Authentication

Authentication is a core security feature of the beem app. It verifies the identity of users and ensures that only authorised individuals can log in and access sensitive features and data within beemNet. This page explains how authentication works in the beem app, what to expect during login, and how re-authentication and logout are handled.

SMS authentication

Essential Edition users can log in by using a mobile phone number linked to beem. This requires a device capable of receiving SMS messages; all major Swiss mobile providers are supported. This authentication is performed using a one-time verification code sent via SMS. Entering this code completes the authentication process and advances the login.

If the code is not entered within 10 minutes, the authentication will time out. Depending on the device's operating system, if you see the ‘Authentication Timeout’ screen, there will be either a close X button in the top right corner or a back ← button in the top left corner. This button will return you to the login screen, where you can try to authenticate again.

Username authentication

Standard, Plus, and Premium Edition users can log in by using their username, which requires a device set up for passkey authentication. Username credentials are based on Swisscom Business Accounts or on other authentication methods provided by a user’s organisation.

By default, users log in with a Swisscom Business Account, but organisations can also provide their own authentication methods. When using Swisscom Business Accounts, authentication is fast, safe, and easy thanks to passkey technology, which eliminates the need for passwords. Authentication must occur within 10 minutes, or it will time out.

Re-authentication

The beem app includes a built-in mechanism to periodically prompt users to re-authenticate. This interval is configured by the beem administrator and helps maintain session integrity and compliance with organisational security standards. Users receive a system notification 15 minutes before re-authentication is required.

Re-authentication does not imply a logout; rather, the user remains logged in but is no longer authenticated. If the user is not authenticated, network traffic cannot be routed through beemNet. As a result, the app behaves as if disconnected from beemNet.

On macOS and Windows, if there is no valid authentication, the beem app automatically opens, prompting for authentication, and the status icon in the menu or tray bar turns red. If authentication times out while the computer is off or in sleep mode, the user will be prompted to authenticate upon restarting the device.

On iOS, iPadOS, and Android, a notification is sent if there is no valid authentication. When the user taps on the notification or opens the beem app, they are prompted to authenticate. If authentication times out while the smartphone or tablet is off or in sleep mode, the user will also need to either tap the notification or open the app manually to authenticate. Therefore, it is important to remember to check for the notification or open the app after restarting the device.

Logout

To log out of the beem app, users must navigate to the settings menu ☰ in the upper right corner of the home screen of the app and select the Log out option. This action is confirmed through a prompt to prevent accidental logouts.

Logging out resets the app to its default state. All user-specific and administrator-defined settings are cleared. This includes custom configurations, preferences, and any temporary session data. Upon the next login, the app will reapply the default configuration as defined by the beem administrator.

UPN syntax requirement

When setting up user accounts, beem administrators must ensure that usernames follow the User Principal Name (UPN) format. This is a widely used schema whose syntax resembles an email address, for example jane.doe@company.com. It is important to note that while a UPN can also be an email address linked to an email server, it does not have to be.

The suffix following the @ is particularly important. UPNs follow the same conventions as the internet's domain name system. This suffix, known as the domain, is globally assigned to a beem tenant and serves as the foundation for the beem app's auto-discovery feature. This ensures that users do not need to know any configuration parameters; knowing their username is sufficient.

WARNING

UPNs must always be specific to a beem tenant when using the beem app. This requirement does not apply to other access methods.