We’re experiencing MFA authentication failures specifically for mobile users trying to access the asset lifecycle module in ics-2022. Desktop users can complete MFA without issues, but mobile users get locked out after the MFA prompt.
The sequence is: Mobile user opens CloudSuite app > enters credentials > MFA prompt appears (push notification to Microsoft Authenticator) > user approves > app shows ‘Authentication failed - MFA verification incomplete’ error. The user is then locked out after 3 failed attempts.
I’ve verified that the mobile users have MFA properly enrolled and the same users can successfully complete MFA when accessing other modules like procurement or HR from their mobile devices. This issue is isolated to asset lifecycle module on mobile.
I’m concerned about mobile app compatibility with the MFA provider and whether there are specific settings in the asset lifecycle module that affect mobile authentication. Has anyone dealt with module-specific MFA issues on mobile devices?
Cause: MFA timeout too short for mobile app switching
Solution: Increase timeout to 120+ seconds
‘Authentication failed’ after approval:
Cause: Missing API permissions for MFA token exchange
Solution: Add mfa.validate scope to mobile app
Test MFA Flow End-to-End:
Use test account with mobile device
Enable debug logging
Attempt login and approve MFA
Review logs for:
MFA request generation timestamp
Push notification delivery time
User approval timestamp
Token callback receipt time
Total time from request to validation
If total time exceeds timeout, increase timeout value
Best Practices for Mobile MFA:
User Communication:
Inform mobile users about MFA timeout (they have 2 minutes to approve)
Provide instructions for app switching workflow
Explain that they may need to approve multiple times if they delay
Gradual Rollout:
Test with small group of mobile users first
Monitor MFA success rates
Adjust timeout and validation settings based on metrics
Expand to all mobile users once stable
Monitoring and Alerts:
Set up alerts for high mobile MFA failure rates
Monitor average MFA completion time for mobile users
Track mobile app version distribution
Identify users on outdated app versions
Fallback Options:
Always enable TOTP as fallback method
Provide SMS backup for users without Authenticator
Document emergency access procedures for locked-out users
Consider grace period for first-time mobile MFA users
Final Validation:
After implementing all changes:
Test with both iOS and Android devices
Test with varying network conditions (WiFi, cellular, low bandwidth)
Test app backgrounding during MFA (switch to another app mid-flow)
Test with different MFA providers if available
Verify that desktop MFA still works correctly
Monitor for 48 hours and adjust settings based on user feedback
The core issue was the disabled ‘Mobile Token Validation’ setting combined with an insufficient MFA timeout for mobile workflows. Asset lifecycle has stricter security requirements than other modules, which is why this issue was isolated to that module. The solution ensures mobile users have adequate time to complete MFA while maintaining security standards.
This draft is based on general Infor CloudSuite knowledge. It has not been verified against your specific version and environment. Practitioners: verify the steps and share your experience below.
This sounds like a session timeout issue specific to how the asset lifecycle module handles MFA on mobile. Check the session timeout settings in the module configuration - mobile apps often need longer timeout windows because of network latency and the time it takes users to switch between apps to complete MFA. Also verify that the mobile app version is compatible with ics-2022’s MFA requirements for asset lifecycle.
Tested this on ICS-2022 and enabling Mobile Token Validation under Asset Lifecycle MFA Configuration with Push Notification method resolved our mobile authentication failures immediately.
Good point about session timeout. I checked and the asset lifecycle module has a 30-second MFA timeout configured, while other modules use 90 seconds. That could explain why users are timing out when switching to Authenticator and back. Should I increase this timeout or is there a recommended value for mobile users?
For mobile users, I recommend at least 120 seconds for MFA timeout. Users need time to unlock their phone, open the authenticator app, approve the request, and switch back to CloudSuite. 30 seconds is too aggressive for mobile workflows. Also check if the asset lifecycle module has any mobile-specific authentication policies that might be conflicting with the MFA flow. Some modules have separate auth flows for mobile vs desktop.
I’ve seen this exact issue in ics-2022. The asset lifecycle module has stricter MFA validation than other modules because it handles sensitive asset data. The problem is that the mobile app doesn’t properly pass the MFA session token back to the module after approval. You need to verify the MFA provider configuration specifically for mobile clients - there’s a setting for ‘Mobile Token Validation’ that needs to be enabled for asset lifecycle. Without it, the module rejects the MFA response even though the user approved it in Authenticator.
I found the ‘Mobile Token Validation’ setting under asset lifecycle security configuration and it was disabled. I’ve enabled it and increased the MFA timeout to 120 seconds. Testing now with a few mobile users. Are there any other mobile-specific settings I should check?
Make sure the mobile app has the correct API permissions to communicate with the asset lifecycle module during MFA. The app needs specific OAuth scopes for MFA token exchange. Also check if your MFA provider (Microsoft Authenticator) supports the authentication method that asset lifecycle requires - some modules use TOTP while others use push notifications, and not all MFA providers support both methods equally well on mobile.