Ability to un-enroll from MFA

[Donna_Munsen]

I couldn't even reply to this without jumping through your 'hoop'. I don't care your reasoning. I think we should have the option of opting out. I now have to figure out how this will work with our elderly people who don't have cell phones. Ridiculous! Did your insurance company demand you do this?

[Donna_Munsen]

Hello,

As part of our new and updated feedback statuses, we wanted to update this idea to Acknowledged. There is a lot of feedback within this one thread in particular, some of which was implemented, a few things planned to be improved, and a few that most likely won’t be planned for in the near future.

First, some additional background information and more information as to the “why” of this change. From some of the comments, it feels like that question hasn’t been answered sufficiently. What’s so important and secure about email newsletters anyway? This had to do with a rise in attempted account takeovers the last several years. That is, a bad actor has somehow gained access to some account credentials and attempts to get into your account to send a spam or phishing email to your customers - potentially looking like it is from you. To be clear, this wasn’t due to any sort of Constant Contact breach, but potentially re-using credentials for your account that were no longer secure. Spam is a lucrative industry, and your Constant Contact account can be a valuable target because given our sending reputation, bad actors gaining access to Constant Contact have a better chance of hitting the inbox and getting their malicious messages read. Especially if it comes targeted to your list, looking like it is from your organization. So adding additional security measures protects your business, your subscribers, and it protects our service to ensure only legitimate permission based mail is being sent out. In this sense, the addition of MFA has been a big success to stop these kinds of attempts.

Now to address some of the feedback. Admittedly, this was quite a big change in a small amount of time. Some organizations shared one set of account credentials for all users of the account, so the need to change behavior to add additional individual users was new and taxing. It's worth noting that if you add more users to your account they can have their own MFA device for authentication. The MFA process also needs some time to learn your device and what a “normal” login looks like for your organization. So, when it’s initially turned on you do get prompted more than you would under normal circumstances. If you still find yourself getting prompted for your MFA method on every login and you normally log in on the same device/network every time, that is not working as intended. Make sure you are not using an Incognito window every time, or please contact our support team to work out what the problem may be.

We have made changes to our MFA roll-out plan due in part to the feedback we received. We are working on the ability for self-recovery of MFA tokens, so if you lose your old device or need to update your MFA device you can do so without contacting our support team. All feedback received is actively reviewed and considered. We will continue to assess this feedback and make changes accordingly, which we will communicate to this thread.

[JohnC9188]

How do I turn this off? I sign in and go to edit it and all I get is the red circle with the line through it. I am on the road and need someone to send out information and the authentication is sent to me which does no good.

[T.RonD]

We would also like to disable MFA

[Frankie_P]

Hi @JohnC9188 we're sorry to hear this is the experience you've had and have merged your post into a larger thread focused on the ability to turn off multi-authentication in an account.

[Glenmary]

Just wanted to add to this thread that as an organization with 4+ users, and we do NOT have company cell phones or work in the same office, this is VERY impractical. I appreciate the focus on security, but really need an email option or an opt-out option for this to be a realistic part of our every day workflow. 

[CameraMall]

I agree with all of the above. Extremely inconvenient and difficult when you have multiple staff members working on eBlasts.

[APAAC]

I'm going to have to agree with everyone else. This verification is absurd. Every time I log in from a different IP address, I have to ask my office to pick up the phone and send me the code. This is ridiculous. I'm constantly inconvenienced by this because I travel a lot for work. Just let us turn off this inconvenience of a "feature" or send the code to my email.
I should not have to give you my phone number after 3 years of service. 

This is ridiculous.

[Caredwen]

MFA does not work for us as it is currently set up, either. Please either offer the ability to unenroll, or allow users to add an email address as a verification method so that multiple users can access the account.

[BruceC76]

I agree with this thread - MFA is a pain and doesn't add any value for me.  It should be optional and it should be allowed to disable when wanted.  We, the customer are paying for this - our wishes should be respected.

[USAMedicalAlumni]

I need help adjusting the MFA. Every single time I log on from another computer in my office, it requires the MFA... The issue is my cell service isn't great in my office so by the time the code comes through its already expired. I would just like to turn the MFA off completely.

[Frankie_P]

Hi @USAMedicalAlumni because the multi-factor authentication is a setting is meant to help curb unapproved account logins, it is required when logging into an account from different computers or devices. Because of this at this time there is no way to turn off this security feature. It is however a feature request we are collecting feedback. We have merged your post into a larger thread on this in the meantime.