Two-step sign-in
Set up an authenticator app, keep recovery codes safely, and recover access when a phone is lost.
Contents
Two-step sign-in asks for your password and then a six-digit code from an authenticator app, such as Google Authenticator or Microsoft Authenticator. An administrator first enables the portal policy under Settings > People & access. When that policy is off, people who have not enrolled cannot set it up themselves. See People and access for account administration.
Ask everyone to use it
Under Two-step sign-in for everyone, an administrator selects Ask everyone to use it. Tell people how to obtain an authenticator app and where to keep recovery codes before changing the policy. This changes how people sign in; it does not install an app on their phones.
After their password, people without two-step sign-in are asked to set it up. Skip for now is available until seven days after they were first asked. After their deadline, setup is required. Existing phone sessions can ask people to sign in again when the policy starts applying and when their grace period ends.
Set up your authenticator
- Follow the setup prompt, or open My account > Two-step sign-in when offered.
- Enter your Current password and select Set up two-step sign-in.
- In your authenticator app, add an account and scan the displayed QR code, or enter its Key manually. Do not share the QR code or key in screenshots or support messages.
- Enter the app's six-digit Code and select Turn on.
- Under Save your recovery codes, keep the ten codes securely. They are shown only now, and each works once.
Keep recovery codes somewhere you can access if the phone is lost. The authenticator setup QR code is a secret; it is different from a QR code used to connect the Kalytera mobile app.
Sign in afterwards
Enter your email and password, then the current code from the authenticator. If it fails, check you chose the correct account and use a current code. If setup or sign-in took too long, start again. Repeated wrong attempts can temporarily lock the account; follow the message instead of repeatedly submitting codes.
A browser session authenticated with two steps ends eight hours after sign-in. The Kalytera mobile app also asks for the code when signing in with email and password; an account with two-step sign-in cannot set up a phone from a QR code instead.
Recover access
At the code prompt, select Use a recovery code instead and enter an unused Recovery code. After signing in, My account > Two-step sign-in > Make new codes generates ten replacements after confirmation with your password and an app or recovery code. All previous recovery codes stop working.
If you lose both the authenticator and recovery codes, contact an administrator. They can turn off two-step sign-in for your account from its People & access page; while the portal still requires it, you must set it up again. If no administrator can sign in, contact Support; do not send passwords, keys or recovery codes.
Turn it off only when permitted
You cannot turn it off yourself while the portal asks everyone to use it. Once the administrator stops asking, an enrolled person can select Turn off on their two-step page and confirm with their password and a code. This removes the authenticator key and recovery codes. Enabling it again needs a new setup.