How to Setup Multi-Factor Authentication (MFA) for your Qlik Account and Cloud Analytics

[Andre_Sostizzo]

Multi-factor authentication (MFA) is an extra layer of security added to your Qlik Account.

It:

• Is Optional for Service Account Owner (SAO)
• Is Optional for Invitees and Tenant Admins
• Can be disabled at any time

Mandating the use of MFA for your users requires a subscription which allows the use of a third party IdP (Identity Provider). 

MFA is not supported in legacy Qlik Sense on-premise installations. See Configuring security > Authentication.
 

Resolution

1. Install a Multi-Factor Authentication (MFA) app on your phone, such as Google Authenticator, LastPassAuthenticator, Microsoft Authenticator, or similar.

   Using only a QR reader will not work. An MFA Authenitcator app is required.

2. Log in to your Qlik Portal (see How to Access My Qlik Portal for details)
3. Navigate to Password & Security
4. Scroll to Multi-factor authentication and click Set up
   
   
   
   
5. Confirm the on-screen instructions to Log out
   
   
   
   
6. Scan the QR code with your MFA Authenticator and enter the Authenticator's one-time code
   
   
   
   
7. Save the provided Recovery Code, confirm by ticking the checkbox, and click Continue

   This code is mandatory in case you need to recover your account. A new one will be generated after use; always save the most recent one.

   
   
   
8. An Authenticator app has been successfully activated
   
   
   

If Multi-factor Authentication needs to be disabled at any point, see How to Reset or Disable MFA (Multi-Factor Authentication) for Qlik Cloud Analytics.

Frequently Asked Questions

Q: What happens if SAO is locked out due to a device change or loss?
A: The SAO can use the Recovery Code generated while setting up MFA.

Q: What happens if SAO loses the MFA recovery link or code or does not save the newly generated one?
A: Contact Qlik Customer Support to reset MFA.

Q: Can a user set up MFA without a mobile?
A: Yes. Authenticators have Desktop options.
 

Related content:

SAML configuration with Okta (Qlik Help)
Qlik Sense SAML: Okta Configuration (YouTube)

[WayneH-RNNZ]

As a test user, not being able to test or validate SSO has a bearing on useability. I have a customer that is moving to QSense, and we cannot test to see if there are any issues, one way or the other. i have a dummy M365 tenant, and a dummy QSense account.

and in the non-integrated environment, how hard would it be to put in a setting to say, "all new users have MFA enabled" and stop the ability for end users to remove the MFA requirement.

[Daniele_Purrone]

Hi @WayneH-RNNZ we understand the requirement and are actively engaging our product team so that they make a decision. In the meantime, please engage our sales department and request a Qlik Sense Enterprise trial instead of a Qlik Sense Business one.  That way you will be able to test and validate single sign on via any IDP of your choosing.

[retretrt]

@Daniele_Purrone thank you for clearing. Was not aware and will set up with IP

[random_user_3869]

Hello everyone,

i see that it is possible to enable individual users to use MFA.

What i would like to know if it's possible to enforce all users to use MFA.

The users of our tenant come from a custom IDP.

So what would be the next step in order to achieve that ?

Is that even possible ?

Thank you

[Sonja_Bauernfeind]

Hello @random_user_3869 

This article documents the use of MFA when QlikID is used as an IDP. If you have your own Identity Provider (IDP), control over Multi Factor Authentication sits with your IDP. You will need to investigate whether or not your IDP supports your requirement. 

All the best,
Sonja 

[random_user_3869]

Thank you @Sonja_Bauernfeind  for your comment.

My question is : how to know that MFA is compatible with my IDP ?

If it is then are there any setup to perfom on the qlik cloud side ?

Ay documentaiton on this topic anywhere ?

Thank you for your response

[Sonja_Bauernfeind]

Hello @random_user_3869 

You will need to speak with your IDP provider to see how they set up Multi Factor Authentication. This is entirely done on your/the Identity Provider's end. Example: If you are using Okta as your IDP, investigate what options Okta has in regards to MFA.

You mentioned you are are already using a third-party IDP, but here are the resources around setting one up regardless:

Setting up identity providers 
Switching from Qlik Account to a corporate IdP configuration 

This article (and any setup of MFA in QlikID) are not relevant if you use a third party provider.

All the best,
Sonja