Two-factor sign-in

Two-factor sign-in means a stolen password alone is not enough to get into an account. Every person can turn it on for themselves, and you can require it for your team or for everyone who signs in through your tenant.

The two kinds of second step

• A passkey. The person confirms it’s them with their device’s fingerprint, face or PIN, or with a security key. A passkey works in two ways:

  • On its own, with Sign in with a passkey and no password. This counts as two-factor sign-in: the device proves who it belongs to, and the fingerprint, face or PIN proves who is holding it.
  • After the password, as the second step. A touch is enough here, because the password was the first step.

  A passkey works only on the tenant address it was created on.

• An authenticator app. After the password, the person enters a six-digit code from an app such as Microsoft Authenticator or Google Authenticator.

The first passkey or authenticator app a person adds turns two-factor sign-in on for their account, even when you don’t require it. From then on, their password alone no longer gets them in. They also get ten single-use recovery codes for the day they lose their device.

People manage both themselves: the Sign-in & security entry in the Provision Portal’s account menu, or Profile → Manage sign-in in the end-user portal, opens the page where they add or remove passkeys, set up the authenticator app, and replace their recovery codes. Adding or removing one asks for the account’s password, and every change sends the person a Sign-in methods changed email, so a change they didn’t make doesn’t go unnoticed.

Require it

Choose who must use two-factor sign-in under Settings → Two-factor sign-in. (Admin)

Setting	Who must use it
Optional	Nobody. Each person decides for themselves. This is the default.
Required for your team	Everyone with a role in the Provision Portal: administrators, sales, support and viewers. Your customers’ end-user portal accounts stay optional.
Required for everyone	Your team and every customer who signs in to the end-user portal.

The setting applies at once. People already signed in with only a password are asked to sign in again the next time a portal renews their sign-in. Someone who must use two-factor sign-in and has not set it up is asked to add a passkey or an authenticator app right after their password, before they reach the portal.

Applications that sign people in with a username and password directly, without the sign-in page, cannot ask for a second step. They are refused for anyone who must use two-factor sign-in, so move them to the sign-in page or to machine credentials first. See API credentials.

When someone loses their device

A person who still has a recovery code signs in with it from the log in with a recovery code link and adds a new passkey or authenticator app. Someone with no recovery code left needs an administrator:

1. Open Customers → Users and find the person.
2. From the row’s menu, choose Reset two-factor sign-in… and confirm. (Admin)

The reset removes their authenticator app, recovery codes and passkeys, and signs them out everywhere. If two-factor sign-in is required for them, they set up a new second step the next time they sign in. They get a Sign-in methods changed email either way.

Five wrong authenticator codes in a row lock the account for five minutes. After 100 wrong codes in a row the authenticator app stops being accepted until the person signs in with a recovery code or a passkey, or an administrator resets their two-factor sign-in.

Next

• People and roles → Set up your account & team
• Every email the platform sends → Emails the platform sends