS services we would require to have MFA enforced account-wide by the admin.

Alternatively if you would include standard SSO options like Google Workspace to the Qlik Sense Business SaaS to re-use their MFA that comes with the SSO. 

[Sonja_Bauernfeind]

Hello @Notwo !

Thank you for your feedback and for voicing your interest in further development and improvements. It's a great idea and I would highly recommend you post it over on our ideas forum to give that feedback directly to our product teams. 

Please feel free to @ me once you do as I want to cast my vote on it!

All the best,

Sonja 

[Notwo]

Thank you  @Sonja_Bauernfeind . I have create an idea https://community.qlik.com/t5/Suggest-an-Idea/Enforced-MFA-and-or-Google-SSO-for-Qlik-Sense-Business...

[Sonja_Bauernfeind]

Voted! Thanks, @Notwo 

[WayneH]

How has this not been enabled yet as a forced item. Where every user must select to do this them selves. This needs to have the option to be enforced at a global level.

Its 2023, the security threats have moved on, MFA is no longer "optional"

[retretrt]

need also this urgently 

[Sonja_Bauernfeind]

Hello @retretrt @WayneH 

Please vote for the existing idea in our ideation platform which is currently gathering feedback. Enforced MFA and/or Google SSO for Qlik Sense Business SaaS 

If you are unable to access the above link, please go to the ideation platform first, where you will be logged in. You can click the link above afterwards.

For Qlik Cloud (Enterprise), I recommend reviewing the option to rely on your own IdP, rather than the Qlik ID and optional MFA.

All the best,
Sonja 

[retretrt]

hi, i have but it has only received 10 votes. Security is seen as a basic minimum requirement and not something that can be "voted on". We will re-evaluate our license with qlik as enforcing security and privacy in 2023 is just something any company cannot survive without

[Sonja_Bauernfeind]

Hello @retretrt I'm forwarding the information to our product team; though please keep an eye on the idea as this is where you will see movement when it has been reviewed.

All the best,
Sonja 

[Daniele_Purrone]

Hi @retretrt ,

judging by your email address, I would say (correct me if I'm wrong) that your customer account has a Qlik Sense Enterprise SaaS subscription, which means that you can setup your own IdP and enforce MFA on all of your users.

That's one of the benefits of having a Enterprise subscription as opposed to Qlik Sense Business, which is not an enterprise offering.

We cannot enforce MFA on QlikId accounts, as those can be used across different tenants (and companies) and even just in order to reach out to support in case of need. That's why we leave it to the single users to decide whether to implement it or not, when using QlikID.
As said, however, you should be free to use any Identity Provider of your choosing and set up the security level that suits your company.

Please, let us know if you have questions about it.