Account Center:Attach or detach a virtual MFA device

What is MFA and why should I configure it?

MFA (Multi-Factor Authentication) is a best practice for improving account security. It adds an extra layer of protection beyond your username and password.

With MFA enabled, logging on to Alibaba Cloud requires the following two verification steps:

1. First factor: Enter your username and password.

2. Second factor: Another verification method, such as the 6-digit dynamic verification code that a virtual MFA device automatically generates every 30 seconds.

With two-factor authentication, even if your password is leaked, anyone without your mobile phone cannot log on to your account. This effectively prevents account theft and greatly improves security.

Which MFA methods do Alibaba Cloud accounts support?

Alibaba Cloud accounts currently support multiple MFA methods, such as text message verification codes. This topic focuses on virtual MFA devices (Virtual MFA Device), which are software-based multi-factor authentication applications. A virtual MFA app follows the TOTP (Time-based One-Time Password, RFC 6238) standard and generates a 6-digit dynamic verification code every 30 seconds for two-factor verification during logon and other critical operations.

Best practices for virtual MFA

• Enable MFA: Attach a virtual MFA device to protect your cloud assets with two-step verification.

• Detach before uninstalling: Always detach the virtual MFA device before you uninstall the MFA application or change your phone. Otherwise, you cannot log on.

• Handle shared accounts: If multiple users share your account, screenshot the QR code during initial MFA setup so other users can scan it to receive verification codes in sync.

Attach a virtual MFA device

1. Log on to the Alibaba Cloud Account Center. Go to the Security Settings page. In the Other Settings section, click Account Protection for the Set up.

2. On the Enable Account Protection page, you can select one or more protection scenarios and verification methods. Click OK to go to the identity verification page.

   TOTP verification

   1. On the identity verification page, you can verify your identity by email address or mobile phone number.

      On the identity verification page, the system sends a 6-digit verification code to your email address. Enter the code and click OK to complete identity verification. The code is valid for 15 minutes.

   2. Download and install Google Authenticator on your mobile phone. After the installation is complete, click Next to go to the binding page. If the app is already installed, click Next.

   3. Use Google Authenticator to scan the QR code on the page and obtain the 6-digit verification code. Enter the code and click Next to complete the account protection setup.

   Text message verification

   1. On the Verify Identity page, you can receive a text message verification code on your mobile phone number.

   2. Enter the verification code from the text message and click OK to complete the account protection setup.

   Note

   If you choose to use text message verification and your account is not attached to a mobile phone number, you can complete identity verification through your email address first and then attach a mobile phone number to enable account protection.

3. You have successfully enabled Account Protection.

Detach a virtual MFA device

• If you still have access to the virtual MFA application, follow these steps to detach it:

  1. Log on to the Alibaba Cloud Account Center. Go to the Security Settings page. In the Other Settings area, click Modify for Account Protection.

  2. Click Turn off in the Account Protection Settings section to disable account protection, or click Turn off in the verification method section to disable a specific method. Click Edit to configure which Scenarios require protection.

  3. On the Verify Identity page, open the Alibaba Cloud app or Google Authenticator and enter the 6-digit verification code. Alternatively, click Try a different method to verify by phone or email.

  4. If the system triggers a security review or an asynchronous detach process, log on to the Alibaba Cloud Account Center again. In the related notifications or to-do items, find the detach request and click Approve or Confirm to complete the detach operation.

  5. After verification, account protection is turned off.

• If the preceding methods do not work and you cannot log on, submit an appeal to detach the MFA device. Logon is blocked by an unavailable virtual MFA device or an IP address mask.