Account security and two-step verification

Open Account at the top of the service desk to see when you last signed in, change your password, and manage two-step verification.

Changing your password

Enter your current password and the new one. Every other signed-in device is signed out, and you receive an email saying the password changed. If you did not change it, reset it at once with Forgot password.

Turning on two-step verification

Two-step verification asks for a 6-digit code from an app on your phone after your password, so a stolen password alone is not enough. Any standard authenticator app works: Google Authenticator, Microsoft Authenticator, 1Password, Authy and others.

1. Open Account and select Turn on two-step verification.
2. Scan the QR code with your app. If you cannot scan it, type the key shown under it.
3. Enter the code the app shows and select Turn on two-step verification.
4. Save the 10 recovery codes shown next, for example in your password manager. They are shown only once.

Recovery codes

If you lose your phone, sign in with a recovery code instead of the app code (Use a recovery code instead). Each code works once. Account shows how many you have left, and you can make a new set at any time. Making a new set cancels the old codes.

Turning it off

You can turn two-step verification off in Account with your password and a current code, unless your admin requires it for staff.

Requiring two-step verification for staff (admins)

Refresh sign-in security retries a failed settings load and confirms saved values after a policy change. Failed reset requests keep the email address you entered and show an error. If a reset cannot be confirmed, refresh and check the account before retrying.

Under Settings › People & access › Sign-in security an admin can require two-step verification for every admin and agent. Requesters are never required to use it.

• You must turn it on for yourself first, so you cannot lock yourself out.
• When you switch it on, staff without two-step verification are signed out. At their next sign-in they are taken through the setup before they can continue.
• The change is recorded in the audit history.

Resetting someone's two-step verification (admins)

If a person lost their phone and their recovery codes, select Reset two-step next to them in Sign-in security. For a requester, enter their email under the list. They are signed out everywhere and get an email saying an admin reset it. The reset is recorded in the audit history. You cannot reset your own: use Account for that.

Security emails

You always receive an email when your password is set or changed, and when two-step verification is turned on or off. These emails cannot be switched off.