Set Up the AuthNull Authenticator
The AuthNull Authenticator is a mobile app that receives push MFA requests and lets the user approve or deny them. It is used when AuthNull Authenticator is the active provider under Settings → MFA Provider.
If your organisation uses Duo Security or Okta Verify as its MFA provider, users approve push requests in that app instead and do not need to register a device in AuthNull. In that case the user's panel shows MFA managed by the provider.
Step 1 - Install the app
Install AuthNull Authenticator from Google Play or the App Store on the user's phone.
Step 2 - Send the user an invite (administrator)
Each device is registered with a one-time invite issued by an administrator. Only administrators and super administrators see Register device.
- Open Users.
- On the user's row, open the ⋯ menu and select Register device.
- Choose how to deliver the invite:
- Send by email - click Send invite. The invite is emailed to the address on the user record. This option is disabled if the record has no email address.
- Show invite - shows an Invite link and a QR code. Use Copy or Download QR and send it to the user over any channel you trust.
Anyone who opens the invite can register a device as that user. Each invite works once and expires after 7 days. Issuing a new invite replaces the previous one, so switching between Send by email and Show invite invalidates the invite you issued first.
If no console URL is configured for the deployment, Show invite displays only the QR code and the message No invite link is available. Have the user scan the QR code instead.
Step 3 - Register the device (user)
The user opens the invite:
- On the phone - open the invite link and tap Open in AuthNull Authenticator on the Register your device page. If the app is not installed, the page shows store links.
- On a computer - open the invite link; the page shows a QR code. Scan it with the AuthNull Authenticator on the phone. A QR code shown by the administrator can be scanned the same way.
If the invite cannot be used, the page explains why:
| Message | What to do |
|---|---|
| This invite has expired | Ask the administrator for a new invite. |
| This invite has already been used | A device is already registered with it. If that device was not yours, tell your administrator. |
| This invite isn't recognised | It was probably replaced by a newer invite. Use the latest one. |
| This link is incomplete / This link could not be read | The link was cut short or altered. Open it again from the original message. |
Check enrolment status
On the Users page, the Authenticator panel for a user shows one of:
| Status | Meaning |
|---|---|
| Enrolled | A device is registered and will receive push requests. |
| Invite pending | An invite has been issued but not yet used. Use Re-issue invite to send a new one. |
| Not enrolled | No device is registered. Use Register device. |
Next step
Once enrolled, the user approves sign-ins from the app. See Authenticating with Push MFA.