Turn on two-factor sign-in

Two-factor sign-in asks for a six-digit code from an authenticator app after your password. It applies to password accounts; accounts that sign in with Microsoft single sign-on use their own two-factor setup.

Set it up

1. Open Profile (your avatar, top right) and choose Set up two-factor.
2. Scan the QR code with an authenticator app (Microsoft Authenticator, Google Authenticator, 1Password, Authy). If you cannot scan, type the key shown under the code.
3. Enter the six-digit code the app shows and confirm.
4. Save the recovery codes. Each one signs you in once if you lose your phone. They are shown only once.

Signing in

After your password, enter the current code from the app. A code works once, so if a sign-in fails, wait for the next code. No phone? Enter a recovery code instead; it is then used up.

Lost your phone or ran out of codes

• Still signed in somewhere: Profile → Manage two-factor → Get new recovery codes (needs your current password). Turn off two-factor is there too, unless your organization requires it.
• Locked out: ask an admin to Reset two-factor on your account in Analysts. You set it up again at your next sign-in.
• Wrong codes count toward the same lock as wrong passwords: 8 in a row lock the account, for longer each time. See Locked out.
• Turning two-factor off or making new recovery codes asks for your current password. After 5 wrong tries in 15 minutes you wait before trying again.

Two-factor lives on your Profile, next to your password and your notification choices.

For admins

• Require two-factor in Settings → General → Session security makes every password account enrol at its next sign-in. Until they do, they can only reach enrolment and sign-out.
• Analysts shows a 2FA badge for enrolled accounts. Reset two-factor in an analyst's editor removes their enrolment; it is audited.

Profile also holds your Time zone (see Choose your time zone), your picture and your notification choices.

For admins who run their own triage, turning on two-factor is one of the steps in the setup checklist.