Multi-factor authentication

MFA is already on by default for staff, non-MIS, school digital champion and Hwb dashboard administrator accounts.

However, school digital champions can also turn on MFA for governors in their school before 30 June 2023.

School digital champions

1. Navigate to https://hwb.gov.wales and log in to Hwb.
   
   
2. Click on User management.
   
   
3. On your ‘Administrator Dashboard’, click on View Users > View Governors.
   
   
4. Use the Search term field as appropriate e.g. type the user’s surname and click on the Search button to locate the relevant user.
   
   
5. Click on the user’s View Details button on the right.
   
   
6. Click on Manage User > Enable MFA for All Apps.
   
   
7. Read the on-screen message and click on the Enable button to proceed.
   
   
8. Whilst still in the user’s record, scroll down and ensure there is a green tick next to ‘MFA Enabled for All Apps’.
   
   
9. Advise the user to follow the instructions below to download the Microsoft Authenticator app and then link the app to their Hwb account.

Download the Microsoft Authenticator app onto an internet enabled mobile device e.g. a smartphone or other internet enabled mobile device that you can access off-site. 

Linking the app to your Hwb account should only take a few minutes, but you must have downloaded the Microsoft Authenticator app onto a smartphone or other internet enabled device before you begin.

The following steps must be completed in one session i.e. you cannot close or skip screens. You will need:

• to log in to Hwb from outside the trusted network of your school or organisation e.g. off-site for the initial setup
  
  
• the internet enabled mobile device onto which you downloaded the Microsoft Authenticator app e.g. a smartphone.

You will only need to follow the instructions below once i.e. when you log in to Hwb for the first time outside the trusted network of your school or organisation e.g. off-site:

1. On a laptop or desktop computer with internet access, navigate to https://hwb.gov.wales and click on Log in. Note: For this step, and during the initial setup only, it is advised that this device is not the one onto which the Microsoft Authenticator app has been downloaded.
   
   
2. ‘Log in’ - Enter your Hwb username and click on Next.
   
   
3. ‘Enter password’ - Enter your Hwb password and click on Sign in.
   
   
4. A screen will appear displaying ‘More information required’.  Click on Next.
   
   
5. On the ‘Microsoft Authenticator. Start by getting the app’ page, click on Next.
   
   
6. On the ‘Set up your account’ page, click on Next.
   
   Depending on the device being used you may get a ‘Scan the QR code’ page showing a QR code, OR a ‘Copy and paste this information into your app’ page showing a secret key.
    
7. On the mobile device onto which you have downloaded the Microsoft Authenticator app e.g. a smartphone, open the Microsoft Authenticator app. Note: If your Hwb account already exists in the Microsoft Authenticator app, you must remove this first by clicking on the account, clicking on the settings cog in the top right-hand corner and selecting ‘Remove account'.
   
   
8. Click on the + (plus symbol) in the top right-hand corner of the screen to add an account.
   
   
9. Click on ‘Other'.
   
   
10. If you have the ‘Scan the QR code’ page described in step 6, scan the QR code using the activated camera on your mobile device.
    
    Note: Do not scan any other QR code.
    
    If you are unable to scan the QR code, click ‘Can’t scan image?’ and follow the next step to manually enter the information.
    
    
11. If you have the ‘Copy and paste this information into your app’ page described in step 6 above, select “Enter code manually” on the mobile device and enter the account name and secret key into the Microsoft Authenticator app. If you are using a single device, you can easily copy and paste the details by pressing the copy button.
    
    
12. On the laptop or desktop computer on which you are attempting to log in to Hwb, on the ‘Scan the QR code’ page (which is displaying the QR code) click on Next.
    
    
13. On the device on which you are attempting to log in to Hwb, click on Next.
    
    
14. On the ‘Enter code’ page, type in the current 6-digit Hwb verification code shown in your Microsoft Authenticator app and click on Next.  Note: If more than 30 seconds has elapsed you may need to enter the latest Hwb verification code from the app and click on Retry.
    
    
15. On the ‘Success!’ page, click on Done.
    
    
16. Setup is complete and you can now log in to Hwb using multi-factor authentication (MFA).

Every time non-learner users log in to Hwb outside the trusted network of their school or organisation, as well as their Hwb username and password, they must prove who they are by providing a unique code generated by the Microsoft Authenticator app:

1. Navigate to https://hwb.gov.wales and click on Log in.
   
   
2. ‘Log in’ - Enter your Hwb username and click on Next.
   
   
3. ‘Enter password’ - Enter your Hwb password and click on Sign in.
   
   
4. ‘Enter code’
    
   • Open the Microsoft Authenticator app and either copy or make a note of the current Hwb 6-digit verification code (the code changes every 30 seconds).
     
     
   • Go back to the Hwb ‘Enter code’ screen and either paste or type in the current Hwb 6-digit verification code.
     
     
5. Click on Verify to go to your home page on Hwb.

If a non-learner account holder obtains a new internet enabled mobile device e.g. a new smartphone, multi-factor authentication will need to be reset.  Please contact your school digital champion or Hwb administrator who will be able to follow the guidance below.

School digital champions and Hwb administrators

School digital champions and Hwb dashboard administrators can reset MFA for individual non-learner account holders in their school or organisation via the Hwb User Management Portal (UMP):

1. Navigate to https://hwb.gov.wales and log in to Hwb.
   
   
2. Click on User management.
   
   
3. On your ‘Administrator Dashboard’, click on View Users > View Staff (or View Digital Champions, View Governors, View Non-MIS).
   
   
4. Use the Search term field as appropriate e.g. type the user’s surname and click on the Search button to locate the relevant user.
   
   
5. Click on the user’s View Details button on the right.
   
   
6. Click on Manage User > Reset MFA.
   
   
7. Read the on-screen message: “Are you sure that you want to reset MFA for [name]@hwbcymru.net?”. Click on the Continue button to proceed.
   
   
8. Whilst still in the user’s record, scroll down and ensure there is a green tick next to ‘MFA Enabled for All Apps’.
   
   
9. Advise the user to follow the instructions to download the Microsoft Authenticator app and link it to their Hwb accounts.