A Microsoft Outage Shouldn’t Mean A Communications Disruption

A friendly reminder, as the Microsoft Outlook and Teams outage drags on, ArmorText users have been able to communicate without interruption.

• BC/DR, Crisis, PR and Cyber response teams have stayed connected.
• Threat sharing communities on ArmorText are still working across industries.
• Critical alerts from OT/ICS, SIEM/EDR and Datacenter Monitoring are still reaching responders.

Most people think about ArmorText in the face of a cyberattack and the need for out-of-band (OOB) communications for incident response (IR).

It’s humbling to know that our users trust us for those most extreme scenarios, but what about the most common ones? Benign outages caused by misconfigurations and human error?

That is exactly the point.

Why you can’t communicate on one tool doesn’t matter nearly as much as that you still can communicate.

Below are a couple common scenarios our users have asked us about during a corporate email outage. Note that while ArmorText itself doesn’t depend on your email, a few self-service steps do.

Here are the ones to work around while your email is unavailable.

Scenario 1: Our organization has ArmorText but I still need to enroll.

Welcome. Getting started takes a few minutes.

1. Download ArmorText for your desktop or phone at https://armortext.com/downloads/.

2. Email is used for MFA for self-guided user setup. Your admin will provide one of two workarounds:

• #1 A Signup Code. Sign up in the app or at https://portal.armortext.com/ with the code and an email address you can reach right now (not the one currently unavailable). A personal email is fine in this scenario. In the app, switch Have a sign up code? to yes to enter it.

• #2 A username and Password Reset Token. Choose Forgot your password? then Reset Password with Token. Don’t wait for an email. If the screen says a token was emailed to you, ignore that and use the one from your admin.

3. If you’re asked to set up multi-factor authentication (MFA), use an authenticator app. It keeps working when your email doesn’t.

Don’t have a code or a token? Ask the person who sent you here. Your organization’s ArmorText admins decide who joins.

Scenario 2: I’m already enrolled in ArmorText but forgot my password

• Need a password reset? The reset email can’t reach you right now. Ask your ArmorText admin for a Password Reset Token, then choose Forgot your password? and Reset Password with Token in the app, or go straight to https://portal.armortext.com/#!/password_reset/.

Scenario 3: I’m already enrolled in ArmorText but MFA is linked to email

• Still getting your MFA codes by email? If you’re prompted for a code on desktop and can’t receive it, let your ArmorText admin know. They can get you moved to an authenticator app in a few minutes. In the meantime, stay signed in on mobile.

*Signed in on your phone? You’re set. As long as you haven’t explicitly signed out, ArmorText keeps running, delivering messages, and sending notifications.

For ArmorText admins

1. Onboarding new users when email is compromised, or in this case just plain unavailable

You have two options:

• Signup Codes. Users enroll themselves with a code you give them and a personal email, for now. The code must come from a sign-up configuration with no domains listed, or personal emails are told the code is invalid. Sign-up configurations live under the Sign-up Configs tab in the ArmorText Management Console.

• Admin-assisted onboarding. You create the account under People > Add New Person with a first name, last name, and username. No email is required. ArmorText generates a Password Reset Token, you choose how long it stays valid, and you hand the username and token to the user directly.

Pro tip: You can leave new users in a Not Approved state. You’ll be able to see them, bring them into conversations, and communicate with them while you validate that the person who just came in with your code or token is who you intended. For Signup Codes, untick Auto Approve on the sign-up configuration first. It is ticked by default. Then give them full access and the ability to see others.

2. Password resets for existing users

ArmorText admins are your users’ friends here. While the self-service reset flow can’t deliver its email, you can issue a Password Reset Token yourself. Confirm you’re dealing with the right person first, keep the validity period short, and deliver the token directly. If the user gets their MFA codes by email, lift their MFA policy first. A reset signs them out of the app on every device, and they would be stuck at an emailed code.

3. MFA over email

If you’re using MFA with ArmorText (and you really should be) but some of your users never made the switch from MFA over email to an authenticator app, you can get things rolling in one of two ways:

• A few users: turn off the MFA policy for the individuals affected, have them enroll their authenticator app with ArmorText, then turn the policy back on for them.

• A lot of users: turn the policy off for specific groups or globally, have everyone enroll, then turn it back on for all. Keep that window short.

This will likely only affect users signing in on desktop, or signing in fresh on mobile, and only if your MFA trigger period has lapsed since their last prompt or you require MFA at every login. Users on authenticator apps are unaffected.

Pro tip: We can tell you where you stand today and help you report on progress. Just have your ArmorText admins ask us in ArmorText and we’ll generate the report right away.

We’ve sent ArmorText admins a step-by-step guide in ArmorText. If you didn’t receive it, message us there.

Need to bring more people on?

If this outage means more of your organization, or more of your partners, need somewhere to work, Reserve Capacity lets you expand your existing ArmorText instance on demand. Don’t have Reserve Capacity in place today? Message us in ArmorText anyway. We’ll work with you to get it approved now and sort out the paperwork afterward.

When your email is back

Two things worth doing while this is fresh:

• Move every remaining user from email-based MFA to an authenticator app.

• Practice in-crisis onboarding before you need it again: who creates accounts, how codes and tokens get to people, and how you verify who’s on the other end.

If you can’t communicate, you can’t remediate. That holds whether the cause is an adversary or an outage.