If an email address is being utilized by another client, employee, or test account:

1. Use an alias email for each account, such as parentemail+clientsfirstname@email.com.
2. You will receive a notification that an email verification link has been sent to the alias email address.
3. Open the email and click Confirm.

Single Sign On (SSO) provides the option to add Multi-Factor Authentication (MFA) to CentralReach accounts. MFA adds an extra layer of security by requiring an authenticator application or access to an email address prior to signing in.

Organizations can enable MFA for the entire organization or per user. If an organization does not require MFA, users can enable it individually.

Organizations can enable MFA:

1. In CentralReach, navigate to the organization’s username in the upper right-hand corner and select Single Sign On Settings
2. Click the Security Settings subsection under the “Organization Profile” section
3. Select the Require Multi-Factor Authentication toggle to turn it blue
4. Click SAVE. All users in the organization will have MFA enabled.

Organizations can opt certain users out of MFA:

1. In CentralReach, navigate to the organization’s username in the upper right-hand corner and select Single Sign On Settings
2. Under “Organization Settings,” select the Manage Users section
3. Search for a user in the “Find users…” search bar
4. After selecting a user, their “User Security” section will display. Select OPT OUT OF MULTI-FACTOR AUTHENTICATION. That user will not have MFA enabled in their CentralReach account.

Organizations can disable MFA:

1. In CentralReach, navigate to the organization’s username in the upper right-hand corner and select Single Sign On Settings
2. Click the Security Settings subsection under the “Organization Profile” section
3. Select the Require Multi-Factor Authentication toggle to turn it grey
4. Click SAVE. All users in the organization will have MFA disabled.

All user types (Clients, Employees, and Generics) utilizing the same email address to access different accounts in CentralReach should follow the process below. Please note, clients cannot link their CentralReach account with another client user account in the same organization.

1. After one user logs into their CentralReach account and validates the email address, the user will not receive the verification email when using the same email to validate themself on their remaining CentralReach accounts, in order to link them. 
2. The user needs to contact the organization’s admin to link their remaining CentralReach accounts.
3. The admin needs to log into the CentralReach organization account and navigate to the Contacts module. Select the user(s) that have not received the email to validate their account.
4. Navigate to the Basics section of their Profile and select Remove Access.
5. Click Convert to User. The user should now receive the email to complete the validation process and log in using the same email address. 
   • Please note, the user must have the same DOB in their Profile in order for the accounts to be linked.

If the user is the owner of two or more organization accounts that need to be linked using the same email address, please contact CentralReach support to assist in linking the accounts.

To log in using Single Sign On (SSO):

1. Navigate to login.centralreach.com
   • Navigating to members.centralreach.com will direct users to the new URL.
2. Enter your username and password, and click LOG IN
3. Your email address will need to be validated:
   • In the “Email Validation Required” screen, review the email address and click SEND CONFIRMATION EMAIL.
   • A validation email will be sent. Confirm the email address, which will then become your username.
   • Return to the login screen and log in with your new username and password.
4. If Multi-Factor Authentication (MFA) is disabled, users will be directed to their CentralReach account. 
5. If MFA is enabled:
   • Select either Authenticator App or Send email in the “Multi-Factor Authentication” screen.
     • If “Authenticator App” was selected, scan the QR code on a mobile device and enter the 6 digit verification code.
       • Click Verify Device
     • If “Send email” was selected, click Select Provider
6. Users will be directed to their CentralReach account.

New CentralReach users, including clients and generic contacts, need to have a primary email and date of birth in the Basics section of their Profile before being converted to a user. After they are converted to a user, they need to sign in to set a password.

When logging into CentralReach with SSO for the first time:

1. Navigate to login.centralreach.com
2. Click Forgot Password/First Time User?
3. Enter your email address in the “Email Address or Username” field and select the reCAPTCHA checkbox.
4. Click RESET PASSWORD. A “Password reset link sent” message will display to notify users that an email was sent.
5. In the email, click Reset Password and enter a password in the “New Password” fields. 
6. Click RESET PASSWORD
7. In the “Password Reset” screen, select click here to continue to be directed to the login screen. 
8. Enter your login credentials and click Login
9. In the “Email Validation Required” screen, review the email address and click SEND CONFIRMATION EMAIL.
10. A validation email will be sent. Confirm the email address.
11. Return to the login screen and log in with your new username and password. Users will be directed to their CentralReach account.

Organizations can manage SSO users that have validated their email address in the “Manage Users” subsection of the Organization Profile settings.

To manage SSO users:

1. In CentralReach, navigate to the organization’s username in the upper right-hand corner and select Single Sign On Settings
2. Click the Manage Users subsection under “Organization Profile”
3. Enter and select a user in the “Find users…” search bar
4. After selecting a user, Basic Information and Multi-Factor Authentication sections will display.
   • The organization can only enable/disable MFA for the user in the “Multi-Factor Authentication” section.

If an organization does not enable Multi-Factor Authentication (MFA), users can utilize this feature individually. 

To set up MFA:

1. In CentralReach, navigate to the username in the upper right-hand corner and select Single Sign On Settings
2. Click Security under the “User Profile” section
3. Click SET UP AUTHENTICATION and select either Authenticator or Email. This will determine how a code will be sent, either through an authenticator application or via email.

4. Click SELECT PROVIDER

5. If “Authenticator” is selected:

• • Follow the instructions in the “Verify Multi-Factor Device” pop-up.
  • Input the unique code in the “Code” field and click VERIFY DEVICE.

6. If “Email” is selected, click SELECT PROVIDER.

• • The next time you sign into your account you will receive a code via email to enter in the “Code” field.

MFA will now be enabled the next time users sign into their account.