What is Multi-Factor Authentication?

Multi-factor authentication (MFA) is now the industry-standard solution for keeping your data safe from identity-based attacks.

MFA works by requiring an additional form of identification in addition to your username and password using a combination of three things:

• Something you know - username and password.
• Something you have - a physical device like a smartphone or security device that can receive or provide a verification code.
• Something you are - biometric authenticators like fingerprints, face recognition.

What happens when you first log in to Unity® Practice Management?

The first time you log into Unity® Practice Management, you will be prompted for MFA.

1. Log into Unity® Practice Management using your username and password.
2. Enter a mobile phone number and request your verification code by SMS.
3. Use the verification code you receive on the mobile phone as your additional verification.
4. At this point, you are given the option of registering your Windows Login. Credentials as your secondary MFA method, which can be your password, PIN or Fingerprint (this will depend on the features available on your device).

What happens next time you log into Unity® Practice Management?

Unity® Practice Management authentication uses adaptive MFA, which means the frequency you are prompted for additional verification will depend on Unity® Practice Management’s level of confidence in the following compared with your previous logins:

1. Your new login location
2. Your new login IP address
3. Your new login device

Here are some examples:

1. You only ever use your laptop or PC from the same office - MFA will only be prompted on initial login.
2. You occasionally take your laptop or PC and work from home or another location – as it is the same device, MFA will only be prompted on initial login unless the IP address at your login location is deemed untrusted.
3. You occasionally log in from your mobile or tablet when you are away from the office - the first time you use your mobile and tablet you will be prompted for MFA as it is a new device, when you use it again you will only be prompted if you are connecting from a new location/IP address.

Why is email unsuitable for Multi-factor Authentication?

MFA is based on using multiple forms of identification (something you know, have or are). A username and password is something you know. Email is also something you know. If, however, your username and password have been compromised, then there is a risk that your email credentials have also been compromised. Having a separate form of identification, such as an SMS to a phone (something you own), is much more secure.