Enable an MFA device for a RAM user

Enable a virtual MFA device

Prerequisites

Before you can enable a virtual MFA device, you must download and install the Google Authenticator app on your mobile device. You can use one of the following methods to download the Google Authenticator app:

• For iOS, download the Google Authenticator app from the App Store.
• For Android, download the Google Authenticator app from your preferred app store.
  Note For Android, you must also download and install a quick response (QR) code scanner from an app store for Google Authenticator to identify QR codes.

Enabling methods

You can use one of the following methods to enable a virtual MFA device based on your business requirements:

• You can enable a virtual MFA device by using an Alibaba Cloud account or a RAM user that has administrative rights in the RAM console.
• If you have selected Required for Enable MFA when you create a RAM user, you are required to bind a virtual MFA device upon the logon of the RAM user. You can select Virtual MFA Device in the Enable MFA Device dialog box and go to 6.
• If a RAM user of your Alibaba Cloud account is allowed to manage its own virtual MFA device, the RAM user can enable the virtual MFA device in the RAM console. To enable a virtual MFA device, perform the following operations: Move the pointer over the profile picture in the upper-right corner of the console and click Security Information Management. On the Virtual MFA Device tab of the Console Logon page, click Enable Virtual MFA Device and go to 6.

Procedure

1. Log on to the RAM console by using your Alibaba Cloud account or a RAM user that has administrative rights.
2. In the left-side navigation pane, choose Identities > Users.
3. In the User Logon Name/Display Name column, click the username of the RAM user for which you want to enable a virtual MFA device.
4. On the page that appears, click the Authentication tab. Then, click the Virtual MFA Device tab.
5. Click Enable Virtual MFA Device.
6. On your mobile device, enable a virtual MFA device.
   Note The following example shows how to enable a virtual MFA device in the Google Authenticator app on your mobile device that runs iOS.
   1. Open the Google Authenticator app.
   2. Click Get started and select one of the following methods to enable a virtual MFA device:
      • Tap Scan a QR code in the Google Authenticator app. Then, scan the QR code that is displayed on the Scan the code. tab in the RAM console. This method is recommended.
      • Tap Enter a setup key. Then, enter the account and key that you obtained from the QR Information tab in the RAM console, and tap Add.
7. In the RAM console, enter the two consecutive verification codes that are displayed in the Google Authenticator app. Then, click Confirm Bind.

Enable a U2F security key

Enabling methods

You can use one of the following methods to enable a U2F security key based on your business requirements:

• You can enable a U2F security key by using an Alibaba Cloud account or a RAM user that has administrative rights in the RAM console.
• If you have selected Required for Enable MFA when you create a RAM user, you are required to bind an MFA device upon the logon of the RAM user. You can select U2F Security Key in the Enable MFA Device dialog box and go to6.
• If a RAM user of your Alibaba Cloud account is allowed to manage its own MFA device, the RAM user can enable a U2F security key in the RAM console. To enable a U2F security key, perform the following operations: Move the pointer over the profile picture in the upper-right corner of the console and click Security Information Management. On the U2F Security Key tab of the Console Logon page, click Enable U2F Security Key and go to 6.

Procedure

1. Log on to the RAM console by using your Alibaba Cloud account or a RAM user that has administrative rights.
2. In the left-side navigation pane, choose Identities > Users.
3. In the User Logon Name/Display Name column, click the username of the RAM user for which you want to enable a virtual MFA device.
4. On the page that appears, click the Authentication tab. Then, click the U2F Security Key tab.
5. Click Enable U2F Security Key.
6. On the Bind U2F Security Key page, bind the RAM user to the U2F security key.
   Note Before you perform the following operations, you must understand the limits on U2F security keys. For more information, see Limits.
   1. Plug the U2F security key into the USB port on your computer.
   2. Tap the button of the U2F security key.
   3. In the message that prompts you to obtain the U2F security key, click OK.
   4. In the message indicating that the U2F security key is obtained, click Confirm Bind.