Multi-factor authentication

If you use a password-based login, Elastic requires that you add an extra layer of security to your Elasticsearch Service account by enabling a multi-factor authentication (MFA) method.

You can choose from the following methods:

Set up an authenticator app such as Google Authenticator, Microsoft Authenticator, or Okta Verify. These apps generate a time-based one-time password (TOTP) that you enter along with your password when you log in.
Receive a verification code through email. You enter this code along with your password when you log in.

Elastic recommends that you enable multiple methods so that you can still access your account if you lose access to one method.

If you use only a Google or Microsoft account to log in, then you can’t configure MFA in Elasticsearch Service. You can check and manage your multi-factor authentication options in your Google or Microsoft account security settings.

You’ll be able to use other MFA methods, including security keys and biometric authenticators, in the future.

You can no longer configure SMS as a multi-factor authentication method. If you already use SMS for multi-factor authentication, then you can continue using it. You’ll be prompted to switch to a new MFA method in the future.

Configure an authenticator app

edit

To enable multi-factor authentication using an authenticator app, you must enroll your device.

Log in to the Elasticsearch Service Console.
Go to User settings and choose Profile. Navigate to the Multi-factor authentication section.
On the Authenticator app card, select Configure.
Scan the QR code with your authenticator app. If you can’t scan the QR code, then you can enter the code manually.
Enter the verification code generated by your authenticator app and select Enable authentication method.

Configure email authentication

edit

To enable multi-factor authentication using an authenticator app, you must verify your email address.

Log in to the Elasticsearch Service Console.
Go to User settings and choose Profile. Navigate to the Multi-factor authentication section.
On the Email card, select Configure.
Enter the verification code sent to your email address, and then select Enable authentication method.

Remove a multi-factor authentication method

edit

You can remove a multi-factor authentication method after it’s added by clicking Remove.

Before you remove an authentication method, you must set up an alternate method. If you can’t use any of your configured authentication methods — for example, if your device is lost or stolen — then contact support.

Frequently asked questions

edit

Below are some frequently asked questions about the multi-factor authentication improvements added in September 2024.

What changes are being introduced as part of the Elastic Cloud MFA initiative?

The following changes were introduced to Elastic Cloud MFA starting September 9th, 2024:

All users authenticating to any Elastic service through Elastic Cloud (cloud.elastic.co/login) with a username and password who have not yet set up an MFA method will be redirected to an MFA setup screen when they log in. Users will only be able to access their service after they successfully set up at least one MFA method, such as Authenticator or Email.
SMS MFA is gradually being phased out. This aligns with our internal information security policy and the industry best practice to move away from SMS as an additional authentication factor due to it not being phishing-resistant. All users with SMS MFA will eventually be redirected to the MFA setup screen to set up a different MFA method.

We will be adding the following features in the future:

Support for an additional phishing-resistant authentication method, in the form of biometric and security key authentication.
Support for customer email notifications for suspicious logins, such as logins from a new device or subsequent logins from geographically distant locations.

Users who authenticate to Elastic Cloud using Google or Microsoft identities, or SAML SSO, are not impacted by the MFA changes. In these cases, MFA is managed by the external identity provider.

What are the Elastic services that can be accessed through Elastic Cloud?

Elastic Cloud login (cloud.elastic.co/login) is used to authenticate the following services or portals provided by Elastic:

Elastic Cloud - cloud.elastic.co. In Elastic Cloud, MFA enforcement will apply to both Elastic Cloud trial and non-trial organizations.
Support Hub - support.elastic.co
Learning Portal - learn.elastic.co
Coming soon: Partner Portal - partners.elastic.co

Does MFA enforcement apply to all Elastic Cloud regions and organizations?

Yes, the Elastic Cloud default MFA enforcement applies to all Elastic Cloud regions, including GovCloud, and all organizations, both trial and non-trial.

Does MFA enforcement apply to direct login to Kibana or Elasticsearch?

No, the Elastic Cloud default MFA enforcement does not apply when selecting Log in with Elasticsearch on the Kibana login screen or connecting to an Elasticsearch endpoint. However, it does apply when using the Log in with Elastic Cloud option.

My team uses a generic account or distribution/mailing list and shares the password to access Elastic Cloud. How will my team be able to log in and access our Elastic Cloud organization after the MFA enforcement?

There are ways to work around the limitations of generic account access, but the more secure approach is to use one Elastic account for each Elastic Cloud user.

You can explore the following workarounds:

Grant your team members access to that account’s Elastic Cloud organization by inviting and making them organization members. This may involve creating additional Elastic user accounts for each team member, depending on their organization access and ownership needs since we have yet to support multi-organization membership. When each team member has their own account to access your Elastic Cloud organization, they will be able to set up their own MFA method.
Use the email MFA method, assuming all of your team members have access to the generic account or distribution list’s mailbox.
Keep using the generic account to log in and set up multi-factor authentication using an authenticator app.

During the setup, share the QR code, or its numeric version, across your team. This code is sensitive and should be stored and shared securely. For example, it should be stored in an encrypted place using a secure algorithm such as AES-256, and transmitted over a secure encrypted channel such as TLS 1.3.

This QR code is the "base" number used by the Authenticator app to generate codes based on the current time. There is no danger of synchronization issues. However, there is risk of a breach if the QR code is compromised.

After I set up an MFA method, will I need to answer an MFA challenge every time I authenticate through Elastic Cloud?

For now, you will need to answer an MFA challenge on every login, but we are working on adding a Trust this device option, which will "silence" the MFA challenge for one month per user session.

« Add a login method Monitor and analyze your account usage »