Configuring MFA for your Alibaba Cloud account is one of the best practices for protecting your assets on the cloud. This topic uses the Google Authenticator app as an example to describe how to attach a virtual MFA device to your Alibaba Cloud account.
What is MFA and why should I configure it?
MFA (Multi-Factor Authentication) is a best practice for improving account security. It adds an extra layer of protection beyond your username and password.
With MFA enabled, logging on to Alibaba Cloud requires the following two verification steps:
First factor: Enter your username and password.
Second factor: Another verification method, such as the 6-digit dynamic verification code that a virtual MFA device automatically generates every 30 seconds.
With two-factor authentication, even if your password is leaked, anyone without your mobile phone cannot log on to your account. This effectively prevents account theft and greatly improves security.
Which MFA methods do Alibaba Cloud accounts support?
Alibaba Cloud accounts currently support multiple MFA methods, such as text message verification codes. This topic focuses on virtual MFA devices (Virtual MFA Device), which are software-based multi-factor authentication applications. A virtual MFA app follows the TOTP (Time-based One-Time Password, RFC 6238) standard and generates a 6-digit dynamic verification code every 30 seconds for two-factor verification during logon and other critical operations.
Recommended virtual MFA apps
Google Authenticator: A mainstream TOTP standard app, available for Android and iOS.
Other TOTP-compatible authenticators: such as Microsoft Authenticator and Authenticator (Windows Phone).
Attach a virtual MFA device
Log on to the Alibaba Cloud Account Center. Go to the Security Settings page. In the Other Settings section, click Account Protection for the Set up.
On the Enable Account Protection page, you can select one or more protection scenarios and verification methods. Click OK to go to the identity verification page.
TOTP verification
On the identity verification page, you can verify your identity by email address or mobile phone number.
On the identity verification page, the system sends a 6-digit verification code to your email address. Enter the code and click OK to complete identity verification. The code is valid for 15 minutes.
Download and install Google Authenticator on your mobile phone. After the installation is complete, click Next to go to the binding page. If the app is already installed, click Next.
Use Google Authenticator to scan the QR code on the page and obtain the 6-digit verification code. Enter the code and click Next to complete the account protection setup.
Text message verification
On the Verify Identity page, you can receive a text message verification code on your mobile phone number.
Enter the verification code from the text message and click OK to complete the account protection setup.
NoteIf you choose to use text message verification and your account is not attached to a mobile phone number, you can complete identity verification through your email address first and then attach a mobile phone number to enable account protection.
You have successfully enabled Account Protection.