Protect sign-in and automation controls with MFA enablement for users with sensitive permissions
This improvement to multi-factor authentication (MFA) enforcement requires MFA for anyone who holds one of seven more sensitive permissions, plus one Enterprise Hub permission, so a stolen password alone can't open your sign-in, single sign-on (SSO), Command Center, or automation controls.
What's changing
Before this improvement, employees with permissions that control sessions, single sign-on (SSO), Command Center, and Automation Hub could sign in with only a username and password. If one of those passwords was stolen, someone could end other people's sessions, change SSO settings and lock your team out, or change automations that run across your business. Starting with this release, ServiceTitan adds seven permissions to the list that always requires multi-factor authentication (MFA): Allow Manage User Sessions, Manage SSO Configuration, Manage SSO Access, Access Command Center, Manage Command Center Recommendations, View Automations Page, and Manage Automations (Enable/Disable/Configure). In Enterprise Hub, Manage Single Sign-On (SSO) also requires MFA. Employees who hold one of these permissions and don't use MFA yet see a 15-minute reminder, are signed out, and set up a text message code or an authenticator app at their next sign-in. Employees who already use MFA keep working without interruption. While an employee keeps one of these permissions, administrators can't turn MFA off for them. Technicians are not affected.
Workflow comparison — before & after
Resources
How it works for your industry
Residential Service and Replacement
- An office manager holds Access Command Center to review daily recommendations. After the ST-82 release, they see a 15-minute reminder, sign back in, and set up multi-factor authentication (MFA) with a text message code.
- A general manager holds Manage Automations (Enable/Disable/Configure) to turn automations on and off. MFA now protects that access, so a stolen password can't be used to change how those automations run.
- Before the release, an administrator filters the Privileged column on the Security > MFA screen and removes View Automations Page from a dispatcher who doesn't need it.
Commercial Service and Replacement
- An IT lead holds Manage SSO Configuration to manage single sign-on (SSO) for a multi-branch company. Multi-factor authentication (MFA) now turns on for them and stays on while they keep the permission.
- A service manager holds Allow Manage User Sessions to sign out employees who leave the company. They already use an authenticator app, so they keep working with no interruption.
- An operations director holds Manage Command Center Recommendations. The administrator exports the MFA list before the release and confirms the director has a verified mobile number.
Residential Construction
- A project coordinator holds View Automations Page to check which automations are active. At their next sign-in after enforcement, they set up multi-factor authentication (MFA) with an authenticator app.
- An office administrator holds Manage SSO Access to control who can sign in with single sign-on (SSO). MFA now protects that control from a stolen password.
- An administrator selects Export List on the Security > MFA screen to share the list of affected employees with the office team before the release.
Commercial Construction
- A controller holds Manage Automations (Enable/Disable/Configure) to manage automations across divisions. Multi-factor authentication (MFA) is now required, and administrators can't turn it off while the controller keeps the permission.
- An Enterprise Hub administrator holds Manage Single Sign-On (SSO). MFA is now required for that permission in Enterprise Hub as well.
- A project executive with Access Command Center already uses a text message code for MFA, so enforcement doesn't sign them out.
Roofing and Exteriors
- An office manager at a roofing company holds Access Command Center. After the ST-82 release, they see a 15-minute reminder, then set up multi-factor authentication (MFA) at their next sign-in.
- A sales manager holds Manage Automations (Enable/Disable/Configure) for follow-up automations. MFA now protects those settings from a stolen password.
- An administrator removes Allow Manage User Sessions from a seasonal office hire who doesn't need it, so that employee isn't asked to set up MFA.
How to prepare
- Allow Manage User Sessions: existing permission. Controls user sessions, including ending other employees' sessions.
- Manage SSO Configuration: existing permission. Controls how employees sign in with SSO.
- Manage SSO Access: existing permission. Controls who can sign in with SSO.
- Access Command Center: existing permission. Gives access to Command Center.
- Manage Command Center Recommendations: existing permission. Controls Command Center recommendations.
- View Automations Page: existing permission. Gives access to view automations.
- Manage Automations (Enable/Disable/Configure): existing permission. Controls turning automations on, off, and setting them up.
- Manage Single Sign-On (SSO) (Enterprise Hub): controls SSO settings for your Enterprise Hub network.