Two-factor authentication #
Each Client decides whether its administrators must use two-factor authentication (2FA) when they sign in. The setting is on the Client.
Separately, each Company has a similar setting, which decides whether its employees must use 2FA.
By default, 2FA is optional, which in practice means it is off: administrators and employees sign in with their username and password as they always have, without 2FA.
However, in reality it is optional, so each can turn it on for themselves if they choose a higher level of security.
A Client or Company which changes optional to required chooses between:
- Authenticator app or emailed code: each person chooses which when they set it up.
- Authenticator app only: the more secure, as anyone who can read the mailbox can also reset the password.
Administrator sign-in #
Open the Client and choose Preferences. Administrator sign-in holds two-factor authentication for every administrator of the Client. Choose one, then click Update.
Administrator sign-in is Client-wide.
Employee sign-in #
Open each Company and choose Preferences. Employee sign-in holds the same three choices for that Company's employees.
Beside it is Disable social sign-in. If you require two-factor authentication, consider disabling social sign-in too: a social network may not ask for a second factor, and cannot be enforced by any settings here.
Then click Update.
Employee sign-in is Company-wide.
When two-factor authentication is required #
- The next time each administrator or employee signs in, they are asked to set up two-factor authentication, and can do nothing else until they have. Anyone already signed in is asked on the next page they open.
- After that, they are asked for a code each time they sign in.
- Changing from app or emailed code to app only asks anyone who uses emailed codes to set it up again with an authenticator app.
- Please communicate to your administrators and employees before making the change, so they can prepare, for example by installing an authenticator app.
Recent Logins #
Dashboards > Recent Logins shows who has signed in in the last 31 days, and helps those who cannot. It has two tabs.
Failed logins #
Failed Logins lists who has failed to sign in. After 15 failures a username is locked for 30 minutes: Reset unlocks it at once.
Successful logins #
Successful logins lists who has signed in, and how: with a password, with a password and an authenticator app or emailed code, or through a social network.
Reset beside a second factor takes it away, for someone who has lost their phone: they set two-factor authentication up again the next time they sign in. First make sure the request really comes from them.