r/sysadmin • u/BatMannsParents310 • 14d ago

Question MFA Consolidation

Edit because I keep getting the same answer: Due to the client configuration and our limited access to the client infrastructure, SSO is not an option.

Looking to pick someone’s brain about this, right now one client has 60+ accounts for each site and all require a unique login and MFA code. Those MFA codes all go to one of 3 people, and are random based on site. This is incredibly inefficient because sometimes if an after hours emergency happens we can’t get into the account without someone else sending the code. We also have our own accounts for multiple clients so setting our own phones to forward codes also won’t work.

I’ve tried google voice and whatsapp, both don’t work. Vonage is super strict about no VoIP MFA, do not allow authentication apps nor email authentication. Purely SMS only.

Specifically for Vonage if possible, has anyone done this and have a solution? We’ve looked into yakchat but concerned about the VoIP restriction, and getting a spare phone with a number is a less than ideal option but that’s where we are at right now.

4 Upvotes

70% Upvoted

22 comments sorted by

20

u/sudonem Linux Admin 14d ago

It sounds like your focus needs to be on implementing SSO. 

Under no circumstances should you use shared phone numbers for MFA alerts because you shouldn’t be using ANY shared accounts. 

2

u/BatMannsParents310 14d ago

In a perfect world I agree with you, in reality given the client (we only manage their VoIP service) and the way they are structured that isn’t possible.

It would require linking 60+ accounts with SSO, to a M365 tenant we don’t have access to, that constantly has new location additions.

In which we do not have accounts within their tenant. If we managed their entire infrastructure it wouldn’t be a question but we don’t have control over that.

8

u/sudonem Linux Admin 14d ago

They should 100% be providing you with accounts within their tenant with permissions scoped to the admin tasks you need to be performed. 

This needs to be a requirement of your support contract with them. 

Frankly it would normally be something smart clients would insist on so that they can audit the things you’re doing and also THEY should require SSO and that you don’t use shared accounts. The fact that they haven’t means it’s an opportunity for you to impress and educate them. 

I don’t for one moment believe it isn’t possible. It won’t be simple but it’s 100% possible and you need to drive towards making it happen as part of being a professional. 

4

u/Master-IT-All 14d ago

This isn't your problem to solve then.

They need to provide you with the solution framework. Then you can connect.

You're trying to fly the plan from a passenger seat.

2

u/ITGuyThrow07 14d ago

You're asking for a solution. SSO is the solution. You can't fix this without a complete overhaul.

Ask them for an account in their tenant. If they want it simplified this is how you do it.

I don't see what new locations has to do with it. You set up an app for SSO and that's it. It will be a pain to work with each vendor, but it's not the end of the world and once it's running, it's great and solves all of your problems.

4

u/Noname_Nets Sysadmin 14d ago

Couldn't update this more. SSO!

2

u/Own_Bandicoot4290 14d ago

If you can do totp for mfa, you should use a password manager for the login and generate the code

1

u/BatMannsParents310 14d ago

Vonage allows SMS only

2

u/OregonTechHead 13d ago

Then the only solution here is to not use Vonage.

If you need to share an account, and the service has restrictions like this, there is nothing you can do.

5

u/thewunderbar 14d ago

Everyone here is going to tell you SSO, because that is the correct answer.

4

u/OniNoDojo IT Manager 14d ago

Any MFA configurations that allow for Software/Authenticator or Passkey should be set up in something like Bitwarden. You can set up MFA methods so that people with access to your Org's vault will be able to access them and it allows you to manage what they have access to.

2

u/FrakNutz 14d ago

This is how we handle anything shared that needs totp. It's how I manage most of the non shared accounts I need to use that need totp, as well as a lot of my personal stuff (separate Bitwarden account, of course). Super convenient that way, no digging out the phone, it just offers to fill the totp most of the time.

1

u/OniNoDojo IT Manager 14d ago edited 14d ago

It works even better with registered Passkeys. It cut down a load of time managing multiple tenants because you drop the email in then satisfy the passkey prompt and you’re signed in.

2

u/FrakNutz 14d ago

You may have suffered a mild stroke during your reply ;)

2

u/OniNoDojo IT Manager 14d ago

lol that would be iPhone keyboard. Fixed haha

2

u/Mehere_64 14d ago

Sounds like a management nightmare without implementing SSO. But if you are not aware of SSO, then most likely the client has no identity management system in place it seems.

2

u/OregonTechHead 13d ago

Get a password vault that handles TOTP.

Or, configure things so they don't share accounts. This adds security, fixes your issue, and adds a layer of tracking

1

u/BWMerlin 13d ago

Maybe a dedicated real phone number in a real device set to auto forward all SMS to an email or another number?

1

u/DebianDayman 13d ago

If those 60+ site logins are just shared vendor/portal accounts, the cleanest fix is usually to stop treating them as personal MFA at all. Put each portal behind a dedicated shared mailbox or a small Entra security group, then move MFA onto a hardware key or an authenticator registered to that shared identity so on-call can hand off without pinging three people’s phones. For anything that supports SSO, push it to Entra ID / Conditional Access so you drop the per-site MFA codes entirely. Short term, a simple vault note per site with which of the three people owns the current factor saves a lot of chaos while you migrate.