Skip to content

Install and update#

Install#

  1. Connect. Sign in at deploy.andykemp.com/mfa and consent to the read-only permissions. Your tenant is linked to your organisation's account.
  2. Plan. Choose the subscription, region and resource group, the posture, which passkeys to accept, your break-glass and optional groups, the mail service and sender, and what people see.
  3. Review. Read-only checks run first: passkey profiles, registration protection, whether the break-glass group is role-assignable, and how your existing Conditional Access policies will combine with Auth-Onboard's. Then you consent once to the setup permissions.
  4. Install. Each step finds what already exists before creating anything. Tenant-wide changes are shown before and after and wait for you to type a confirmation.
  5. Done. You get the link to your admin portal. Add other admins by assigning them to Auth-Onboard-Portal in Enterprise applications.

Note

Microsoft tokens stay in your browser tab, and the mail key goes straight into your Key Vault. Andy Kemp Consulting never receives either.

Custom domain#

Optional, at the end of the install or on an existing install:

  1. Enter a subdomain such as onboard.example.com.
  2. Add the CNAME record shown.
  3. The installer checks it, adds it to the portal and points the email links at it. Azure issues and renews the certificate.

Updating#

Connect at deploy.andykemp.com/mfa again: your installs are listed with the version each runs.

  • Update publishes a new release with your settings and data kept. It needs only Azure access (Contributor on the resource group) and no Entra role.
  • Upgrade is offered only when the new release changes something in Entra or in how data is stored. It opens one screen: what's kept, the posture and passkey choice, and a single Upgrade button. Tenant-wide changes still wait for you to type UPGRADE.

To change groups, posture, passkeys, mail or branding on an install that's up to date, run the install form again on the same resource group: it's filled in from the install and picks up what's already there.