Instagram Onboarding Guide

About this Document

1. Purpose

This guide has been created to assist Territory App Owners in securely managing Instagram accounts with the Identity Access Bridge (IDAB) powered by Cerby. This document provides essential steps and considerations for integrating Cerby’s security features.

2. Considerations for Effective App Onboarding

To ensure a smooth onboarding experience please review the below considerations when onboarding your Instagram account.

1. Use the Same Device: Perform the initial configuration using the device you regularly sign in from to avoid security alerts related to unfamiliar devices.
2. Be Aware of Login Limits: Watch out for new logins that exceed usual travel distance limits, as they might trigger security alerts.
3. Manage Two-Factor Authentication (2FA): Disable 2FA on your account entirely before enabling it through Cerby to ensure seamless integration.
4. Follow Steps in Order: Adhere strictly to the outlined steps to prevent locking your account or creating inconsistencies.
5. Validate Your Password: Before proceeding to other tasks, ensure your password works by logging in. It's easy to inadvertently introduce an extra space when copying and pasting.
6. Account Change Restrictions: Be aware that some platforms may restrict multiple changes to an account at once. These restrictions typically lift automatically after a few days, so don’t worry.
7. Preferred MFA Method: Whenever possible, use the Authenticator App over SMS or email for a more secure MFA experience.
8. Login Process: After clicking login, avoid moving your mouse or clicking anything until Cerby confirms: “You are logged in” to ensure the automation runs smoothly.
9. Avoid Automation Interference: Navigating away or interacting during automation processes may cause them to fail.
10. Check Alerts and Notifications: Pay special attention to in-context alerts in the top-right corner of the screen for important information. If errors occur, these alerts can be very informative.

3. Overview of Onboarding Steps

As part of this document we will cover, how to:

1. Onboard the account to Cerby
2. Enable MFA managed by Cerby
3. Integrate your account to a Cerby-managed Email
4. Integrate your account to a Cerby-managed Phone
5. Save the backup codes
6. Share your account with security groups
7. Password Rotation

3. Prerequisites

Before proceeding, please make sure that you comply with the prerequisites laid out below. If you have not you will not be able to complete onboarding and may leave your account inaccessible.

• Access to the account’s credentials including the username, email associated with the account, password, and access to the multi-factor authentication (if enabled).
• A list of authorized users' emails (internal, external) who require native access to your accounts.
• Confirm that you can access https://pwc-prod.cerby.com/
• Access group creation: Please follow the guide HERE to create your access groups.
• Install the Cerby extension on your PC.
• Download the Cerby mobile app via your app store (if the account is also managed on the mobile application).

4. Instagram Account Onboarding Guide

4.1 Account Onboarding

1. Login to Cerby Workspace:
   • Navigate to the "Accounts" section in Cerby if you are not already there.
2. Add New Account:
   • In the top right corner, click the blue "+ Add item" button.
   • Select "Account" from the drop-down menu.
3. Account Label:
   • Fill out the label field to uniquely identify the account.
   • Use the naming convention: "<territory's 2-letter country code> - Instagram" (e.g. "US - Instagram").
   • This standard format helps with visualization, management, and avoiding conflicts with existing app labels.
4. App Selection:
   • In the "App name or URL" field, either select from the list or type the name to display the app.
   • Choose "Instagram" from the options.
5. Username and Password:
   • Enter the username and password in the respective fields.
6. Email Address:
   • Input the email address linked to the account.
7. Vault Configuration:
   • Ensure the Vault is set to “AKV-PwC-Prod,” which is the default vault for PwC.
8. Complete the Addition:
   • Click the "Add Account" button.

4.2 Initial Login Test for Instagram

1. Install Cerby Browser Extension:
   • Ensure the Cerby Browser Extension is installed and configured with your account.
   • To pin the extension for easy access:
     • Click on the “puzzle piece icon” at the top right of the browser window.
     • Click the pin icon next to the Cerby Browser Extension.
     • Click on the extension and then select “Login.”
   • [If the extension is not installed, proceed with the browser extension installation.]
2. Testing the Login Process:
   • Return to Cerby, refresh the browser tab, and click on “Login” for Instagram.
   • The automation will take over, entering the username and password on your behalf.
   • Once the login process is complete, it will confirm that the account has been onboarded successfully.

4.3 Securing Your Instagram Account

Instagram is particularly sensitive to security configuration changes. The process involves enabling a Cerby-managed SMS, followed by managed MFA, and managed Email. If successful, a password rotation can be performed a few days later to avoid any potential account security restrictions, imposed by Instagram.

4.3.1 Managed SMS

1. Enable Cerby-Managed SMS:
   • Navigate to your newly onboarded Instagram account in Cerby.
   • Click “Add a Cerby-managed SMS” on the left side of the screen.
2. Generate and Copy Phone Number:
   • A new Cerby-generated phone number will be created.
   • Once it's ready, check the checkbox, click the “Copy” icon next to the phone number, and then click the “Create Phone Number” button.
3. Add Phone Number in Instagram:
   • Return to the Instagram tab.
   • Navigate through: “More” → “Settings” → “Account Center” → “Personal Details” → “Contact Info” → “Add new contact” and select “Add Mobile Number.”
   • Paste the Cerby-generated phone number, confirm the correct Country Code, select the associated account, and click “Next.”
4. Retrieve OTP from Cerby:
   • Instagram will send a One Time Password (OTP) to the Cerby-managed phone number.
   • Return to Cerby and click on the “Inbox” at the top to find the OTP code.
5. Confirm Phone Number in Instagram:
   • Enter the confirmation code in Instagram and click “Next.”
   • If the code is correct, the new phone number will be activated.
   • Click “Close” to complete the process.

4.3.2 Managed MFA

1. Enable Cerby-Managed MFA:
   • Navigate to your Instagram account settings within Meta Accounts Center.
   • Click on “Password and Security.”
2. Configure MFA in Instagram:
   • Select “Two-factor authentication,” choose the relevant account, then select “Authentication app” and click “Continue.”
   • On the next screen, click "Copy key."
3. Setup MFA in Cerby:
   • Return to your Instagram app in Cerby and click on “Settings.”
   • Click “Turn on Cerby-managed MFA.”
   • Paste the copied key into the “Secret Key” box and click “Save Code.”
4. Complete MFA Setup:
   • Cerby will generate a code for you. Copy this code.
   • Paste the code back into Instagram, click “Next,” paste the code again, and click “Next.”
5. Backup Codes:
   • Click on “Backup Codes” in Instagram.
   • Highlight and copy the codes using CTRL+C.
   • Return to Cerby, and click on “Save back-up code” on the left side.
   • Paste the codes into the “MFA Backup Codes” box and click “Save Codes.”
   • Go back to Instagram, click on the “< back arrow,” and then “Done.”

4.3.3 Managed EmailNote: If managed Email cannot be enabled during this session and this is the first application onboarded, proceed to the next item. If only the former applies, move on to the step for enabling Managed SMS.

Managed Email

1. Set Up Cerby-Managed Email in Cerby:
   • Access your Instagram account in Cerby.
   • Click “Add a Cerby-managed email.”
   • Follow the prompts: “Protect my email address” → “Set up email address.”
2. Set Up Auto-Forwarding:
   • Click on “Set up auto-forward.”
   • Choose the recipients who should receive forwarded messages from the Cerby-managed email.
   • [Select recipients based on customer preferences; use the territory name as a prefix for distribution lists. Note: Custom distribution lists with team emails should be configured by a CCM Admin via the distribution lists option in the main menu.]
   • Click “Next” and then “Confirm.”
3. Add the Cerby-Managed Email in Instagram:
   • Copy the Cerby-managed email address by clicking the “Copy icon,” then click “Confirm.”
   • Navigate back to the Instagram tab.
   • Click on “Personal Details,” then “Contact Info,” then “Add new contact” and select “Add email.”
   • Paste the Cerby-managed email address.
   • Select the account the email will be associated with and click “Next.”

Top of Form

Account Sharing

This section provides the steps need to share the onboarded account with the access groups that have been created for your Instagram account.

1. Share Account:
   • In Cerby, click on “Accounts” on the left menu, select Instagram, and then click “Share” at the top right.
2. Assign Permissions:
   • Search for the specific team group. If the group does not appear in the list, start typing the two-letter territory code followed by "_Instagram."
   • Select the Owners group, choose “Owner” permission from the drop-down list, then click “Confirm.”
   • Repeat the process for the Collaborator group by clicking “Share,” selecting the Collaborator group, choosing “Collaborator” permission, and clicking “Confirm.”
3. Confirm Teams and Users:
   • Navigate to the “Teams” section in the Instagram account to view both groups with their permissions.
   • In the “Users” section, all users and their permissions will be displayed.

4.4.1 Checking & Managing Access

1. View User Access:
   • In Cerby, within the Instagram account, click on “Users” to see who has access and their roles.
   • Users are synchronized from PwC’s Identity Provider, based on Microsoft’s Entra ID.
2. Manage Users in Entra ID:
   • To add or remove users from a specific application group, access “myaccount.microsoft.com” and click on “Groups I own” on the left.
   • As the owner of the application groups, manage users according to business needs as part of the self-service model for the IDAB Service.

Note: Be cautious in provisioning access or assigning full team ownership, as this may increase the risk surface associated with the app.

4.5 Final Login Test

To test login for Instagram after enabling security features:

1. Install Cerby Browser Extension:
   • Ensure the Cerby Browser Extension is installed and configured with your account.
   • Click the puzzle icon at the top right of the browser window, click the pin icon next to the Cerby Browser Extension, click on the extension, then select “Login.”
   • [If not installed, proceed with the browser extension installation.]
2. Automated Login:
   • Return to Cerby, refresh the browser tab, and click on “Login” for Instagram.
   • The automation will complete the login process, including entering the username, password, and MFA.
   • When the login process is complete, you are ready to go.

Password Rotation

What is Password Rotation

Password rotation is a security practice that involves changing your account password periodically. This helps to minimize the risk of unauthorized access by reducing the chances that a stolen or compromised password remains useful to a malicious actor for an extended period. In the context of Cerby, once the password rotation feature is fully implemented, it will be automated to ensure that passwords are changed at regular intervals without manual intervention, thus enhancing security without disrupting user access.

When to Rotate

• Post-Onboarding: After onboarding your account, wait at least 2-3 days before performing a manual password rotation to avoid triggering security alerts from Instagram.
• Password Rotation: Follow a standard password change process via Instagram and copy the new password to the password section of your App in Cerby.

6. Document Approval & History

6.1 Document Approval

Name	Role	Date

6.2 Document history

Version	Date	Description	Contributor
0.1	10–02-2026	Initial Draft	Leonard Rooney