1. Navigating to Settings > MFA Setup

The primary purpose of the SurgeONE.ai MFA module is to protect user accounts and sensitive data by adding extra layers of security beyond just a password.

Let us assume that you have logged-in to SurgeONE.ai. Click on the Settings menu option of the left-panel menu and then on the expanded menu option labeled as MFA Setup to navigate to the MFA Setup page.

Fig: 1 - MFA Setup menu option

Here is the default view of the MFA Setup screen.

Fig: 2 - MFA Setup screen

NOTE:

1. MFA will be disabled for all users by default.
2. In the MFA module, one gets the options to perform the following:
   1. Enforce MFA on account logins in SurgeONE.ai portal for self
   2. Disable MFA on account logins in SurgeONE.ai portal for self
3. By default, when you are visiting this screen for the first time, the slider and radio buttons are usually disabled. The users can enable or disable this MFA functionality at their own discretion.

2. Toggling the MFA Functionality Using the Email Verification Radio Button

To enhance the security of own SurgeONE.ai account, user can have Multi-Factor Authentication (MFA) enabled. By requiring both a password and an additional verification method — such as a code sent to the registered email address, the user can ensure that unauthorized access is significantly more difficult. This added layer of protection safeguards own sensitive information, prevents identity theft, and gives a peace of mind when accessing SurgeONE.ai across devices.

1. The MFA Setup page displays the MFA Status: Active/Inactive slider to toggle the MFA for own user account. Click on the slider to enable it. After the MFA Status: Active/Inactive slider is enabled, then the radio button labeled as Email Verification (below the Preferred Verification Method label) gets selected by default.

Fig: 3 - Own account MFA Active/Inactive slider view

2. Click on the Save Settings button.

Fig: 4 - Saving the MFA preference

3. A success toast notification gets triggered and can be seen at the top.

Fig: 5 - Success notification on MFA setup for own user account

4. Log out of the application and re-login to trigger the email comtaining the unique 6-digit code.

Fig: 6 - Logging out of the application

3. Toggling the MFA Functionality Using the Authenticator App Radio Button

To maintain the integrity of organizational systems and data, it is essential that all subordinates have Multi-Factor Authentication (MFA) activated on their SurgeONE.ai accounts. MFA strengthens account security by requiring a second form of verification in addition to their password. This measure helps reduce the risk of breaches, ensures compliance with data protection policies, and demonstrates a proactive commitment to safeguarding firm's information.

1. The MFA Setup page displays the MFA Status: Active/Inactive slider to toggle the MFA for own user account. Click on the slider to enable it. After the MFA Status: Active/Inactive slider is enabled, select the Authenticator App(AUTHENTI-KEY) radio button.

Fig: 7 - Selecting the QR code MFA option

2. Click on the Save Settings button.

Fig: 8 - Saving the MFA preference

3. A success toast notification gets triggered and can be seen at the top.

Fig: 9 - Success notification on MFA setup for own user account

4. Log out of the application and re-login to trigger the email comtaining the unique 6-digit code.

Fig: 10 - Logging out of the application

4. Logging into SurgeONE.ai with Email Verification Type MFA Enabled

Once the unique MFA code is successfully validated, user gets redirected to your SurgeONE.ai Dashboard, or any permitted landing page which is configured as per the user account permissions/priviliges. This extra verification step ensures that even if your password is compromised, only you can complete the login process.

1. Next time the user (whose Email Verification type MFA is enabled) tries to login to SurgeONe.ai with valid login credentials, he / she will be redirected to the MFA verification page and prompt to provide an authentication passcode (unique 6 digit code). Here is the view of the login page. The user needs to enter the username and password in the respective fields and click on the Login button.

Fig: 11 - Entering own credentials in the login page to proceed to the MFA code input page when MFA is enabled

2. By default, you get redirected to the MFA verification page.

Fig: 12 - MFA verification page view

As the MFA is enabled, an email gets triggered. Here is the view of one such email with a 6-digit secure, login authentication code.

Fig: 13 - Email triggered with unique code for login authentication

3. Enter the unique code in the Verification Code field of the MFA verification page. The Submit button gets activated after you enter the unique code. Click on it to login to SurgeONE.ai.

Fig: 14 - Submitting the received MFA code to login

NOTE:

1. For existing SurgeONe.ai users (who already have an account), if MFA is activated, they will be prompted for a 2-step authentication during login starting from the very next time they login to SurgeONe.ai.
2. You must enter a valid code in the Verification Code field of the MFA verification page before clicking on the SUBMIT button. Otherwise, the system will prompt the following validation text below the field.

Fig: 15 - Validation employed on the Verification Code field

5. Logging into SurgeONE.ai with Authenticator App Type MFA Enabled

Next time the user (whose Authenticator App type MFA is enabled) tries to login to SurgeONe.ai with valid login credentials, he / she will be redirected to the MFA verification page and prompt to provide an authentication passkey (unique 6 digit code). You need to scan the triggered email's QR code using any supported authenticator app to get this unique passkey.

1. Here is the view of the SurgeONE platform login page. The user needs to enter the username and password in the respective fields and click on the Login button.

Fig: 16 - Entering own credentials in the login page to proceed to the MFA code input page when MFA is enabled

2. By default, you get redirected to the MFA verification page.

Fig: 17 - MFA verification page view

3. As the MFA is enabled, an email gets triggered. A QR code is present in the email body so that you can scan it and activate your MFA via an Authenticator application.

Fig: 18 - View of the triggered email with QR code

4. Using your smartphone, open your authenticator application (such as Google Authenticator, Microsoft Authenticator, Authy, etc.) and scan the QR code attached to this email. After scanning the QR code, you can receive the unique MFA code in the authenticator app of your mobile / handheld device.
5. Enter the unique code in the Verification Code field of the MFA verification page. The Submit button gets activated after you enter the unique code. Click on it to login to SurgeONE.ai.

Fig: 19 - Submitting the scanned authentication passkey to login

NOTE:

1. The following tooltip gets prompted below the Verification Code field if the entered passkey (obtained in authenticator app by scanning QR) is not valid.

Fig: 20 - Entered Verification Passkey is invalid tooltip

2. The following error toast notification gets prompted in the MFA Verification screen during login, if the entered code token is expired. You need to click on the Back to login button to navigate back to the login screen, enter valid username and password, click on the Login button and again enter the received code (to your email address) in the Verification Code field.

Fig: 21 - Error notification prompted when the MFA login token is expired

3. In case the QR code containing email is not triggered to the user's mail inbox, click on the Regenerate QR button.

Fig: 22 - Option to agian trigger the email

4. Here is the view of the triggered email.

Fig: 23 - View of the content of the resent email

6. Disabling Enabled MFA

Disabling an enabled Multi‑Factor Authentication (MFA) feature removes the additional verification layer that protects user accounts from unauthorized access. This action reverts authentication back to password‑only verification, which significantly reduces account security and increases exposure to credential‑based attacks.

1. To disable MFA, click on the enabled MFA Status: Active/Inactive slider.
2. After you click on the slider to disable it, the following modal window loads.

Fig: 24 - Modal window to disable MFA

3. Click on the Yes button to proceed. The modal window closes and the slider is displayed as disabled.
4. Click on the Save Settings button and your change gets stored.

Fig: 25 - Saving disabled MFA preference