User Management & Security

Manage users & security settings within the Reach Admin Portal with robust tools, new as of 2024.

As of April 2024, all current Reach Admin users will be required to make new accounts on the updated experience. Current users will receive an email with an invitation link, as well as detailed instructions from their account manager at Reach.

The account hierarchy within Admin will be set up as follows:

Account - Users assigned at this level will have visibility to the client account and all merchant accounts below it.

Sub-account - Users assigned at this level only have visibility to a specific merchant account.

Accounts can have multiple sub-accounts beneath them, but users can belong to only one, either an account, or sub-account. 

Please navigate to the menu icon in the top right of your screen, and click “account settings” to open your profile and explore each of the following tabs:

Profile

• This tab is accessible and editable by all users.
• Click the edit button on each editable field to change details as needed.

Privacy & Security

• This tab is accessible and editable by all users.

• Basic Settings:

• Change your password by clicking the edit button.

• Multi-Factor Authentication 

• There are two methods for adding an extra layer of security to your account:
  • SMS text authentication to your mobile phone.
  • Or an authentication app on your smartphone.

• Login Sessions

• This section shows you all devices from which you are currently logged into this account. From here, you can also log out of all other sessions at once.

Security

• This tab is viewable & editable by admins only.
• The top of this page shows a summary of recommendations to take, click “manage” to pursue each recommendation, all of which are also listed below under “security checkup.” Each individual security page will also feature recommended actions. Let’s look into each security feature individually:

• MFA - Multi-Factor Authentication

• Summary - view which users are enrolled in MFA and those who are not.

• Configuration - Reach strongly encourages our merchants to enforce MFA for their users, and there are two options to do so:
  • “Force all users to enable MFA”
  • And “Force except enterprise SSO:” if the user is using SSO, MFA is not needed, otherwise they must enable MFA.
    
• Sessions:
  • Idle Session Timeout - set the time limit at which idle user sessions will end.
  • Force Re-login - set the time limit after which users must refresh their logins.
  • Maximum Concurrent Sessions - set the maximum number of sessions a user can have open at one time.

• Password:
  • “Summary” shows users with breached passwords.
    • It is important to note that there has not been any breach on the Reach site. However, Reach monitors third-party databases that identify compromised data. If the user's password matches with the database in the third-party platform, Reach will flag it. This proactive measure is meant to encourage the use of stronger passwords.
  
  • Configuration
    • User lockout: max sign in attempts before the user gets locked out.
    • Password history: set how many times a user must enter a net-new password before being allowed to enter a previously-used one.

• Inactivity:

• Displays users that have not been logged in for a certain period of time.

• Restrictions:

• IP - restrict your account to only be accessible from a singular IP address.
  
• Domain - allow only users with an approved email domain to be invited to your account.
  

Audit Logs

• This tab is only accessible by Admins and shows all security-related activity performed on the platform by each user, and when.

All Accounts

• This tab is only accessible by admins - it lists the account you are assigned to, as well as all sub-accounts under yours - for example: Merchants under Clients.
• From here, you can see a table view and graph view, as well as click into each account & sub-account.

• Clicking into an account lists all users within the account and offers a few options:
  • Invite Users:
    
    
    • First, enter their Email & Role.

• • • Then, toggle whether this user has access to the sub-accounts under them or not - you will need to do this if an Admin is adding another Admin - you can toggle sub-account access within the list of users too. This MUST be enabled in order for Admins to access All Accounts and to manage users with sub-accounts.
      
      
    • Lastly, an invited user will receive an email entitled: ‘Let’s activate your account’:
  • Click the “3 vertical dots” icon to edit user roles or delete users.
    
  • The sub-accounts tab will allow you to view all sub accounts under the selected account, and you can use the “3 vertical dot icon” beside to click into those accounts directly.
  • At this time, there is no function to move a user to a different account or sub-account. In order to do so, you must delete the user and add them again to the account or sub-account you wished to move them to.
    
    

Roles

• External users are assigned either a Merchant Admin role or a Merchant User role, and will have permissions as shown in this table: