MFA Enrolled Users Report

Enrolling for multi-factor authentication (MFA) in ManageEngine ADSelfService Plus lets users log in to their accounts and endpoints—Windows, macOS, or Linux machines, as well as RDPs, VPNs, etc.—securely, sign in to custom enterprise applications with SSO, as well as perform self-service password resets and account unlocks. As an admin, you should be taking appropriate measures to improve enrollment across your organization, which means it's important that you have a list of users who are enrolled for MFA and know which authenticators they have enrolled for.

The MFA Enrolled Users Report displays details of every enrollment action, including the username, time of enrollment, authenticator enrolled for, IP address, endpoint type, and who attempted enrollment (user or admin).

You can also disenroll users from MFA and generate backup codes for user accounts from this report.

Report filtering and generation :

Report customization

• Adding or removing columns: To add or remove columns, click on the Add/Remove Columns[] option at the far right of the report. In the Select the columns to be displayed pop-up that appears, select the required fields under Available Columns and click on the right arrow [>>] to move it to the Selected Columns. To remove columns, select the unused fields under Selected Columns and click on the left arrow [<<] to move it to Available Columns.
• Ordering the columns: The columns' positions can also be altered by selecting a value under Selected Columns and using the Up and Down options to change its position.

Sorting :

Click on any of the columns to view the report's entries in ascending order or descending order.

Searching :

• Click on on the search icon [ ] in order to search for specific data in the columns displayed.
• Particular user can be searched using SAMAccount Name,Display Name, E-mail Address, Mobile Number and OU Name.
• Searching will happen with criteria 'contains' . Ex. if user name is searched with word "jack" , then user name contains "jack" will be given as result.

Schedule Reports, Export As and More

• The Schedule Reports option can be used to schedule the generation of reports at specified intervals, and automatically email them to administrators or specific email addresses. Learn to schedule reports here.
• The Export As option at the right corner of the page helps export the report in CSV, PDF, XLS, XLSX, HTML and CSVDE formats.
• The More option at the right corner of the page lists the Printable View, Send Mail, and Export Settings options.
• The Printable View option can be used to preview and print the report.
• The Send Mail option can be used to mail the report to the desired email addresses.
• Additionally, you can configure custom Export Settings, such as a personalized title for the report and a header logo that you may wish to display on each page.

Disenrolling the user

Disenrollment of a user involves partially or completely removing their enrollment information from ADSelfService Plus.

Users will not be able to verify their identity via the authenticators they have been disenrolled from. If a user is completely disenrolled, they must re-enroll for at least the minimum number of authentication methods set by the admin to perform MFA and self-service actions.

Users can be disenrolled via two methods:

1. Manual disenrollment
2. Bulk CSV disenrollment

• Manual : Choosing user(s) whom you want to disenroll them by clicking available checkbox in the first column of each row and click Disenroll button next to search button. In the pop-up that opens, select the authenticators you want to disenroll the user(s) from and click OK. Click All Authenticators to disenroll the users from all authenticators.
  
  
  
  
• CSV : Click the Bulk Disenroll button in the right corner of the report header, nearer to navigation buttons. And upload CSV file which contains list SAM Account Name, Mobile Number or Mail ID, Secondary E-mail ID or Secondary Mobile number of the users to disenroll them. Once the CSV file is uploaded, you can select the authenticators you want to disenroll the user(s) from and click OK. Click All Authenticators to disenroll the users from all authenticators.

You can use the Free up the selected user(s)' licenses option while disenrolling users from any of the authenticators they are enrolled for. Choosing this option will remove the chosen users from all enrolled authenticators and free up their ADSelfService Plus licenses. As a consequence, these users will become unlicensed and lose any administrator or technician privileges they may have had.

If they are later assigned ADSelfService Plus licenses again, their previous privileges will not be automatically reinstated and will need to be reassigned manually.

Customizing the report:

You can customize the report to include or exclude additional columns with information from AD attributes by clicking on the Add/Remove Columns icon at the far left of the navigation buttons.

Users' enrolled authenticators

Clicking View List in the Enrolled Users Report will display the list of authenticators a user has enrolled for.

Generating backup codes

Admins can generate a backup code for an enrolled user when the user's MFA device is not reachable or is lost. The user can use each backup code only once. To generate a backup code for a specific enrolled user:

• Go to the MFA Backup Code column of the Enrolled Users Report. Click Generate Now



• The Generate MFA Backup Code section appears. Here the following details are displayed:
• SAM Account Name: The samAccountName value for the user.
• Domain Name: The domain to which the user belongs.
• Generated time: The date and time of the backup code generation.
• A table displays the newly generated one-time use backup code.
• Use the Expire (Mins) field to specify the number of minutes after which the code will expire in the.
• Click the copy icon next to the backup code to copy it. The code should be sent or conveyed to the user to let them verify their identity without MFA.
• Click Close.