Multi-factor authentication has arrived at Delta eSourcing

At Delta eSourcing we pride ourselves on ensuring our platform is simple, smart and secure and we are pleased to announce that we are taking security to the next level and introducing multi-factor authentication.

What does multi-factor authentication mean?

You may already be familiar with multi-factor authentication (MFA) as it is commonly practised by various online service portals such as online banking. It is essentially a process that requires the user to enter more than one piece of information to access their account. For example, in addition to entering a password you may also be asked to enter a code that has been sent to your mobile device or email account.

In the case of Delta, our MFA process will involve users logging in with their current username and password before carrying out the second authentication step using either Google or Microsoft's multi-factor authentication app. Please be advised that it will be your organisation's responsibility to ensure that your teams have downloaded and set up the Google or Microsoft authenticator application on either their work or personal mobile devices. Rest assured that this is very easy to do and both Google and Microsoft provide helpful setup and user guides.

Why is Delta implementing MFA?

In the first instance, implementing MFA is good practice and, as mentioned, very commonplace, but the main reason for adding MFA to the Delta platform is security and to ensure that Delta continues to comply with current guidance from the National Cyber Security Centre. For more information and advice from the NCSC on implementing MFA, please visit https://www.ncsc.gov.uk/guidance/multi-factor-authentication-online-services.

Setting up multi-factor authentication

Below is a step-by-step guide on what to expect when you log in to Delta and are setting up MFA for the first time.

Important: You will need to download either the Google or Microsoft authenticator app on your mobile device prior to beginning these steps.

Step 1:

When you first visit the Delta login, the first screen will look exactly the same. Simply enter your usual username and password.

Step 2:

Next you will need to set up the authenticator app. Please note that you will need to download either the Google or Microsoft authenticator app on to your device in advance. Scan the QR code on the screen using the authenticator app and you will be shown a token code for the next step. Important: Please note down the backup codes shown on the screen and store in a safe place.

Step 3:

Enter the token code from your authenticator app and then click 'Register'.

Step 4:

Next you will be shown a one-time passcode on your authenticator app. Please enter that into the box shown on screen and click 'Login'.

Step 5:

In order to reduce the frequency of login verification, you can opt to trust the browser that you are logging in from. If you choose to set this up, simply name the device and choose how long you would like to remember the browser. The options are 30, 60 or 90 days. Then click 'Register'. You can also choose to skip this step and set this up at a later date.

Step 6:

You will now be logged in to the Delta platform and can continue to use it as needed. The next time you log in to Delta you will use your username and password as before but will then be asked to enter a one-time passcode from the authenticator app. This is MFA. Simply open your authenticator app and enter the passcode shown. Please note that the passcode refreshes every 30 seconds.

Shared accounts

We are aware that many Delta users have shared accounts – for example, multiple users using the same username and password to access the Delta platform.

For Delta buyers, there are two options:

Option 1:

One member of your team sets up the authenticator originally and then provides the token to each user who can then log in with the shared login. Each user then selects to trust their device for 90 days, which allows them to log in without the token for 90 days. However, they will need to get a new token every 90 days.

Option 2:

Each team member is invited to the organisation using their own email address and then has their own login username and password. This allows them to set up their individual authenticator rather than sharing. Each user would then need to ask the asset owner for all the tenders they work on so that they can add them to their email alert preferences in order to continue to get system emails for those tenders. There is no limit to how many Delta user accounts you can have within your organisation.

We would recommend option 2 as this means that each individual Delta user within your team has their own login and is responsible for their own authenticator app access codes. You can implement option 2 easily by inviting individual users to your organisation via Account Settings.

To do this, simply log in to the shared Delta account and follow the steps below:

Go to Account Settings and then:

1. Organisation Settings
2. User Management
3. Invite new users
4. Add email
5. Enter the team members email address
6. Enter their role
7. Select which Organisation Group the invited user to be assigned to
8. Click 'Add email'. You can continue to 'Add email' for all individuals you would like to be invited.
9. Once all emails have been added, click 'Next'.
10. Click invite

Invited users will receive an email from Delta informing them that they have been invited to Delta eSourcing on behalf of the organisation and will receive instructions on how to complete their registration.

Please note, each new user would need to edit their email preferences so that any Delta communications and alerts go to the shared inbox instead of the individual's email inbox, if this is the preferred option.

Only option 1 of the two outlined above is available for suppliers. One person would set up the authenticator originally and then provide the token to each user who would log in with the shared login. Each user then selects to trust their device for 90 days, which allows them to log in without a token for 90 days. However, they will need to get a new token every 90 days.

For any help or advice regarding shared accounts, please contact our Helpdesk team at helpdesk@delta-esourcing.com

Removing Authenticator or Trusted Devices

In the event that you change your device, you can remove the setup authenticator and re-register a new device. This can be done via your Account Settings. Once logged in, go to Account Settings by clicking on the user icon in the top right of the screen and follow the steps below:

1. Account Settings
2. Click Multifactor Authentication
3. You will see the option to Delete Authenticator Registration, which will remove authentication from the account and requires you to set it up upon the next login.
4. You will see the option to remove Trusted Devices by clicking Delete. If you remove a Trusted Device, you will be required to enter a token upon the next login, which will allow you to trust your device again for up to 90 days.

FAQs and troubleshooting

If you are experiencing issues with setting up multi-factor authentication, please find some common questions and advice below that may help.

It is important to remind our users that we have implemented MFA to ensure that the Delta platform and our users continue to be compliant in line with current guidance from the National Cyber Security Centre.

Where will I find the authenticator app?

You will need to have downloaded either the Google or Microsoft app before beginning to set up MFA. You can download either of these apps from most commonly used app stores such as Apple and Google Play. We would recommend speaking to your IT departments prior to downloading any apps on to your work devices.

I don't have a work mobile device to use

We understand that many users will not have access to work mobile device and/or can't use their personal device for various reasons. There are ways to implement MFA using internet browsers but we would strongly recommend that you speak to your organisation's IT department for their recommendations.

We have multiple Delta users within our team using a shared account

Please refer to the 'Shared accounts' section within this user guide for your options.

I have registered my authenticator app but I'm having issues with the access codes

If you experience any issues after you have set up the authenticator app on your device, such as problems with your access codes, please do not delete any details from the authenticator app. Deleting the Delta account details from the authenticator app will not allow you to rescan the QR code and restart the setup process. We would recommend that any issues you have regarding your chosen authenticator app are directed either to the app provider or your IT department initially. If they cannot help resolve the issues, contact the Delta Helpdesk at helpdesk@delta-esourcing.com.

I've left my device at home

In the event that you can't get access to your device after setting up MFA, you can use one of the back-up codes provided during the set-up process. It's important to take a note of these so they can be used in this scenario.

I'm having problems with the authenticator app

Unfortunately our Helpdesk will not be able to assist with issues relating to the authenticator app itself. We would recommend that you speak to your IT department or the app provider directly. Our Helpdesk as always will be on hand to help with any Delta-related issues.