Multifactor Authentication

The following links are to resources for providers and Waiver Support Coordinators that serve Agency for Persons with Disabilities (APD) clients and use APD system applications. 

Documents

• Access to Internet-Facing APD Systems - Getting Started with Multi Factor Authentication
  
• Multifactor Authentication and APD iConnect Access Presentation
• Provider Access to APD iConnect Flow Chart

Staff Account Management (for owners/operators)

• Step-by-Step - ID PASS
• Staff Separation: Deactivating an APD iConnect Worker Record

Self Service Account Management (for all users)

• Self-Service Password Resets in CyberArk (Added 4/12/2024)
• Self-Service Phone Number Updates in CyberArk  (Added 4/12/2024)

Videos

• Multifactor Authentication and ID PASS Introduction

Important Account Security Information

APD’s Identity Proofing Administrative Security System (or “ID PASS”) is the Agency’s system for requesting user login accounts for access to APD systems.

The ID PASS system allows Waiver Support Coordinator Qualified Organization (QO) Owners or Service Provider Business Owners to submit electronic applications for user login accounts for employees of the business.

APD region Provider Enrollment staff will create user login account requests for QO Owners and Business Owners (and Sole Proprietors). Thereafter, Business Owners may request login accounts appropriate for their employees via the ID PASS system. Business Owners may also use ID PASS to delegate “Business Agents,” who may request user login accounts appropriate for business employees. This will facilitate the needs of larger organizations where the work of requesting business employee login accounts can be distributed among trusted members of the business. For example, HR staff might make good Business Agents to act in the Business Owner’s stead.
Business Owners and their Agents will be able to manage their employees’ login accounts as follows:

1. Submit an application for a new employee’s login account
2. Specify/modify the system roles that are appropriate for the employee’s access
3. Terminate an employee’s login account

All APD system users (including WSCs, Business Owners, and Sole Proprietors) will undergo an Identity Proofing session through the ID PASS system as a part of the user login account creation process. The Identity Proofing session in the ID PASS system consists of a series of questions and multiple-choice answers that facilitate identity verification of the individual for whom the user login account is requested. In the rare case when an individual is unable to pass the Identity Proofing session, there will be an alternative manual process where the individual may prove their identity using a government-issued photo ID and verification of residential address.

Upon successful enrollment through the ID PASS system, a new user login account will be created. This new user login account will be used for all APD system access. Older systems will be migrated to the new user login account, one by one. The new user login account will utilize “Multi Factor Authentication” (“MFA” for short). This means each login to a system will require 2 authentication factors. For example, both a password and an authentication code delivered to the user’s phone would constitute 2 authentication factors. The enrollment process through the ID PASS system will allow the user to specify which phone number(s) the individual would like to use for receiving authentication text messages or voice calls.  In addition, there are other alternatives to receiving an authentication text message or voice phone call. For example, using a smartphone (iPhone/Android), a user may install a Mobile Authenticator app, which will also handle the extra authentication in place of text message or voice call.  Facilitated by Multi Factor Authentication, self-service for forgotten passwords, locked login accounts, and password changes will be easier and more secure.