Enrollment Preferences Policy

Enrollment Preference policy allows administrator to associate appropriate authenticators for securely accessing the 1Kosmos application.

---

Overview

With the Enrollment Preferences policy, administrators can use the Enrollment Preferences tab under the Authentication menu to allow first-time users to enroll their mobile or landline numbers, enabling additional MFA methods such as SMS OTP or voice OTP after the user provides their password. End users can also onboard their devices using the 1Kosmos app to experience passwordless access on first-time login.

• Passwordless Access on 1Kosmos App — enable this option to allow users to onboard their devices for passwordless login. Before enrolling a device, users must have the 1Kosmos mobile app installed.
• Mobile Phone — enable this option to associate a mobile number for receiving OTPs via SMS during authentication.
• Landline — enable this option to receive OTPs at the configured number through a voice call.

Enabling MFA for first-time login users

1. Navigate to the AdminX interface.
2. Go to Authentication > Enrollment Preferences. The Enrollment Preferences page is displayed.
3. Turn the First time login enrollment factors slider ON.
4. In the Initial Sign in MFA Enrollment policy section, enable the appropriate authenticators such as Passwordless Access on 1Kosmos App, Mobile phone, and Landline.
5. Click Save.

Enrolling mobile or landline through the login screen

Once the community administrator has enabled the Enrollment Preferences setting, first-time login users can associate their mobile or landline details to log in to AdminX.

Prerequisites:

• The user must be logging into AdminX for the first time and must be part of one of the preferred user stores.
• The administrator must have enabled the First time login enrollment factors setting under the Enrollment Preferences tab, along with at least one authenticator such as Mobile or Landline.

To enroll your mobile or landline number:

1. Open the AdminX URL.
2. On the USERNAME tab, enter the username and click Next.
3. Enter your password and click Next.
4. On the Choose an authentication method screen, click Setup MFA.
5. On the Setup multifactor authentication screen, select either Setup SMS Authentication or Setup Voice Call Authentication:

   • Setup SMS Authentication — on the Enroll a mobile number screen, select the appropriate country code, enter your mobile number, and click Next.
   • Setup Voice Call Authentication — on the Enroll a landline number screen, select the appropriate country code, enter your landline number, and click Next.
6. On the Enter your verification code screen, enter the code received on your mobile or through the voice call.

After the code is entered, the screen notifies the user that the phone number has been added to their profile.

Enrolling devices through the 1Kosmos app

Before enrollment, community administrators must have enabled the Passwordless Access on 1Kosmos App setting in the Initial Sign in MFA Enrollment policy section under Authentication > Enrollment Preferences.

To enroll the user's device using the 1Kosmos app:

1. Go to the Sign in page of your tenant, enter the username to be onboarded, and click Next.
2. Enter the password and click Next.
3. Click Setup MFA.
4. Select Setup 1Kosmos App.
5. Download the 1Kosmos app for your device if you have not installed it. If you already have the app, click I already have the app.
6. Scan the QR code.
7. The login page notifies users that a new device has been added for passwordless login. Click Let's try a login.
8. Scan the QR code using the 1Kosmos app. You have successfully logged in.