Instructions to WES Users for Enrolling in Multi-Factor Authentication

Instructions to WES users for Enrolling in Multi-Factor Authentication

Guide for WES Program Users and Superusers

As of June 11, 2021

This document contains instructions for enrolling in Multi-Factor Authentication (MFA) for the Web Enrollment System (WES). MFA enrollment

is a one-step action required for all WES users. MFA will become effective for logging in to WES on July 1, however, existing WES users can

already complete their one-time enrollment. Starting July 1, WES users will not be able to log in to WES unless they have completed their MFA

enrollment. This document also contains instructions for modifying your MFA settings after enrolling.

Contents:

1. Login credentials

2. Technical support with MFA Enrollment

3. Authentication options

4. Enrolling in MFA: step-by-step instructions

5. Signing in to WES with MFA

6. Modifying your MFA settings

7. Video demonstrations

1. Login credentials

The instructions listed in this document only apply to users who have valid WES login credentials (username and password).

If you do not have a WES username, you must contact a WES superuser at your vendor organization and request that they create your WES

user account. If you need a new superuser at your site, please contact WESHelp@schools.nyc.gov.

If you do not know your WES password or if your WES password is no longer active, you must reset your password by emailing

missecurityadmi[email protected]c.gov with email subject “WES Password reset request”, including your WES username and a cell phone number in

the body of the email. You will receive a temporary password within 48 hours via email or text, which you can modify when completing your

MFA enrollment.

2. Technical Support with MFA enrollment

For technical support with MFA enrollment or login, please send an email to WES.MFASupport@strongschools.nyc with your WES username, a

description of the issue and a screenshot of the error message, if any (make sure to include your entire computer or phone screen in the

screenshot, including the web address bar). To take a screenshot on a PC, press on the PrtSc key (or Fn + PrtSc) to open the screenshot tool.

3. Authentication Method Options

You must choose between 2 authentication methods when enrolling in MFA:

- App authentication method: under this method, you will have to approve a push notification from the Microsoft Authenticator

application on a smartphone every time you attempt to sign in to WES, after entering your login credentials.

- Robocall authentication method: under this method, your will have to respond to a phone call and enter the “#” key every time you

attempt to sign in to WES, after entering your login credentials.

Note that you can modify your authentication method after enrolling (see instructions for modifying the authentication method in the last

section of this document).

4. Enrolling in MFA: step-by-step instructions

To enroll in MFA, you will need a computer connected to the Internet. If you choose the App authentication method, you will also need a

smartphone with the Microsoft Authenticator App (available for free on all smartphone apps stores). If you choose the Robocall authentication

method, you will also need a phone that you can answer every time you sign in to WES.

Step 1: Sign in to the MFA enrollment site

1. On your computer, close all your active web browsers and open a new browser.

2. In the new web browser, open an “incognito” or “private” window as follows:

a. If you use Google Chrome, you can either select the option “New incognito window” after clicking on the icon with the 3 vertical

dots in the upper right corner of the screen (below the “x”), or press the keys Ctrl + Shift + N

b. If you use Microsoft Edge, you can either select the option “New InPrivate window” after clicking on the icon with the 3

horizontal dots in the upper right corner of the screen (below the “x”), or press the keys Ctrl + Shift + N

c. If you use Mozilla Firefox, you can either select the option “New Private window” after clicking on the icon with the 3 horizontal

lines in the upper right corner of the screen, or press the keys Ctrl + Shift + P

d. If you use Safari, you can either select the option “New Private window” in the “File” menu or press the keys Shift + ⌘ + N

3. In the new private window, copy and paste the following web address, and press Enter:

https://aka.ms/mfasetup

4. The next screen should include a quadrant titled “Sign In”. In the “Email, phone, or Skype” field, enter your new username, which

consists of your WES username (not case sensitive) followed by “@hra.nyc.gov”, and select Next.

Example: if your WES username is “ACSTEST23”, you must enter “acstest23@hra.nyc.gov” (if you do not know your WES username,

please refer to the first page of this document, in section “1. Login credentials”)

Note: if you don’t see the “Sign In” quadrant when opening the link, but instead see a quadrant called “Pick an account” with a list of email

accounts, make sure to select the last option that reads “Use another account” . You will enter the new username in the screen that follows.

5. In the “Password” field, enter your WES password and select Sign In (if you do not know your password, please refer to the first page of

this document, in section “1. Login credentials”)

6. The next page should indicate that more information is required. Select “Next” and move to the instructions in Step 2 on the next page.

Step 2: Enroll in your primary authentication method

If you choose to enroll in MFA with the App method, please follow the instructions listed in the left column of the table below. If you choose the

Robocall method, please follow the instructions listed in the right column..

Option 1: App method

Option 2: Robocall method

1. On your smartphone, download the Microsoft Authenticator

application (available for free through any app store).

2. On your computer, select “Next”.

3. On your smartphone, open the

Microsoft Authenticator app.If you are

using an iPhone, select the “+” icon at

the top right corner of your screen. On

other devices, select the 3 vertical dots

at the top right corner of your screen and

select “Add account”.

1. Select “I want to set up a different method” at the

bottom of the central quadrant.

2. The pop-up window will ask you to pick an option. In

the drop down menu, choose “Phone” and select

“Confirm”.

Option 1: App method

Option 2: Robocall method

4. On your smartphone, select “Work or

school account”.

5. On your smartphone, in the pop-up

message, select “Scan QR code”. Your

phone should switch to camera mode.

Note: if your phone’s camera does not work,

select “Sign In” instead. When prompted to

enter an email, enter your WES username

followed by “@hra.nyc.gov” (for example:

“[email protected].gov”). When prompted

to enter a password, enter your WES

password.

6. On your computer, you should now see a QR code. Aim your

phone camera at the QR code on your computer screen (this

might happen very quickly, in some cases you might not notice

that it has been completed). The scan is completed when you can

3. In the next screen, enter a phone number. You must

be able to receive calls at the phone number you

indicate every time you want to log in to WES. Note

that you can change that phone number in the future if

needed. After entering a phone number, select “Next”.

4. You should receive a phone call at the number you

entered in the previous screen. Answer the call and

when prompted, press the “#” key on your phone.

Option 1: App method

Option 2: Robocall method

see your WES username followed by “@hra.nyc.gov” listed on the

app’s main screen on your phone (see image on the right below).

On your computer screen, select “Next”.

Note: if this step does not work, select “Can’t scan image” on your

computer screen and follow the instructions.

Computer screen Phone screen (after scan)

7. On your computer screen, a message should instruct you to

approve a notification on your phone. On your phone, in the pop-

up message, select “Approve” (depending on your phone, you

might also be asked to enter your PIN)

Computer screen Phone screen

Note: if your phone allows you to see the caller’s number,

the call you receive should come from (855) 330-8653,

“Restricted” or “Unknown” . If you do not receive the call,

please make sure that those numbers are not blocked on

your phone.

5. After pressing the “#” key on your phone, a message

should appear on your screen, reading “Call answered.

Your phone was registered successfully”. Select “Next”,

and follow the instructions in the next section (Step 3,

on the page after next)

Option 1: App method

Option 2: Robocall method

8. On your computer, a message should indicate that the notification

was approved. Select Next and move to the instructions in Step 3

(next page).

Step 3: Enroll in a backup authentication method

Both methods will require you to enroll in a backup method as an alternative.

If you opted for the App method in Step 2, you should select the Phone method as your backup method. The MFA enrollment website will

propose other backup methods (such as security questions, emails, etc.), however please note that none of the options other than the Phone

method and the App method will actually work for logging in to WES. In the column on the right side of the table below, we will describe the

steps for the “Phone method” as the back-up method.

If you opted for the Phone method in Step 2, unless you want to use the App method as your back-up method , none of the other backup

methods listed in the MFA enrollment website (security questions, email, etc.) will actually work for logging in to WES, however you must

select a backup method to complete your MFA enrollment. In the column on the left side of the table below, we will describe the process for the

“Email” method as the back-up method. If you want to use the App method instead, please follow the instructions in the right column of Step 2.

Option 1: if you chose the App method in Step 2

Option 2: if you chose the Robocall method in Step 2

1. In the next screen, enter a phone number. You must be able

to receive calls at that number every time you log in to WES.

Note that you can change that phone number in the future if

needed. After entering a phone number, select Next.

1. Select “I want to set up a different method” at the bottom

of the central quadrant.

Option 1: if you chose the App method in Step 2

Option 2: if you chose the Robocall method in Step 2

2. You should receive a phone call at the number you entered in

the previous screen. Answer the call and when prompted,

press the “#” key on your phone.

Note: if your phone allows you to see the caller’s number, the

call you receive should come from (855) 330-8653, “Restricted”

or “Unknown” . If you do not receive the call, please make sure

that those numbers are not blocked on your phone.

3. After pressing the “#” key on your phone, a message should

appear on your screen, reading “Call answered. Your phone

was registered successfully”. Select “Next”.

2. The pop-up window will ask you to pick a method. In the drop

down menu, choose “Email” and select “Confirm”.

3. In the next screen, enter your work email and select Next.

4. You should receive an email at the address you entered with

the subject “NYC DSS/HRA/DHS account email verification

code” with a temporary password. Enter the passcode in the

field provided and select Next.

Option 1: if you chose the App method in Step 2

Option 2: if you chose the Robocall method in Step 2

4. The next screen should indicate that you are successfully

enrolled in MFA, select “Done”

5. The last page will summarize the enrollment methods you

have chosen and your default method. Select the circle on the

top right corner of the screen and select Sign out.

5. The next screen should indicate that you are successfully

enrolled in MFA, select “Done”.

6. The last page will summarize the enrollment methods you

have chosen and your default method. Select the circle on the

Option 1: if you chose the App method in Step 2

Option 2: if you chose the Robocall method in Step 2

6. You have completed your MFA enrollment! You will be able

to log in to WES using MFA starting July 1, 2021. You can close

your web browser.

top right corner of the screen and select Sign out.

7. You have completed your MFA enrollment! You will be able

to log in to WES using MFA starting July 1, 2021. You can close

your web browser.

5. Log in to WES to using Multi-Factor Authentication (available after July 1, 2021 only)

If you have successfully completed your MFA enrollment in the last section,, you should be able to log in to WES after July 1, 2021 by following

these steps:

1. Open WES by click on the following link (or copy/paste the link in a web browser): https://a069-ra.nyc.gov/wes

2. If the home screen consists of a list of email accounts (titled “Pick an account”,) select the email account with your WES username

followed by “@hra.nyc.gov” (for example, “ac[email protected]v” if your WES username is ACSTEST23” ). If that account is not listed

on the home page, select “Use another account” and in the following screen, enter your WES username followed by “@hra.nyc.gov”.

Otherwise, if the home screen consists of a Sign in window, enter your WES username followed by “@hra.nyc.gov” (for example,

“[email protected]v” if your WES username is ACSTEST23

3. In the next screen, enter your WES password and select “Sign In”

4. If you enrolled in MFA using the App authentication method, you should receive a push notification on your phone. Select “Approve”

(you might also be asked to enter your phone PIN after approving). If you enrolled in MFA using the Robocall authentication method,

you should receive a phone call. Answer the call and press the “#” key. After completing the authentication step you should be signed

in to WES.

6. Modifying your MFA settings: step-by-step instructions

1. Open the MFA enrollment website by clicking on this link (or copy/paste the link your browser): https://aka.ms/mfasetup

2. Sign in using the same process described in the last section for signing in to WES.

3. In the menu on the left side of the window, make sure to select the “Security info” tab.

4. To modify your default authentication method, select “Change” and follow the instructions on the screen.

To add a new authentication method, select “Add method” and follow the instructions on the screen. Note that only the App method

and the Phone methods will work for the purpose of logging in to WES.

To delete an authentication method, select “Delete” on the row of the method you want to deactivate.

To re-do your MFA enrollment from the start, delete all methods and sign out from the authentication website. You can log back in to

that same site and re-enroll in MFA following the instructions in Section 4 of this document.

7. Video demonstrations

The instructions listed in this guide are also available in our video demonstrations accessible online at the following links:

● MFA for WES – Part 1 : Introduction to MFA

● MFA for WES – Part 2: Enrolling in MFA with the App method

● MFA for WES – Part 3: Enrolling in MFA with the Robocall method