Previous Topic Next Topic

Enrolled Users report

Enrolling for MFA in ManageEngine ADSelfService Plus lets users perform self-service password resets and account unlocks, log into endpoints (Windows, macOS, Linux, and VPN), and sign in to custom enterprise applications with SSO. As an admin, it's important for you to know the list of users who have enrolled for MFA and which authenticators they have enrolled for so that you can take appropriate measures to improve enrollment across your organization.

The Enrolled Users report provides you with the list of users who have enrolled themselves in ADSelfService Plus. The report displays the users' email addresses, users' mobile numbers, OUs, the time of enrollment, and the last time the users' enrollment data was modified.

Report filtering and generation

• Specify the domain using the Select Domain option.
• Specify OUs (if necessary) using the Select OUs option.
• Enrollment status: Use the Enroll Status drop-down to filter the entries based on whether the users are Enrolled or Partially Enrolled. Enrollment status is considered based on the fulfillment of the below conditions. If all of these conditions are satisfied, then the user's enrollment is treated as Enrolled. If not, the user is considered Partially Enrolled.
• Condition 1: The user has enrolled for all mandatory authenticators.
• Condition 2: The user has enrolled for the required number of authenticators set by administrators.
• Condition 3: If security questions is configured as the authenticator, the user has enrolled with all the mandatory questions and the correct number of questions.
• Enrollment type: Filter the results based on MFA methods using the Enrollment Type drop-down.
• Click Generate to generate the report.

Sorting

Click any of the columns to view the report's entries in ascending or descending order.

Searching

• Click the search icon [ ] to search for specific data in the columns displayed.
• Search for a particular user using the SAM Account Name, Display Name, E-mail Address, Mobile Number, or OU Name.
• The search results will include all the keywords related to your search. For example, if the Display Name field is searched with the keyword "jack," all the display names that contain "jack" will be displayed.

Export and More

• The Export As option in the right corner of the page helps export the report in various formats, like CSV, CSVDE, HTML, PDF, and XLS.
• The More option in the right corner of the page lists the Printable View, Send Mail, and Export Settings options.
• The Printable View option can be used to preview the report.
• The Send Mail option can be used to email the report to the desired email addresses.
• The Export Settings option allows users to customize the description and logo that will be used in the exported report. Also, admins can opt to keep the logo on every page of the exported report.

Disenrolling a user

Disenrollment of a user involves partially or completely removing their enrollment information from ADSelfService Plus.

Users will not be able to verify their identity via the authenticators they have been disenrolled from. If a user is completely disenrolled, they must reenroll for at least the minimum number of authentication methods set by the admin to perform MFA and self-service actions.

Users can be disenrolled via two methods:

1. Manual disenrollment
2. Bulk CSV disenrollment

• Manual: Choose the user(s) you want to disenroll by checking the box in the column to the left of the user, and then click Disenroll next to the search button. In the pop-up that opens, select the authenticators you want to disenroll the user(s) from and click OK. Click All Authenticators to disenroll the users from all authenticators.

• CSV: Click Bulk Disenroll on the right side of the report header near the navigation buttons. In the pop-up that opens, upload a CSV file containing the SAM Account Name, Mobile Number, Mail ID, Secondary E-mail ID, or Secondary Mobile number of the users to disenroll them. Once the CSV file is uploaded, you can select the authenticators you want to disenroll the user(s) from, and click OK. Click All Authenticators to disenroll the users from all authenticators.

You can use the Free up the selected user(s)' licenses option while disenrolling users from any of the authenticators they are enrolled for. Choosing this option will remove the chosen users from all enrolled authenticators and free up their ADSelfService Plus licenses. As a consequence, these users will become unlicensed and lose any administrator or technician privileges they may have had.

If they are later assigned ADSelfService Plus licenses again, their previous privileges will not be automatically reinstated and will need to be reassigned manually.

Customizing the report

You can customize the report to include or exclude columns containing additional information by clicking the add/remove columns [ ] icon at the far left of the navigation buttons.

Users' enrolled authenticators

Clicking View List in the Enrolled Users Report will display the list of authenticators a user has enrolled for.

Generating backup codes

Admins can generate a backup code for an enrolled user when the user's MFA device is not reachable. The user can use each backup code only once. To generate a backup code for a specific enrolled user:

• Go to the MFA Backup Code column of the Enrolled Users Report. Click Generate Now.

• In the Generate MFA Backup Code section that appears, you'll find the following details:
• SAM Account Name: The SAMAccountName value for the user.
• Domain Name: The domain the user belongs to.
• Generated time: The date and time that the backup code was generated.
• A table displays the newly generated single-use backup code.
• Use the Expire (Mins) field to specify the number of minutes after which the code will expire.
• Click the icon next to the backup code to copy it. The code should be sent or conveyed to the user to let them verify their identity without MFA.
• Click Close.

Previous Topic Next Topic