Configuring a TOTP 2FA app

SECURITY  All users

NAVIGATION  My > Miscellaneous > Preferences > One-Time Password Options

IMPORTANT  One-time password emailing is no longer supported.

Autotask supports the TOTP (Time-based One-time Password) algorithm for two-factor authentication (2FA) in both the Autotask and the Datto RMM applications. The one-time password is generated by an app you install on your mobile device.

Any app that uses the TOTP algorithm (such as Duo, Microsoft Authenticator, or Google Authenticator) should be compatible with both Autotask and Datto RMM. If you have two separate TOTP accounts for Autotask and Datto RMM, you only need to put in the one-time password for the first application you log into. Navigation to the other application is seamless.

NOTE  The instructions below were tested for Duo, Microsoft Authenticator and for Google Authenticator. We cannot test all possible TOTP 2-Factor Authentication solutions. If you are using a different app, please follow the instructions provided by that app's support resources.

How to...

To start using a TOTP app, do the following:

  1. Depending on your operating system, go to the App Store or the Play Store and search for Duo, Microsoft Authenticator, Google Authenticator, or another app of your choice.
  1. Install the app according to the instructions for Duo, Google Authenticator, Microsoft Authenticator, or another app of your choice.
  2. Log into Autotask and go to > My > Miscellaneous > Preferences.
  3. Click One-Time Password Options.
  4. Click Request New QR Code.

The window will expand and display a QR code.

  1. Open Authenticator on your mobile device and click the + symbol, or from the menu, select Set up account.
  2. Click Scan a barcode.
  3. Place the barcode inside the viewfinder rectangle to scan it. Authenticator will display a six-digit one-time code that is valid for 30 seconds.
  4. Enter the code into the Generated Code field. Check the show check box to display the generated code in clear text.
  5. Enter your Autotask password into the Autotask Password field.
  6. Click Validate. If you entered the correct code and password, a success notification will be displayed.

You have now set up a valid Autotask account in Microsoft Authenticator or Google Authenticator. It will generate a new one-time password every 30 seconds, even when you are not connected to a network.

IMPORTANT  Since 2FA is time-based, you must retrieve the time for your time zone automatically for one-time password options to work, not set it manually.

The One Time Password Options configuration page does not currently provide a visible key code for manual entry.

If your preferred TOTP phone app, for example, Authenticator, includes a manual entry option, you can use an external QR code reader app on your browser, for example, Google's Right-click QR reader extension.

  1. Download the QR code reader app to the browser you use to open Autotask. Then complete steps 1 through 5 under Set up an Autotask account with Microsoft Authenticator or Google Authenticator.
  2. Use the QR code reader app to read the QR code on the One Time Password Options page. The app displays a string similar to the one below:

otpauth://totp/Autotask:username@domain.com?secret=abcdefghijklmnop

username@domain.com should be your Autotask username. The 16 character string after = is the key code.

  1. Open the TOTP app on your phone and go to the account setup page. Select the manual entry option (the option name varies between apps).
  2. Enter the Autotask username from the QR reader string into the Account or User field (field name varies between TOTP apps). Then enter the 16 character key code (everything after =) in the key code field. Save.
  3. The phone should start to generate one time password codes. Now, sync your phone with Autotask.
  4. Return to the One Time Password Options page in Autotask.
  5. Enter the current one time password from your phone into the Generated Code field. Select the show check box to display the generated code in clear text.
  6. Enter your Autotask password in the Password field.
  7. Click validate.

NOTE  The One Time Password is valid for 30 seconds! IF you fail to enter the generated code and your Autotask password and click Validate within 30 seconds, repeat with a newly generated code.

If you lose your TOTP device, you can ask an administrator to pause the 2FA requirement for the next login or 24 hours. This allows you to log into Autotask and request a new QR code so you can set up an account on a different device. Refer to Set up your account with Microsoft Authenticator or Google Authenticator.

If your system administrator removes the 2FA requirement from your account, you may want to remove your 2FA account from your mobile device.

  1. On your mobile device, open the Authenticator app.
  2. Touch the account entry until the top menu bar appears and tap the Delete (trash can) icon.
  3. Click Remove account.