With the second half 2020 release hitting the SAP SuccessFactors Preview environment, we wanted to highlight an enhanced security feature coming to Production environments in January 2021. The new feature is a One-Time Password (OTP) for new candidate creation in Recruiting. If you have enabled “Use Email as External Applicant User ID,” when a new candidate creates an account, they will receive an email with a password/verification code and will be prompted to enter it before continuing to create their account. Why an extra step? It’s an added security feature to ensure new accounts are created by valid users. It has been applied to Preview environments and is available to be reviewed and tested. Unlike many features which are normally admin opt-in, the OTP feature is admin opt-out.
What does this mean for SAP SuccessFactors Recruiting customers? Once released in January 2021, if you decide this feature is not something you want to use, the system-administrator can turn it off. However, before making a decision, we recommend reviewing documentation and testing to ensure you have full understanding of how the OTP feature works and why it may be a best-practice to use.
Let’s explore how the OTP feature at a high level.
When a new candidate visits your site, and they select the option to create an account, they are presented with the account creation screen. Depending on whether you use Career Site Builder, your account creation page may look a little different.
Once the candidate completes the required fields and selects Create Account, they will receive an email (managed in Recruiting email triggers) with a one-time password and will be prompted to enter that password. Once the password is verified, the account will be successfully created. The password is good only for a short period and if not entered during that time frame, the applicant can request a new passcode.
After reviewing the documentation and best practices, if your organization decides not to use the added OTP verification feature, it can be disabled in Admin Center, by navigating to Manage Recruiting Settings. Under the Career Site section, select the check box for “Disable One-Time Password for Email Verification during Candidate Account Creation.
Regardless of whether you decide to use the OTP feature, prepare for it's arrival of in the Jan 2021 release. For up-to-date information don’t forget to check out SAP SuccessFactors' Recruiting Resource Blog.
