Two-Step Verification for Cisco Umbrella – Setup Guide

Overview: Two-Step Verification

Two-step verification is the ability to add a second factor of authentication to your login. This combines something you know (your password) with something you have (your mobile phone), and whenever you log into your account, you'll need to enter both your password and a security code from your mobile device. In order to better secure your login to Cisco Umbrella, we encourage you to use two-step verification. 

It's a two step process: enable the verification for your account in the dashboard, then select an authentication method (usually an app on your phone). Every login from then on requires two factors. 

Enabling Two-Step Verification

Before you start, it's important to note that you can only enable two-step verification on the account you're currently logged in with. You can view whether another administrator account has two-step verification turned on, but you cannot change another account's settings.

1. In your Umbrella dashboard, navigate to Admins > Accounts.
2. In the table, click to expand the account name you're logged in as.
3. Click Enable.
   
   
   
   
4. Select a two-step verification method. There are two ways to receive your initial security code to enable the service. These methods are also the ones you'll use in the future to authenticate. For more about each method, click a link below to jump to that section of this article:
   
   • Use text messages—Security codes will be sent to your mobile phone via SMS text message
   • Use mobile app—Security codes will be generated by an authenticator app. For more information about Google Authenticator, click here.
     
     
     
5. Click Continue.

Once enabled, you have to verify your mobile device in order to turn on the two-step verification. This is to ensure you don't accidentally turn the feature on and are unable to use it successfully.

Configuring Two-step Verification – Text Messages or Authentication App

Method 1: Text Messages (SMS)

1. If you select this method, you'll be asked to input your phone number including the country code and area code.
   
   
   
   
2. Click Continue.
   You'll receive a text message on your mobile device that includes a six digit security code.
3. Enter your original password—the one you use to log into Umbrella—along with the six digit code you've just received, then click Enable two-step verification.
   
   
   
   Note: The SMS code expires 30 seconds after being sent. It's possible if there's a delay with your carrier or you don't use your code right away, you'll need to have it resent. There is an option to do this at the login screen by clicking Resend Code.
   
   At this point, you'll receive a very important message with an emergency recovery code to disable two-step verification in case you lose your phone.
   
   
   
   Reminder: Make sure you keep your recovery code somewhere separate from your two-factor device (phone or tablet). Likewise, don't store your passwords on your phone—the security is only effective if the password and the security codes are separate.
    
4. Click Done. Now that it's enabled, Umbrella text messages you a security code when you log into Umbrella.

   We suggest using Google Voice for the SMS, because if someone gains access to your Gmail account, the attacker can use the reset password feature and also receive one-time passwords.

Method 2: Mobile authentication app (preferred)

This method requires first that you download an authentication app. We recommend Google Authenticator, which works on all major mobile platforms. To read more about it including how to install, click here.

Alert: If the time on your mobile device using Google Authenticator is off significantly from actual time, code verification does not work. Please ensure that your mobile device is correctly time synced. Even being off by a few minutes can make a big difference in regard to receiving codes that have not expired.

1. Once you've installed Authenticator or an equivalent app, in Umbrella, select Use mobile app and click Continue.
2. You'll be asked to scan a QR code. Go into Authenticator on your mobile device, and add a new token (clicking the + in the lower right) then Scan Barcode.
   
   
   
   

3. On your mobile device, go into Authenticator and select Add Token > Scan Barcode. After scanning the barcode, you'll receive a six-digit code that you'll use to authenticate.
   
   

4. In Umbrella, enter your original password—the one you use to log into Umbrella—along with the six digit code you've just received, then click Enable two-step verification.
   
   
   Once this step is complete, your authentication app will generate a fresh code every 30 seconds that you can use to log into Umbrella.
   
   At this point, you'll receive a very important message with an emergency recovery code to disable two-step verification in case you lose your phone.
   
   Reminder: Make sure you keep your recovery code somewhere separate from your two-factor device (phone or tablet). Likewise, don't store your passwords on your phone—the security is only effective if the password and the security codes are separate.
   
   

Logging in as the user

Logging is as simple as entering the security code you've received via the mobile app or text message after you've already logged in with your password. The verification screen is shown after your initial login.

1. In Umbrella, log in as you would normally: enter your Username and Password and click Log In.
   
   
   
   
2. In the verification screen, enter the security code.
   
   
   
   
3. Click Log In Securely.
   Optionally, you can select Remember device for 30 days. If you select this option, you will not be prompted for the security code for the next 30 days.

Lost your phone or wish to disable two-step verification?

Disable two-step verification

1. In your Umbrella dashboard, navigate to Admin > Accounts.
2. In the table, click to expand the account name you're logged in as.
3. Click Disable.
   You are sent a final security code that you must use to disable two-step authentication.
4. Enter your original password—the one you use to log into Umbrella—along with the six digit code you've just received, then click Disable Two-Step Verification.
   
   
   
   

You'll receive a final message letting you know that two-step authentication has been disabled for your Umbrella account.

Lost phone

If you lose your phone, you can disable two-step authentication use the emergency backup code that was generated for you when you first configured two-step verification.

1. Log into Umbrella with your username and password.
2. When prompted for your security code, click Lost your phone?
   
   
   
   

3. This will take you to an area where you enter the emergency backup code generated when you first configured two-step verification.
   
   
   
   

4. Click Disable.
   Two-step verification is disabled and you can access the Umbrella dashboard with only your username and password.