If an email address is being utilized by another client, employee, or test account:

1. Use an alias email for each account, such as parentemail+clientsfirstname@email.com.
2. You will receive a notification that an email verification link has been sent to the alias email address.
3. Open the email and click Confirm.

Single Sign On (SSO) provides the option to add Multi-Factor Authentication (MFA) to CentralReach accounts. MFA adds an extra layer of security by requiring an authenticator application or access to an email address prior to signing in.

Organizations can enable MFA for the entire organization or per user. If an organization does not require MFA, users can enable it individually.

Organizations can enable MFA:

1. In CentralReach, navigate to the organization’s name in the upper right-hand corner and select Single Sign On Settings
2. Click the Security Settings subsection under the “Organization Profile” section
3. Select the Require Multi-Factor Authentication toggle to turn it blue
4. Click SAVE. All users in the organization will have MFA enabled.

Organizations can opt certain users out of MFA:

1. In CentralReach, navigate to the organization’s name in the upper right-hand corner and select Single Sign On Settings
2. Under “Organization Settings,” select the Manage Users section
3. Search for a user in the “Find users…” search bar
4. After selecting a user, their “User Security” section will display. Select OPT OUT OF MULTI-FACTOR AUTHENTICATION. That user will not have MFA enabled in their CentralReach account.

Organizations can disable MFA:

1. In CentralReach, navigate to the organization’s name in the upper right-hand corner and select Single Sign On Settings
2. Click the Security Settings subsection under the “Organization Profile” section
3. Select the Require Multi-Factor Authentication toggle to turn it grey
4. Click SAVE. All users in the organization will have MFA disabled.

All user types (Clients, Employees, and Generics) utilizing the same email address to access different accounts in CentralReach should follow the process below.

1. After one user logs into their CentralReach account and validates the email address, the user will not receive the verification email when using the same email to validate themself on their remaining CentralReach accounts, in order to link them. 
2. The user needs to contact the organization’s admin to link their remaining CentralReach accounts.
3. The admin needs to log into the CentralReach organization account and navigate to the Contacts module. Select the user(s) that have not received the email to validate their account.
4. Navigate to the Basics section of their Profile and select Remove Access.
5. Click Convert to User. The user should now receive the email to complete the validation process and log in using the same email address. 

If the user is the owner of two or more organization accounts that need to be linked using the same email address, please contact CentralReach support to assist in linking the accounts.

New CentralReach users, including clients and generic contacts, need to have a primary email in the Basics section of their Profile before being converted to a user. After they are converted to a user, they need confirm their account and set up a password.

When logging into CentralReach with SSO for the first time:

1. Navigate to login.centralreach.com
2. Click First Time User?
3. Select CentralReach
4. Enter your email address in the “Email Address” field and select the reCAPTCHA checkbox, then click Send Link.
   • If the user exists within CentralReach, they will receive a “Set up your CentralReach Account” email.
5. Select Confirm Access & Set Up Password to navigate to the “Set Password” screen. 
6. When the password meets CentralReach’s requirements and is accepted, the page reloads and displays a hyperlinked “click here to continue” message that redirects users to the login screen. 
7. Upon returning to the login screen, log in with your email address and password. Users will be directed to their CentralReach account.

Organizations can manage SSO users that have validated their email address in the “Manage Users” subsection of the Organization Profile settings.

To manage SSO users:

1. In CentralReach, navigate to the organization’s name in the upper right-hand corner and select Single Sign On Settings
2. Click the Manage Users subsection under “Organization Profile”
3. Enter and select a user in the “Find users…” search bar
4. After selecting a user, Basic Information and Multi-Factor Authentication sections will display.
   • The organization can only enable/disable MFA for the user in the “Multi-Factor Authentication” section.

If an organization does not enable Multi-Factor Authentication (MFA), users can utilize this feature individually. 

To set up MFA:

1. In CentralReach, navigate to the name in the upper right-hand corner and select Single Sign On Settings
2. Click Security under the “User Profile” section
3. Click SET UP AUTHENTICATION and select either Authenticator or Email. This will determine how a code will be sent, either through an authenticator application or via email.

4. Click SELECT PROVIDER

5. If “Authenticator” is selected:

• • Follow the instructions in the “Verify Multi-Factor Device” pop-up.
  • Input the unique code in the “Code” field and click VERIFY DEVICE.

6. If “Email” is selected, click SELECT PROVIDER.

• • The next time you sign into your account you will receive a code via email to enter in the “Code” field.

MFA will now be enabled the next time users sign into their account.