[Access Control] Frequently Asked Questions about the Mandatory OTP Requirement for Administrators

As a general rule, an OTP must be entered each time you sign into HENNGE Access Control from a browser or app.

However, as long as your login session is maintained within the same browser, you will not be prompted to enter it again when accessing other services via SSO.
If you explicitly sign out or if your session expires, you will need to sign back into HENNGE, at which point you will be prompted to enter the OTP again.

No, nothing will change for administrator accounts that are already utilizing an OTP. No additional configuration is required.

Yes, it will change.

Currently, your experience may bypass the OTP under specific conditions (e.g., on a device with a device certificate installed). This will change to an experience where the OTP is strictly required under all conditions (e.g., even when logging in via a device certificate).

Yes, the initial administrator account can continue to be used as-is.
By setting up an OTP for your current account, you can continue using it smoothly after the transition.

For detailed configuration steps, please refer to the articles below.
[Access Control] Configuring OTP (One-Time Password) to be Received via Email
[Access Control] Configuring OTP (One-Time Password) to be Received via an Application

If using a smartphone application (such as HENNGE Lock) is not feasible, you can utilize the method of receiving one-time passwords via email instead.

This mandatory requirement applies exclusively to accounts that hold [Administrator Privileges] capable of accessing the HENNGE Access Control admin console.
Standard user accounts that do not have "Administrator" assigned to their role do not require any action.

*How to identify if your account is an admin account:
When you access the User Portal (ap.sssso.hdems.com/portal/your-domain), if you do not see the "Admin Console" icon, that specific account does not have an "Administrator" role.

This update applies strictly to "administrator accounts" only.
Therefore, no notices or manual distributions are required for standard users.

Please use an email address that can be accessed without requiring an OTP, or utilize a smartphone OTP application instead.

Since you will need the HENNGE OTP to sign into Microsoft 365, if the recipient email address is located within Microsoft 365, you risk falling into a loop where "you want to log in to check your email, but you cannot view the OTP email needed to log in."

By performing the OTP authentication once on the HENNGE side, it is possible to skip the MFA prompt on the Microsoft 365 side.
The configuration is very simple and can be completed in a short time. This will significantly reduce the hassle of logging in every time, so if you have not done so yet, please take this opportunity to configure it.

For more details, please refer to the release notes below.
[Access Control] April 2026 Week 3: Added a feature to skip Microsoft 365 Multi-Factor Authentication when specific authentication is performed in Access Control

You can search the OTP configuration status of administrators using the "Filter" option in the Users menu of the admin console.

This allows you to filter finely by admin roles or specific settings status.
You can search for "Administrators without OTP configured" by applying the following conditions:

• Role: Administrator
• Administrator Role: All
• OTP: "-"