Two-step verification

Deze inhoud is nog niet vertaald.

With two-step verification, signing in needs two things: your password (or your Google, Microsoft or company account) and a six-digit code from an authenticator app on your phone. The code changes every 30 seconds, so someone who learns your password still cannot sign in.

Choose an authenticator app

Any app for time-based codes works, for example Google Authenticator, Microsoft Authenticator, 1Password or Bitwarden. Use an app that you keep with you and that is backed up.

Set it up

Open Profile from your user menu in the top bar, then your profile’s Security tab.
On the Two-step verification card, choose Set up two-step verification. The setup page of the sign-in pages opens. If you signed in more than 10 minutes ago, you are asked to sign in again first.
On the page Set up two-step verification, scan the QR code with the authenticator app. If you cannot scan it, type the key shown under the QR code (groups of letters and digits) into the app instead.
Enter the six-digit code the app shows and choose Turn on two-step verification.
Focus shows ten recovery codes, once. Save them before you continue (recovery codes), then choose I saved the codes. You return to the dashboard.

When your organization requires two-step verification, the sign-in page opens the same setup page right after your password, before you can open the organization.

You receive an e-mail whenever two-step verification is turned on or off for your account.

What the Security tab shows

When two-step verification is on, the card shows your authenticator app with the date it was added and when it was last used, how many recovery codes you have left, and which organizations require two-step verification from you.

New recovery codes replaces all of your recovery codes (create new codes).
When only a few codes are left, the card warns “Only 2 recovery codes left” (with the number you have) and offers New recovery codes right there.
Turn off turns two-step verification off (turn it off).

Signing in

After your password, the sign-in page asks for the code from the app. Each code works once: if a code was just used, wait for the next one. If you do not have your phone, choose Use a recovery code.

You have 5 minutes to enter the code; after that, sign in again.
After 5 wrong codes, the sign-in starts over.
The desktop app signs in through your browser, so it asks for the code in the same way.
Your own code is also asked for when you sign in with Google, Microsoft or your company account.

When your organization requires it

Owners and admins can require two-step verification in Settings → Security → Sign-in policy, with the setting Require two-step verification (sign-in policy):

Setting	Who needs two-step verification
Off	Nobody is required to use it; everyone can turn it on for themselves
Owner and Admin only	Owners and admins
Everyone	Every member of the organization

When it applies to you and you have not set it up, the sign-in page asks you to set it up right after your password, before you can open the organization. Sessions that were opened without two-step verification end: the dashboard asks you to sign in again with your next click, and the desktop app within about 15 minutes. The error mfa_required means exactly this; sign in again and follow the steps.

An owner or admin who turns the requirement on must have set up two-step verification and signed in with it first, so nobody can lock themselves out.

People who sign in through your company’s own single sign-on already meet the requirement, because the company identity provider handles it. You can also require the identity provider to confirm multi-factor authentication; see single sign-on.

Confirming sensitive actions

Some actions ask you to sign in again if your last sign-in was more than 10 minutes ago, and to enter your code if you use two-step verification. The error step_up_required means this confirmation is needed. It applies to:

transferring ownership, changing your e-mail address and granting support access,
changing the sign-in policy,
turning off two-step verification and creating new recovery codes,
removing a sign-in method (sign in with Google or Microsoft),
single sign-on settings and domains.

The dashboard takes you to the sign-in page for the confirmation and brings you back to the same screen. Then choose the action again: it is not repeated by itself.

Turn it off

Open your profile’s Security tab.
On the Two-step verification card, choose Turn off and confirm.
Confirm your sign-in with your code if you are asked to.

You cannot turn it off while an organization you belong to requires it (mfa_required_by_organization): the card names that organization. Ask its owner or admin, or keep two-step verification on.

To move two-step verification to a new phone, turn it off and set it up again with the new phone. If an organization requires it, write to support@workify360.com from the e-mail address of your account instead (you lost your phone).