Two-factor sign-in
With two-factor sign-in, signing in needs your password and a six-digit code from an authenticator app on your phone, such as Google Authenticator, Microsoft Authenticator or 1Password. Someone who learns your password still can’t get in.
Requiring it for your staff
Two-factor sign-in is required for everyone in your business to start with. Change this in Settings > Security:
- Require two-factor authentication for staff: on or off.
- Grace period: how many days staff have to set it up after it’s first required. The days start from each person’s first sign-in after that.
Customers signing in to the portal never need it.
Setting it up
When it’s required, you are asked to set it up the next time you sign in. You can also do it yourself from Account security in the menu under your initials:
- Click Set up two-factor and enter your password.
- Scan the QR code with your authenticator app.
- Enter the code it shows.
- Save your backup codes somewhere safe. Each one works once if you lose your phone.
New phone?
In Account security, use Move to a new phone. You need your password and a code from your old phone or a backup code. Run out of backup codes? Use Generate new backup codes.
Sign-in alerts
Everyone gets an email when their account is signed in to from a new device or a new country. The email is sent as soon as the password is accepted, so you hear about it even if two-factor sign-in stopped them.
If it wasn’t you, click Secure my account in the email. This changes your password to a random one, signs you out everywhere and sends you a link to choose a new password.
Your devices and sign-in history
Account security also shows:
- Devices signed in to your account now, with their location
- your sign-in history for the last 90 days
Click Sign out of all other devices if you see one you don’t recognise, or after using a shared computer. Changing your password also signs out your other devices.