Enable two-factor authentication

Require a time-based code in addition to your password when you sign in.

1. Open the account menu, select Account settings, then open Account security.

2. Under Authenticator app, select Set up authenticator.

3. Enter your Current password, then select Continue.

4. Scan the QR code with a TOTP authenticator app.

5. Save every recovery code in a secure offline location. They are shown only once.

6. Enter a new authenticator code and select Confirm.

Caution

Each authenticator code and recovery code can be used only once. Use Regenerate recovery codes if you lose the saved set.

What you should see: the Authenticator app card says Two-factor authentication is enabled.

Instance two-factor policy

Instance admins can require two-factor authentication for everyone. Open Instance administration, then Security.

1. Under Who must use two-factor authentication, choose Nobody, Instance admins, Instance admins, owners and admins, or Everyone.

2. Set Grace period in days (0 to 30). People without two-factor authentication can keep signing in during the grace period, then must enable it. Recovery codes remain the recovery path.

3. Select Save policy.

To excuse one person, use Two-factor exemptions: pick the User, enter a Reason (up to 500 characters), optionally set Expires (optional), then select Grant exemption. Use Remove exemption to end it. Changes are audited.

Caution

A policy with no grace period is refused if no enabled instance admin would still be able to sign in, because that would lock everyone out.

Related

• Manage team roles
• Invite users
• Use the instance admin console
• Review the audit log