Special Article: Configuration and Migration Guide for Strengthening Security

At this time, we have no plans to implement measures that would prevent the use of Access Control because MFA has not been configured for a user account.

However, in response to the increasing sophistication of cyberattacks in recent years, we strongly recommend requiring MFA for all user accounts to ensure the secure use of the service.

As described in the following article, OTP will be mandatory for administrator accounts from December 1, 2026. Please take the necessary action.
[Access Control] Notification of Mandatory OTP (One-Time Password) for Administrator Accounts

We recommend strengthening authentication by combining OTPs or device certificates.

Although the security level is higher than authentication using only an ID/password, there is still a risk of spoofing. In addition, if an attacker infiltrates the internal network, relying solely on a global IP address will result in the attacker being treated no differently from a legitimate user. Even the latest international guidelines, such as NIST, do not define this as multi-factor authentication. Given the recent increase in cyberattacks and the advancement of attack techniques, it is becoming increasingly important to adopt multi-factor authentication methods that are difficult to spoof and resistant to phishing.

Adding an OTP (one-time password) to authentication using only an ID/password can improve the security level. However, phishing methods such as the increasingly common AiTM attacks (adversary-in-the-middle attacks) allow attackers to intervene in the authentication flow, and techniques that enable the theft of authentication cookies even when OTPs are used are on the rise.

To protect against such attacks, use authentication methods that use private keys stored on devices, such as phishing-resistant passkeys and device certificates.

If access restrictions using device certificates are applied, highly secure device authentication with phishing resistance is already being performed.

However, it is also possible to operate with stronger multi-factor authentication by combining “device certificates” and “OTPs,” such as to prevent impersonation when a device is stolen or lost. Please consider this based on the balance between your security policy and convenience.

From a defense-in-depth perspective, if an ID/password is leaked from a device after VPN connection or from within the internal network, there are concerns about the cloud-side security measures.
As a measure against ID/password leakage, we recommend using Access Control multi-factor authentication (OTP or device certificates) together.

If there is an email client already in operation that maintains authentication and can always be checked, an administrator can set any email address as the OTP delivery destination and enable OTP.

Using the following Procedure, enter an email address in the ［OTP Notification Email］ field for the Target user and update it to configure OTP via email.
[Access Control] How to Perform User Batch Update
After configuration, perform step 2 of the One-Time Password (OTP) for All Employees configuration to enable the OTP requirement.

* If a user cannot access the email used as the OTP delivery destination and is unable to log in to Access Control, please log in using an emergency OTP and configure OTP with another email address or an application.
[Access Control] OTP Issuance Methods and Expiration Period
[Access Control] Configuration for Receiving OTP (One-Time Password) via Connected Application
[Access Control] Configuration for Receiving OTP (One-Time Password) via Email

Authenticator applications provided by Microsoft and Google are also supported.
The HENNGE Lock application is required to use OTP authentication with push notifications.

We recommend operating by installing an application for OTP authentication, such as HENNGE Lock, on BYOD devices.
Install the HENNGE Lock application

You can create an access policy group for validation and verify operation by applying it only to users who will perform the validation.
[Access Control] Assigning Access Policy Groups to Users
Bulk User Registration/Update/Deletion (Modern View)

Technically, it is possible to distribute and install tenant certificates using a file server or online storage. However, the administrator must strictly manage the password required for installation. Please understand that if the password is shared with users, there is an increased risk that not only the user but also unintended third parties may install the certificate on inappropriate devices.

Based on the above, although an additional order will be required, we strongly recommend using device certificates in environments where MDM is not used.
[Access Control] Tenant Certificates Feature Overview

At this time, there are no plans to make multi-factor authentication mandatory for logging in to Email DLP.

However, to enhance security, we strongly recommend reviewing and strengthening whether MFA is configured at login for Google Workspace.

We recommend strengthening security even if you do not use Access Control. Because authentication using only an ID and password carries an extremely high risk of intrusion, please consider enabling multi-factor authentication in your groupware as follows.

* For detailed procedures, please contact your service provider.

・If you use Microsoft 365 (Microsoft Entra ID):
Enable “Security Defaults” or require MFA for all users through a “Conditional Access” policy
・If you use Google Workspace:
Apply “2-Step Verification (2SV)” company-wide from the Google Admin console

If there are services that you log in to through Access Control and SSO integration, we strongly recommend configuring MFA.

The required measures to skip multi-factor authentication in Salesforce are summarized below. In summary, the following two measures are required: ① perform authentication using a device certificate or OTP in addition to ID+PW; and ② add settings in “Service Provider Settings” on the Access Control administration screen according to the control conditions you use.

Recommended Checks

Please check whether the access policy group on the Access Control administration screen is configured to meet ① and ②.
[Access Control] Required Device Activation for Salesforce Single Sign-On

If multi-factor authentication is configured in Access Control, you can skip multi-factor authentication on the Microsoft 365 side by following the procedure below.
Release Information: [Access Control] Added a feature to skip Microsoft 365 multi-factor authentication when specific authentication is performed in Access Control in the 3rd week of February 2026

* Reconnecting federation integration may be required. For details, please refer to the article above.

If the login ID currently used to log in to Access Control is not in email address format, after migrating to the New Login Screen, the value to enter will change to the UPN (primary email address).
Many customers have proceeded with migration to the New Login Screen by notifying end users in advance.
[Access Control] Migration Procedure to the New Login Screen

Recommended Checks

Please check whether the Access Control username matches the value of the UPN attribute.

The New Login Screen uses the UPN attribute for login. If the username and UPN do not match, notify users that the login ID will change before switching over.
You can also try the New Login Screen with administrators only.
[Access Control] Try the "New Login Screen" for Admins Only

We currently do not have any materials available, but we intend to update this special site as needed depending on future customer feedback.

Please note that future feature additions will apply only to the New Login Screen, so we recommend migration from the perspective of improving security measures as well.
Release Information: [Access Control] Support for New Log in Screen in the 5th week of March 2026

The initial administrator account may also be used as the initial administrator account for other HENNGE One services, so we recommend retaining it and enhancing security with OTP or certificates.

For administrator accounts used regularly, we recommend granting administrator privileges to the accounts of personnel in the information systems department and configuring access control conditions that allow access by OTP only in emergencies, such as with a certificate or OTP.

There may have been an attempt to access Microsoft 365 using deleted user information.
However, because the relevant user does not exist in Access Control, authentication did not succeed, and sign-in (login) to your environment was properly denied (failed).
Therefore, please rest assured that no actual damage, such as unauthorized access, has occurred at this time.

Since it is currently being blocked appropriately, no urgent action is required. However, as a precaution, we recommend checking the “Source IP Address” listed in the log.

・If it is an internal network or a familiar provider: Identify the relevant device and delete the account / initialize the device
・If it is an unfamiliar external IP: Determine it to be an attempted attack and, as necessary, consider restricting or disabling WS-Trust (legacy authentication) communications in the access policy

We recommend self-management by users (an operation in which users set their own passwords).

Although administrators can set strong passwords, we do not recommend having administrators manage the authentication information of all users, considering the risk of theft during distribution.

Recommended Checks

It is possible to require users to change their passwords at first login and have them set passwords that comply with the password policy. Configure the settings to require a password change when creating users. Also, please check whether the password policy meets sufficient complexity and password length requirements.
Using self-service password reset is also effective. However, an email address that does not require authentication by Access Control to view email is required.
[Access Control] New User Creation / Edit
Password-related settings (Modern View)

By using an emergency OTP token, it is possible to log in using OTP after authenticating with an ID and password. In addition, if PC configuration is always performed within the internal network, you can use IP address controls to implement secure access control without using certificates.
[Access Control] OTP Issuance Methods and Expiration Period

Please consider implementing Password Manager, the organizational password management service we provide.
[Password Manager] Services Overview

A device certificate is a client certificate associated with the device on which it is installed, whereas a tenant certificate is a mechanism for sharing a single certificate across your Access Control tenant.
A comparison table is also available. Please refer to the following Help Center article.
In addition, if both certificates are installed, both certificates will be displayed when selecting a certificate during the login flow, and you will need to select one.
[Access Control] Tenant Certificates Feature Overview