Require two-step sign-in for your team

Require two-step sign-in when you want a stolen password alone to be useless, for the whole team or for the roles that see money.

Before you start

• Your role needs Change settings.
• Turn on two-step sign-in for yourself first if the new rule covers you. The system refuses a rule that would lock you out.
• Each teammate needs a phone with an authenticator app: Google Authenticator, Microsoft Authenticator, Authy or 1Password.

Steps

1. Open your name at the top of the screen, choose My account and security, and check that Two-step sign-in shows On. If not, set it up there first (the same steps as your teammates below).
2. Open Settings → Sign-in security.
3. Under Who must use two-step sign-in?, choose Everyone in the agency or Only some roles.
4. For Only some roles, press each role that must use it, for example Owner, Manager and Finance.
5. Check the line above the buttons: how many people the rule covers and how many still need to set it up.
6. Press Save rule.
7. If some people have not set it up yet, the window Require two-step sign-in? tells you how many. Press Require it.

The message Sign-in rule saved and recorded in the audit log appears.

After you save the rule

• In the People table, people the rule covers show Everyone or Role under Why required. Those who have not set it up show Must set up, and the number in still need to set it up goes up.
• Each of them sees the setup screen the next time they sign in or load a page. They cannot use the app until they finish it.
• People who join later are covered too: they set it up right after they accept the invitation.
• To require it for one more person only, use the Require for this person switch: Two-step sign-in for one teammate.
• The change is written to the audit log, for example Two-step sign-in now required for everyone.

What each teammate sees

Instead of the app, the teammate sees Hi …, let's protect your account, the reason (for example Your agency requires it for everyone or Your agency requires it for your role) and three tiles: Your phone, Scan once and Save 10 codes. They do this:

1. Press Set it up now.
2. Open the authenticator app, tap Add (+) and scan the QR code. If the camera cannot scan, press Cannot scan? Type a key instead and type the key in the app.
3. Press I scanned it.
4. Type the six-digit code the app shows and press Turn on.
5. Save the 10 recovery codes with Download .txt, Copy or Print.
6. Tick I saved my recovery codes somewhere safe and press Continue to the app.

The app opens without signing in again. From then on, each sign-in asks for a code after the password. Sign out at the top leaves the setup for later, but the screen comes back at the next sign-in.

Setting it up from My account

Anyone can also do it before the rule reaches them: open the name at the top of the screen → My account and security → Set up two-step sign-in, then the same steps from the scan onwards, ending with Done. The card then shows On. While a rule requires it, Turn off two-step sign-in is not offered and the card says It cannot be turned off.

If something goes wrong

• A red note says This rule includes you, and you have not turned on two-step sign-in yet. Turn it on first so you are not locked out. Press Open My account, set it up, then save the rule again.
• Pick at least one role: you chose Only some roles without a role.
• A teammate sees That code is not right. Check the time on your phone and try the newest code.: the phone's clock is off or the code changed. Set the phone's time to automatic and type the newest code.
• Too many wrong codes. Try again in 15 minutes.: five wrong codes in a row lock code checks for 15 minutes.
• Start the setup again: the setup was interrupted, for example by a reset in the meantime. Start again and scan the new QR code.