« Add a login method Monitor and analyze your account usage »
Elastic Docs ›Elasticsearch Service Documentation ›Your account and billing ›Edit user account settings

Multifactor authentication

edit

Multifactor authentication

edit

If you use a password-based login, Elastic requires that you add an extra layer of security to your Elasticsearch Service account by enabling a multifactor authentication (MFA) method.

You can choose from the following methods:

  • Set up an authenticator app such as Google Authenticator, Microsoft Authenticator, or Okta Verify. These apps generate a time-based one-time password (TOTP) that you enter along with your password when you log in.
  • Authenticate using a hardware security key or biometric data, such as a YubiKey or a fingerprint reader.
  • Receive a verification code through email. You enter this code along with your password when you log in.

Elastic recommends that you enable multiple methods so that you can still access your account if you lose access to one method.

If you use only a Google or Microsoft account to log in, then you can’t configure MFA in Elasticsearch Service. You can check and manage your multifactor authentication options in your Google or Microsoft account security settings.

You can no longer configure SMS as a multifactor authentication method. If you already use SMS for multifactor authentication, then you can continue using it. You’ll be prompted to switch to a new MFA method in the future.

Configure an authenticator app

edit

To enable multifactor authentication using an authenticator app, you must enroll your device.

  1. Log in to the Elasticsearch Service Console.
  2. Go to User settings and choose Profile. Navigate to the Multifactor authentication section.
  3. On the Authenticator app card, select Set up.
  4. Scan the QR code with your authenticator app. If you can’t scan the QR code, then you can enter the code manually.
  5. Enter the verification code generated by your authenticator app and select Enable authentication method.

Configure a security key or biometrics

edit

To enable multifactor authentication using a security key or biometrics, you must register your security key or biometric data.

  1. Log in to the Elasticsearch Service Console.
  2. Go to User settings and choose Profile. Navigate to the Multifactor authentication section.
  3. On the Security key or biometrics card, select Set up.
  4. Follow the prompts on your screen to register your hardware security key or your biometric authentication method.

Configure email authentication

edit

To enable multifactor authentication using an authenticator app, you must verify your email address.

  1. Log in to the Elasticsearch Service Console.
  2. Go to User settings and choose Profile. Navigate to the Multifactor authentication section.
  3. On the Email card, select Set up.
  4. Enter the verification code sent to your email address, and then select Enable authentication method.

Remove a multifactor authentication method

edit

You can remove a multifactor authentication method after it’s added by clicking Remove.

Before you remove an authentication method, you must set up an alternate method. If you can’t use any of your configured authentication methods — for example, if your device is lost or stolen — then contact support.

Frequently asked questions

edit

Below are some frequently asked questions about the multifactor authentication changes added in September 2024.

What changes are being introduced as part of the Elastic Cloud MFA initiative?

The following changes were introduced to Elastic Cloud MFA starting September 9th, 2024:

  • All users authenticating to any Elastic service through Elastic Cloud (cloud.elastic.co/login) with a username and password who have not yet set up an MFA method will be redirected to an MFA setup screen when they log in. Users will only be able to access their service after they successfully set up at least one MFA method, such as Authenticator or Email.
  • SMS MFA is gradually being phased out. This aligns with our internal information security policy and the industry best practice to move away from SMS as an additional authentication factor due to it not being phishing-resistant. All users with SMS MFA will eventually be redirected to the MFA setup screen to set up a different MFA method.

We will be adding the following features in the future:

  • Support for customer email notifications for suspicious logins, such as logins from a new device or subsequent logins from geographically distant locations.

Users who authenticate to Elastic Cloud using Google or Microsoft identities, or SAML SSO, are not impacted by the MFA changes. In these cases, MFA is managed by the external identity provider.

What are the Elastic services that can be accessed through Elastic Cloud?

Elastic Cloud login (cloud.elastic.co/login) is used to authenticate the following services or portals provided by Elastic:

Does MFA enforcement apply to all Elastic Cloud regions and organizations?

Yes, the Elastic Cloud default MFA enforcement applies to all Elastic Cloud regions, including GovCloud, and all organizations, both trial and non-trial.

Does MFA enforcement apply to direct login to Kibana or Elasticsearch?

No, the Elastic Cloud default MFA enforcement does not apply when selecting Log in with Elasticsearch on the Kibana login screen or connecting to an Elasticsearch endpoint. However, it does apply when using the Log in with Elastic Cloud option.

My team uses a generic account or distribution/mailing list and shares the password to access Elastic Cloud. How will my team be able to log in and access our Elastic Cloud organization after the MFA enforcement?

There are ways to work around the limitations of generic account access, but the more secure approach is to use one Elastic account for each Elastic Cloud user.

You can explore the following workarounds:

  • Grant your team members access to that account’s Elastic Cloud organization by inviting and making them organization members. This may involve creating additional Elastic user accounts for each team member, depending on their organization access and ownership needs since we have yet to support multi-organization membership. When each team member has their own account to access your Elastic Cloud organization, they will be able to set up their own MFA method.
  • Use the email MFA method, assuming all of your team members have access to the generic account or distribution list’s mailbox.

  • Keep using the generic account to log in and set up multifactor authentication using an authenticator app.

    During the setup, take a photo of the QR code, or note its numeric version, and share it across your team. This code is sensitive and should be stored and shared securely. For example, it should be stored in an encrypted place using a secure algorithm such as AES-256, and transmitted over a secure encrypted channel such as TLS 1.3.
    This QR code is the "base" number used by the Authenticator app to generate codes based on the current time. There is no danger of synchronization issues. However, there is risk of a breach if the QR code picture or number is compromised.

After I set up an MFA method, will I need to answer an MFA challenge every time I authenticate through Elastic Cloud?

For now, you will need to answer an MFA challenge on every login, but we are working on adding a Trust this device option, which will "silence" the MFA challenge for one month per user session.

« Add a login method Monitor and analyze your account usage »