Interchange: Two-factor authentication (2FA)

As part of our work to increase our security arrangements, from 15 April we’re adding two-factor authentication (2FA) to our secure website, Interchange. To enable us to do this, we’re changing the way you log into Interchange.

What’s changing?

From 15 April, users will access Interchange via our single sign-on service, My Cambridge, and then set up 2FA. This is what you’ll need to do:

1. Enter your My Cambridge login details – Users log into My Cambridge and click on the Interchange tile or click on a link to Interchange and enter their My Cambridge login details. If you didn’t have an existing My Cambridge account, we’ve created an account for all active Interchange users. You’ll need to activate this account – please see our instructions.
2. Enter your 2FA passcode – Users will be asked to set up 2FA using an authenticator app – see our step-by-step instructions. Then, each time you log in, you’ll need to enter the passcode from your authenticator app.
3. Select your Interchange user details – Users will then select their centre number or ID and Interchange username from the dropdown boxes.

You will then be able to use Interchange and the associated services.

If you did not receive our recent email containing the instructions for adding 2FA to your Interchange account, this can be found here 

Two factor authentication (2FA) FAQs

What’s is two-factor authentication (2FA)?

Two-factor authentication or '2FA' is a type of multi-factor authentication (MFA). This is also sometimes knows as TFA.

Which services does this impact?

This impacts all services that are linked to Interchange or are accessed through Interchange. This includes  Active Results, the OCR Repository, Special consideration online and the JCQ Centre Admin Portal, including Access arrangements online.

What devices can I use?

You need to use a mobile device that only you have access to. This can be a mobile phone or a tablet.

Which authenticator apps can I use with my mobile device?

We have tested Google Authenticator and Microsoft Authenticator, although if you already use other authenticator apps, these may also work.

Do I have to pay for an authenticator app or pay a subscription?

No. If you are asked to pay or subscribe to use an authenticator app, please check you have downloaded the authenticator app you intended. Google Authenticator, Microsoft Authenticator and many other apps are free to use. 

I don’t want to use a mobile phone or tablet, is there an alternative?

You can purchase and use a hardware authenticator called a YubiKey, manufactured by Yubico. This is a USB device linked to the Yubico desktop authenticator app. This has been tested with the My Cambridge 2FA that is used to access Interchange. 

For further information, please see our article on using a Yubico authenticator on your desktop.

Why do we have to have an authenticator app? Why can’t we use email or phone authentication?

Authenticator apps have a greater level of security. The codes are generated locally on your device so offer an additional layer of protection if your email account is compromised. We are implementing 2FA in line with the other awarding bodies.

Set-up troubleshooting

I am an Interchange user but I have not used My Cambridge before, how do I get a My Cambridge account?

If you didn’t have an existing My Cambridge account, we’ve created an account for all active Interchange users. You’ll need to activate this account – please see our instructions.

A new 'Interchange' role has been added to My Cambridge. This is required to access Interchange and has been added to all My Cambridge users with an 'active' Interchange account.

Which Interchange users are considered to be 'active'?

• Any users that have changed their password in the last year are considered 'active' and have been added to My Cambridge and given the 'Interchange' user role.
• We have removed any users from Interchange that have not changed their Interchange password in the last year. We have not set up a My Cambridge account for these users. 

A user at my centre has followed the step-by-step instructions for adding an authenticator. They are receiving an error message that the request is invalid or they are missing a Device ID.

This may be because they are using 'incognito' or 'private browsing' mode or are blocking third party cookies. Switch to standard browsing or enable third party cookies to continue. 

A user at my centre has followed the step-by-step instructions for adding an authenticator. They are receiving an error message after they have scanned the QR code and entered the code from their authenticator app, what can I do?

If the user receives an error, the first thing to do is close all browser tabs and windows and then re-open the browser and log in again. 

Another thing to check is that the user is not in 'incognito' or 'private browsing' mode. Switch to standard browsing or enable third party cookies to continue. 

If the user is still receiving an error, there are a number of things you can check:

General troubleshooting

I have removed the authenticator app from my device and lost my 2FA access, what can I do?

If you uninstalled the authenticator app after it was paired to your My Cambridge account, please contact us. We will reset the 2FA on your account so you can link it again.

I have a new phone or tablet, do I need to set up 2FA again?

If you have access to your old device, you can simply transfer the authentication – please follow the instructions provided by your authenticator app to transfer the authentication to your new device.

If you are unable to use the transfer function, please contact us. We will reset the 2FA on your account so you can link it to your new device.

As the centre administrator for My Cambridge and Interchange, how do I set up a brand new user on Interchange?

1. You first need to set the user up with a My Cambridge account and give them the 'Interchange' user role on My Cambridge. Please check Adding users to your organisation and Managing user roles on My Cambridge for instructions.
2. It may take up to 15 minutes from adding the Interchange user role within My Cambridge for the new user details to be available within Interchange.
3. Log into Interchange, navigate to Admin>Manage centre users and click on ‘Add new Interchange users’. Enter the user’s email address exactly as entered in My Cambridge in the space provided and click ‘Search’. You then must give the new user a username – we recommend using the first initial and last name. Once the username has been added, select the ‘Role’ tab to add the roles they need within Interchange and click ‘Add’.