Skip to main content
日本語 简体中文 繁體中文

[Access Control] Frequently Asked Questions about Mandatory Admin OTP Entry

Question

I have some questions regarding making OTP entry mandatory for admins.

Answer

Below are frequently asked questions and answers regarding making OTP entry mandatory for admins.

 

Is it necessary for admins to enter OTP every time they sign in?+

In principle, you are required to enter OTP each time you sign in to HENNGE Access Control from a browser or app.

However, as long as you remain logged in on the same browser, you will not be prompted to enter OTP again when using SSO to access other services. If you explicitly sign out or your session expires, you will need to sign in to HENNGE again, and OTP entry will be required at that time.

I am already using OTP with my admin account. Will anything change with this update?+

If you are already using OTP with your admin account, nothing will change. No additional configuration is required.

I use OTP for my admin account only under specific conditions, such as "require OTP if there is no device certificate." Will anything change with this update?+

Yes, it will change.

Currently, you may have an experience where "OTP is not required under certain conditions (e.g., when a device certificate is installed on the device)." With this update, OTP will be required under all conditions (e.g., even if you log in with a device certificate).

I am using the initial admin account with password authentication. Can I continue to use it by simply adding OTP?+

Yes, you can continue to use the initial admin account as is.
By configuring OTP for your current account, you will be able to continue using it after the transition.

For detailed setup instructions, please refer to the following articles.
[Access Control] How to receive OTP (One-Time Password) via application
[Access Control] How to receive OTP (One-Time Password) via email
 

We outsource admin tasks, and setting up a smartphone is difficult. What should we do?+

If you cannot use a smartphone app (such as HENNGE Lock), you can receive one-time passwords via email.
[Access Control] How to receive OTP (One-Time Password) via email

I use both an admin account and my personal account. Will my personal account also be subject to mandatory OTP?+

This mandatory requirement applies only to accounts with admin privileges that can access the HENNGE Access Control Administration.
Accounts with only user privileges (i.e., those without "admin" in the role name) do not need to take any action.

How to check if your account is an admin account:
If you do not see the "Administration" icon when accessing the user portal screen (ap.sssso.hdems.com/portal/your-domain), your account does not have the "admin" role.

With mandatory OTP entry for admins, is there any impact on normal users or need to distribute manuals?+

This change only affects "admin accounts."
Therefore, there is no need to notify or distribute manuals to normal users.

We use HENNGE for Microsoft 365 federation. Is it okay to set a Microsoft 365 email address as the OTP recipient address?+

Please use an email address that you can access without OTP, or use a smartphone OTP app.

Since you will need HENNGE OTP to sign in to Microsoft 365, if your OTP recipient address is within Microsoft 365, you may encounter a situation where you "want to log in to check your email, but cannot view the OTP email needed to log in."

I have to enter OTP when logging in to HENNGE, and Microsoft also requires MFA, which is honestly a hassle. Is there any way to make this easier?+

If you complete OTP authentication on the HENNGE side, you can skip MFA on the Microsoft 365 side.
The setup is very simple and can be completed quickly. This will greatly reduce the hassle of logging in each time, so if you have not yet set this up, please take this opportunity to do so.

For more details, please refer to the following release information.
Release Information: [Access Control] 3rd week of April 2026 - Added feature to skip Microsoft 365 multi-factor authentication when specific authentication is performed in Access Control

We have multiple admin accounts. Is there a way to check the OTP setup status for all accounts at a glance?+

You can check the OTP setup status for admins from the "Users" list menu in the Administration by using the "Filter" option.

You can filter by admin role and setup status in detail.
To search for "admins without OTP configured," use the following filter conditions:

  • Role: admin
  • Admin Role: All
  • OTP: "-"

Even though OTP is already configured, I am prompted to set up OTP again. Why is this happening?+

It is possible that the current configuration type cannot be correctly detected by the system.
We apologize for the inconvenience, but please reconfigure your OTP notification settings.