eBrigade two-factor authentication (2FA/MFA) module
Secure every login with a context-aware second factor
A stolen or shared password is enough to compromise access to all your operational data. eBrigade adds a one-time code, read from an authenticator app such as Google Authenticator or sent by email, SMS or mobile notification, triggered by the login context (new IP address, foreign country or regular interval) to block suspicious access without weighing down day-to-day use.
These buttons are about this optional module: add-on pricing and a 1-month trial of the module.
Two-factor authentication: one-time code read in an authenticator app (Google Authenticator…) or sent by email, SMS or mobile notification, triggered by context (new IP, foreign country, login interval).
What is eBrigade’s two-factor authentication module?
eBrigade’s two-factor authentication (2FA/MFA) module adds a one-time code after the password. The code comes from an authenticator app (Google Authenticator, Microsoft Authenticator…) or is sent by email, SMS or mobile notification. Verification is triggered according to your rules: new IP address, login from abroad or a set number of logins.
Why switch on two-factor authentication?
A compromised password is enough to open up all of your organisation’s data — member records, schedules, sensitive documents. In rescue or healthcare organisations, an intrusion into an administrator account can have serious consequences and expose you to liability. A second factor closes that door, without requiring verification at every login.
What two-factor authentication changes in eBrigade
At login, after the password, eBrigade asks for a one-time code: the one from the person’s authenticator app (Google Authenticator, Microsoft Authenticator…), or a code sent by email, by SMS (if the SMS module is active) or by mobile notification (if the Notification module is active). A sent code expires after 5 minutes. Verification is only triggered in the situations you define (new IP, login from abroad or every N logins), and IP addresses a user has already validated are recognised to avoid redundant requests.
What you can do with Two-factor authentication (MFA)
Authenticator app (Google Authenticator, Microsoft Authenticator, FreeOTP…), email, SMS (if the SMS module is active) or mobile notification (if the Notification module is active). The administrator chooses the permitted channels, with email always available.
Each person links their app by scanning a QR code from their profile. Codes are generated on the phone, even without a network, and each code can only be used once. Phone left behind: a code by email is still possible.
Rather than a code at every login, verification is triggered by risk rules: new IP address, login from a foreign country, or a regular interval. A single trigger is enough, and routine logins are not weighed down.
The login IP address is geolocated via the ipbase API to identify the country of origin. A login from a foreign country can therefore automatically trigger the code request.
The “interval” trigger requires a code every N logins, with a frequency configurable from 1 to 50 logins, for the whole organisation.
A user’s already-known IP addresses, cross-checked against the login audit log, are recognised so that no code is requested again from a usual location.
The settings tab, restricted to clearance 14, switches on two-factor authentication and sets the triggers, frequency and permitted channels. The rule applies to web login and the mobile app alike, and every account is protected from its very first login.
A sent code expires after 5 minutes. After five wrong codes, the login is cancelled, and every failure is counted by the eBrigade firewall.
Step by step
From the module’s configuration tab (restricted to clearance 14), choose the permitted methods: email (always available), SMS if the SMS module is enabled, mobile notification if the Notification module is enabled, and authenticator app (Google Authenticator, Microsoft Authenticator…).
For the whole organisation, choose the events that trigger verification: new IP address, login from a foreign country, or a code every N logins (from 1 to 50). Every account is protected from its very first login.
When a trigger occurs, the person enters the code from their authenticator app, or the one eBrigade sends them through the chosen channel (valid for 5 minutes). Access is only granted once the code has been entered.
IP addresses the staff member has already used, cross-checked against the audit log, are recognised as known: no new verification is requested from a usual location, which reduces day-to-day friction.
Where this module really pays off
Fire and rescue services (SDIS) & public bodies: two-factor authentication applied to every account from its first login, administrators and team leaders included.
Staff without reliable network coverage: codes generated offline by Google Authenticator or Microsoft Authenticator, without waiting for an email or SMS.
Healthcare organisations & sensitive data: verification code triggered on any login from a new IP address before access to casualty or patient records.
Multi-site & remote working: automatic challenge on logins from a foreign country, detected by IP address geolocation.
Mobile teams: periodic verification every N logins (configurable from 1 to 50) rather than at every login, to limit friction.
Shared workstations: recognition of IP addresses the staff member has already used, so a code is not requested again from a trusted location.
Frequently asked questions
How is the verification code delivered?
Through the person’s authenticator app if they have set one up (Google Authenticator, Microsoft Authenticator, FreeOTP…), otherwise by email. If the SMS module is enabled, the code can also be sent by SMS; if the Notification module is enabled, by notification in the eBrigade mobile app. The administrator chooses the permitted channels, with email always available.
Is the code requested at every login?
No. Verification is triggered according to the rules set for the whole organisation: a new IP address, a login from a foreign country (detected by geolocation), or a code every N logins (from 1 to 50). A single trigger is enough. Logins from an already-validated address do not ask for a code again.
Are TOTP apps such as Google Authenticator supported?
Yes. Each person links their authenticator app (Google Authenticator, Microsoft Authenticator, FreeOTP, 2FAS…) from My profile › Password, by scanning a QR code. Codes are then generated on the phone, even without a network, and each code can only be used once. Phone left behind: a code can still be received by email.
Who can configure two-factor authentication?
Organisation settings are restricted to users with clearance 14: from the settings tab, the administrator switches on two-factor authentication, chooses the triggers and frequency, and defines the permitted channels. Each person manages their own authenticator app from their profile.
How long does the code remain valid?
A code sent by email, SMS or notification is valid for 5 minutes and can only be used once; it can be resent from the entry screen. An authenticator app code changes every 30 seconds. After five wrong codes, the login is cancelled.
Does two-factor authentication work with SSO and LDAP?
Yes. It applies after the password, Google sign-in, SSO or the LDAP directory, on the web and in the mobile app alike. Your SSO identity provider can also apply its own two-factor authentication.