Skip to content

Set up two-step sign-in

Add an authenticator app, keep your recovery codes safe, enter a code at sign-in and replace a lost phone.

Checked against the screens:

Every organisation can choose its own words for the people and roles it works with. When you are signed in, this guide uses your organisation’s words. Otherwise it uses the product’s own.

For anyone who signs in. Two-step sign-in asks for a six-digit code from an app on your phone after your password.

Steps

  1. Install an authenticator app on your phone, such as Microsoft Authenticator or Google Authenticator.
  2. Open Settings, then Security, then Two-factor authentication. Choose the link to set up two-step sign-in.
  3. On the setup page, press Set it up. Scan the picture with your app, or type the key shown under it.
  4. Type the six-digit code your app shows, then press Finish.
  5. Copy the recovery codes into a safe place away from your phone. Then press Continue.
  6. Next time you sign in, type the current code on the code page and press Verify.

If it goes wrong

  • If the code is refused, wait for the next code and try again. Check your phone's clock is correct.
  • If you lose your phone, ask support to check it is you and reset your two-step sign-in.
  • If you cannot finish now, press Sign out and come back to it.

How it links together

Your authenticator is stored against your sign-in, not your profile. Setting it up clears the reminder on your task list and the banner at the top of the page.

Your admin sees on the two-step page whether you have set it up. See the guides on signing in and on security for administrators.

Setting up and using two-step sign-inSet it up once, then type a code every time you sign in on the website.
  1. App installed
  2. ScannedSet it up
  3. Codes savedRecovery codes kept safe
  4. Code at sign-inVerify

Why you are asked

Your organisation can ask admins and DSLs to use two-step sign-in on the website. If it does, you are sent to the setup page the next time you sign in, and you carry on once it is done.

Anyone else can set it up early. A banner invites you to, and you can dismiss it for a day. It takes about two minutes.

Setting it up

Open the app, add an account and scan the picture on screen. If you cannot scan, open the line that offers the key and type the key into the app instead.

Setup is not finished until you type a code and press Finish. Seeing the picture alone does not turn it on.

Recovery codes

You are shown recovery codes once, at the end of setup. Save them somewhere safe, away from your phone. Do not put them in a record, an email or a shared screenshot.

You can make a new set at any time from Recovery codes on the two-step page. Press Make new recovery codes. Any codes you had before stop working, and the new ones are shown only once.

Signing in with a code

After your password, the code page asks you to open your app and type the current code. Press Verify. A code lasts a short time, so type the one on screen now.

If you landed here by mistake, press Sign out and start again.

Managing your authenticators

Open Two-step sign-in under Security. Your authenticators lists each one with the date you added it. Choose Remove to take one off.

Before you change phone, choose Set up another (for example, on a new phone). Add the new one first, then remove the old one.

What two-step covers today

Two-step sign-in covers the website. The tablet app does not ask for the code yet. Your admin can see who has set it up.

Questions people ask

Which app should I use?

Any authenticator app works. Microsoft Authenticator, Google Authenticator, 1Password and Authy are all fine.

My code is not accepted. What now?

Wait for the next code and try again. Check your phone's date and time are set automatically.

I lost my phone. How do I get in?

Contact support. They check it is you and reset your two-step sign-in. Then set it up again on the new phone.

Where do I find my recovery codes again?

They are shown once. Make a new set with Make new recovery codes. The old codes then stop working.

Can I use it on two phones?

Yes. Choose Set up another (for example, on a new phone) and scan the new picture.

Does the tablet app ask for a code?

Not yet. Two-step sign-in applies to the website for now.

Can I turn it off for myself?

You can remove an authenticator. If your organisation requires two-step sign-in, you will be asked to set one up again.