Best Of

• Why MFA?

Oracle is committed to enhancing the security of your account through the application of Multi-Factor Authentication (MFA), which adds an extra layer of protection by requiring a second verification step when signing into your account.

Who does MFA apply to?

All Oracle customers who use their Oracle account to sign into any portal are required to enroll in MFA.

If you sign in using your cloud tenancy credentials, this change will not impact you. Your cloud administrator manages authentication settings for your account.

What should I expect with MFA?

When MFA is required for your login, you will be automatically prompted to set it up during your next sign-in. Follow the onscreen instructions to set up MFA. You can choose between the Oracle Mobile Authenticator (OMA) app, phone number (SMS), or email. Please note that OMA is the recommended method.

Will this affect my products I’ve purchased from Oracle?

No. MFA enforcement for Oracle hosted applications will not have any impact to products purchased from Oracle Products and Services.

What should I do if I don't receive my one-time passcode (OTP)?

If you don't receive your OTP:

• If using email, check your spam/junk folder.
• If using SMS, ensure that your phone has network coverage.
• Click “Resend” to generate a new OTP.
• Ensure “no-reply@identity .oci.oraclecloud.com” is not blocked. Check with your local IT if the email address is on the allowed list (if using email).
• Clear your browser cache and restart from the login URL.

How do I manage or set up a backup (second) factor?

You set your default factor during initial MFA registration. To add an additional phone number, email, enroll a new Oracle Mobile Authenticator, or change your default verification method, go to My Login Profile page, and use the Action menu under Authentication Factors.

If you lose your device or the device was reset, log back in by accessing My Login Profile page and set up a new factor with same/different device.

What factors are available for MFA?

Three factor options are currently available: the Oracle Mobile Authenticator app, phone number (SMS), and email. OMA is the recommended factor.

Note: If you have previously enabled factors other than phone number or email, these factors are not currently supported. Oracle has removed these factors for you, and you will be prompted to re-enroll in MFA during the sign-in process.

How do I download the Oracle Mobile Authenticator app?

To download the Oracle Mobile Authenticator app, please go to any major app store to download.

• Android | iPhone
• Apple | Microsoft

What is the impact of using an email alias/distribution list to log in?

It is not recommended that you use an email/distribution list for your account login. If you do, the following actions are recommended:

• Verify OTP delivery. Ensure that the alias correctly forwards emails to your inbox.
• Consider using OMA for MFA. OMA is the preferred MFA method. To add your individual phone number to the authentication list, go to My Login Profile → Authentication Factors and select Add Mobile Number as your authentication factor.

How do I change the email address associated with my account?

If you need to change the email address associated with your account, please use Oracle Account Profile to make any necessary updates.

My account is locked. What do I do?

After a maximum of 10 failed attempts, your account will be locked. The lockout duration is 30 minutes. Try logging in again after 30 minutes or reach out to Oracle support.

I lost the phone that I use for MFA. How can I update these factors?

Your email is automatically enrolled by default. So you can access My Login Profile with the alternative sign-in options and choose “email” for your second factor option. You will receive a passcode via email and should be able to log into the My Login Profile portal. Once logged in, click on Actions → Add Mobile Number to add another factor. If there are no other factor options listed, please contact live chat support.

What do I do when I get this message: The requeststate provided is either invalid or expired. Please provide a valid requeststate error message in the log-in screen.

This error message is returned when the passcode or the session is expired. Start a new browser session and re-access the application to go through the authentication process.

https://www.oracle.com/corporate/contact/help.html