<style>p { margin: 0; }span.fr-emoticon.fr-emoticon-img { background-repeat: no-repeat !important; font-size: inherit; height: 1em; width: 1em; min-height: 20px; min-width: 20px; display: inline-block; margin: -0.1em 0.1em 0.1em; line-height: 1; vertical-align: middle; } span.fr-emoticon { font-weight: normal; font-family: "Apple Color Emoji", "Segoe UI Emoji", "NotoColorEmoji", "Segoe UI Symbol", "Android Emoji", "EmojiSymbols"; display: inline; line-height: 0; } blockquote { border-left: solid 2px #5e35b1; color: #5e35b1; margin-left:0; padding-left:5px;}blockquote blockquote{ border-color: #00bcd4; color: #00bcd4;}blockquote blockquote blockquote{ border-color: #43a047; color: #43a047;} table.grid{ border-collapse: collapse;} table.grid td, table.grid th { border: 1px solid #ddd;} .fr-fic.fr-dib{ display: block; margin: 5px auto;}.fr-fic.fr-dib.fr-fir{ text-align: right; margin: 5px 0 5px auto;}.fr-fic.fr-dib.fr-fil{ text-align: left; margin: 5px auto 5px 0;}.fr-fic.fr-dii{ float: none; margin: 5px auto;}.fr-fic.fr-dii.fr-fil{ float: left; margin: 5px auto;}.fr-fic.fr-dii.fr-fir{ float: right; margin: 5px auto;}img.fr-dib.fr-fir { margin-right: 0; text-align: right;}img.fr-dib.fr-fil { margin-left: 0; text-align: left;}img.fr-dib { margin: 5px auto; display: block; float: none;}img.fr-bordered { box-sizing: content-box; border: solid 5px #CCC;}img.fr-shadow { box-shadow: 10px 10px 5px 0px #cccccc;}img.fr-rounded { border-radius: 10px; -moz-border-radius: 10px; -webkit-border-radius: 10px; -moz-background-clip: padding; -webkit-background-clip: padding-box; background-clip: padding-box;}</style><p><strong>In this guide we will cover:</strong></p><p><strong>- What is Admin Mode? </strong></p><p><strong>- How to Configure Admin mode</strong></p><p><strong>- Using Admin mode</strong></p><p id="isPasted"><strong>- Notify the agent when admin mode is activated on their account</strong></p><p><br></p><p><br></p><p><br></p><p><strong><span style="font-size: 14pt;">What is Admin Mode?</span></strong></p><p>Admin mode allows you to restrict administrator accounts so they are not granted admin privileges immediately upon login, and instead have to complete an additional two-factor authentication to elevate the permissions of the session when they require admin privileges. </p><p><br></p><p>This improves the security of administrator accounts as it provides an additional barrier to administrator access as well as imposing a time limit on this access. Administrator agents will still be able to access their Halo in line with all their other permissions but to view or edit any entities that require administrator access they will need to head into 'Admin mode' and complete 2FA. </p><p><br></p><p><strong><span style="font-size: 12pt;">Who this affects</span></strong></p><p>Admin mode only impacts agents who have the permission 'Is a HaloPSA Administrator' this can be granted either through a role or against their agent profile. </p><p><br></p><p>These agents will still be able to log into Halo as usual, but when they log in they will not be able to access entities that are restricted to administrators right away (i.e. the configuration area). If the agent has been granted access control to certain entities, they will be able to access these entities in the 'My config' area without going into Admin mode. </p><p><br></p><p><strong><span style="font-size: 14pt;">How to Configure Admin mode</span></strong></p><p>As admin mode relies on 2FA to gatekeep access, in order to use this functionality 2FA must be enforced for all agents. To enforce this head to configuration > advanced settings > enable 'Force all Agents to use Two-Factor Authentication'. </p><p><br></p><p><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImMzMDA5MjMwLTM1OWMtNDgzZC1hOGU2LWM0Y2YzZGNhMmRiNCJ9.Qb3PhdjGz5U3RmnpBpkjCEHQcQw_u8Vn_TredstLYq4" class="fr-fic fr-fil fr-dib" width="383" style="width: 385px; height: 331.404px;" height="331"></p><p><strong><span style="font-size: 10pt;">Fig 1. Enforce 2FA</span></strong></p><p><br></p><p>Once this is enabled 'Admin mode' can be enabled. Head to configuration > security and performance > section 'Request verification to enable Admin privileges' > click to configure > set 'Agent app Administrator access grant' field to be 'Agents with the administrator permission must elevate their session by verifying with 2FA to get Administrator access'. </p><p><br></p><p><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImExZTU0NWYwLTcyYzUtNDg0ZC05YjNkLTVjZmMwYzBlMTc4YyJ9.g4a2nxz5bMYZWogjuoeMY8sZE1jzDJamH_wZ5rW1HL0" class="fr-fic fr-fil fr-dib" width="1219" style="width: 1221px; height: 273.924px;" height="274"></p><p><strong><span style="font-size: 10pt;">Fig 2. Agents with the administrator permission must elevate their session by verifying with 2FA to get Administrator access</span></strong></p><p><br></p><p>Once enabled you will have an additional option to set the admin mode duration. </p><p><br></p><p>Admin mode duration - Here, choose how long admin mode lasts for agents. </p><ul><li><strong>Admin mode lasts until the next token refresh (normally 1 hour) until the agent needs to verify again</strong> - When chosen admin mode will last until the next token refresh, token refreshes take place automatically, usually every hour. </li><li><strong>The Agent can choose whether the access lasts until the next token refresh or until they log out</strong> - When chosen agents can choose how long they will be in admin mode for. They can choose between staying in admin mode until the next token refresh or until they log out, this is useful when doing configuration for an extended period of time.</li></ul><p><br></p><p><strong><span style="font-size: 14pt;">Using Admin mode</span></strong></p><p>When admin mode is enabled agents with the administrator role will be able to log into Halo as usual, but their access will behave as if they do not have the administrator permission. The entities the agent has access to will be determined by the rest of the agent's permissions. They will also have two configuration modules 'Configuration' (for admins) and 'My config'. </p><p><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImU0ZTYyNDFmLWIyY2UtNDcwYS1iYzc3LTY5YTk4M2ViM2NmMCJ9.n2EtOh1_HRgWBFBjFBnv839aOpn7B7h4_bpw--xMoJE" class="fr-fic fr-fil fr-dib" width="529" style="width: 531px; height: 564.906px;" height="565"></p><p><strong><span style="font-size: 10pt;">Fig 3. Configuration modules</span></strong></p><p><br></p><p><strong>My Config </strong>- This module will provide configuration access to entities the agent has been granted <a data-fr-linked="true" href="https://usehalo.com/haloitsm/guides/2426" id="isPasted" target="_blank" rel="noopener noreferrer">access control</a> to. Agents do not need to be in admin mode to access this module. </p><p><br></p><p>When agents navigate to the configuration module a pop-up will appear, prompting them to log-in and complete 2FA. If you have allowed agents to choose how long they can remain in admin mode for it is at this stage they can choose. </p><p><br></p><p><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImVkOWFlNTkyLTMwNWEtNGVmMy04MzkwLTMyZDMzZTVjZjhjMSJ9.beK4EFcGbXKSRZcQ7RK3j7gJrqqn3Uu273DKXOtT5W8" class="fr-fic fr-fil fr-dib" width="538" height="639"></p><p><strong><span style="font-size: 10pt;">Fig 4. Log-in pop-up</span></strong></p><p><br></p><p>Now the agent will be in administrator mode and can made configuration changes as usual. </p><p><br></p><p>Agents can also access admin mode from their account on the side bar.</p><p><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImE3ZDEyNjExLThlOTUtNGY2OS1hNjZmLWM1YmM3ZWM3ZjE2ZiJ9.-kKcAyDI_8hiU7AKajZgqwXBobUJ8D23mPgZVCBoKeY" class="fr-fic fr-fil fr-dib" width="270" style="width: 272px; height: 310.857px;" height="311"></p><p><strong><span style="font-size: 10pt;">Fig 5. Admin mode option</span></strong></p><p><br></p><p>Once in admin mode agents will have administrator access to the instance, they will be able to access entities (such as tickets) regardless of their other permissions, and they will have configuration access. </p><p><br></p><p>If they have selected to stay in admin mode for an hour (until the next token refresh), they will see a timer at the top of the page indicating how long they have left of their session. </p><p><br></p><p><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjMyMDQwMThmLWUyZDItNDRhNS05ODY0LTY1YjhiMjVjN2RhZiJ9.3NE9QpmTtqyJP5c-NLR6_XFZHeiHdIp2DSaatD30p7Y" class="fr-fic fr-fil fr-dib" width="1218" style="width: 1220px; height: 474.279px;" height="474"></p><p><strong><span style="font-size: 10pt;">Fig 6. Time remaining in admin session</span></strong></p><p><br></p><p>To leave admin mode agents will need to log out and log back into Halo. </p><p><br></p><p><strong><span style="font-size: 14pt;">Notify the agent when admin mode is activated on their account</span></strong></p><p>To increase security the agent can be notified each time admin mode is activated against their account. Enable this under configuration > security and performance > 'Admin mode activated'. </p><p><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImI2MjhkZWU3LTk4NDQtNGM3MC05N2YyLWNlN2Q0ZjgyODM0YiJ9.4J2WcWemD_9-aVPC0gXBdMnJMk2PVY85cQ7ZFXZM4d0" class="fr-fic fr-fil fr-dib" width="1060" style="width: 1062px; height: 304.187px;" height="304"></p><p><strong><span style="font-size: 10pt;">Fig 7. Activate admin mode notification</span></strong></p><p><br></p><p><br></p><p><br></p><p><br></p>
