Skip to content

Security for administrators: two-step sign-in and support access

Require two-step sign-in for the people who need it, and decide whether anyone from the platform team may look at your service.

Checked against the screens:

Every organisation can choose its own words for the people and roles it works with. When you are signed in, this guide uses your organisation’s words. Otherwise it uses the product’s own.

For admins. Two-step sign-in applies to admins and DSLs on the website. Support access is always your decision.

Steps

  1. Open Admin, then two-step sign-in. If you have not set it up yourself, press Set it up now first.
  2. If you set it up but signed in without a code, press Enter a code and type one.
  3. Check the list of who it applies to. Press Remind them for anyone not set up.
  4. When everyone has set it up, tick the box that you understand and press Turn it on.
  5. To switch it off, press Turn it off. Authenticators people set up stay set up.
  6. For support access, open Support access. Read anything under Waiting for your answer.
  7. To allow it, press Approve this request then Yes, approve it, or No, not now. Press End this now under Happening now to stop.

If it goes wrong

  • If the request was made by you, another administrator must approve it.
  • If you cannot turn on two-step, set up your own first so you cannot lock yourself out.
  • If this page cannot read your support record, do not approve anything until it can.

Two-step sign-in

When it is on, admins and DSLs type a six-digit code from an authenticator app after their password, whenever they sign in to the website. Everyone else signs in as now.

The tablet app does not ask for the code yet, so this covers the website only. A change reaches every open page within a minute.

Turning it on safely

Set it up for yourself first. The page then asks you to confirm everyone it applies to has set it up. A banner invites each person to do so.

If it ever blocks sign-in by mistake, contact support. It can be switched off platform-wide without touching anyone's authenticator.

Support access

Nobody from the platform team can look at your service unless an administrator says so. This is where you say so, and where you can stop it.

They can only read. An approval lasts an hour at most and cannot be extended. The person who asked cannot approve their own request.

Reading the page

Waiting for your answer shows each request with the reason. Leaving it alone is an answer. Happening now shows access in progress. Below, the history says who approved or ended each one.

How it links together

Two-step status shows on each person's task list as a reminder, and banners follow them until it is done. Support requests and every approval are recorded and shown in the history.

See the guides on setting up two-step sign-in, on your tasks and on the audit log.

Requiring two-step sign-inYou set up first, remind the others, then turn it on for the website.
  1. You set up
  2. Others remindedRemind them
  3. Switched onTurn it on
  4. Code at sign-inWebsite only

Questions people ask

Does two-step apply to everyone?

No. It applies to admins and DSLs. Anyone else can set it up early.

Can the platform team see my data without asking?

Not through this route. They ask and an administrator approves.

How long does an approval last?

At most an hour, and it cannot be extended.

Someone lost their phone.

They contact support, who check it is them and reset it.

Does the tablet ask for a code?

Not yet.