Two-step sign-in for one teammate

Use this for one person: to make two-step sign-in compulsory for them (for example, the person who handles refunds), or to reset it when they lost or changed their phone. To require it for everyone or for whole roles, see Require two-step sign-in for your team.

Before you start

• Your role needs Manage the team.
• Only an owner can change this for an owner.

Steps

Require it for one person

1. Open Team and roles → Team.
2. Open the menu at the end of the person's row.
3. Under Two-step sign-in, choose Require two-step sign-in. A tick shows it is on.

The message … must now use two-step sign-in appears. Choose it again to make it optional: Two-step sign-in is optional again for ….

You can do the same in Settings → Sign-in security with the Require for this person switch in the People table.

If the menu says Already required by the agency rule, the person must use it anyway. Your switch only adds a reason; turning it off does not remove the agency rule.

Reset it after a lost phone

1. In the person's row menu, choose Reset two-step (lost phone). Or press Reset on their row in Settings → Sign-in security.
2. Read the window Reset two-step sign-in for …? and press Reset.

The link to their authenticator app, their recovery codes and their remembered devices are removed, and they are signed out everywhere. The message says either Reset. … will set it up again at the next sign-in. (when it is required for them) or Two-step sign-in reset for ….

After the change

• A person you required it for, who has not set it up, sees the setup screen the next time they sign in or load a page, and cannot work until they finish. Their status shows Must set up.
• After a reset, the person signs in with their password only. If two-step is required for them, they set it up again on their new phone at once.
• Each change is written to the audit log, for example Two-step sign-in reset for ….

Recovery codes in short

• When someone sets up two-step sign-in, they get 10 recovery codes like K7QX5-M2PL9. They are shown once.
• If they lose their phone, they press Use a recovery code instead at sign-in. Each code works once.
• Sign-in security shows how many codes someone has left when it is 3 or fewer. Nobody else, owners included, ever sees the codes.
• They make a fresh set in My account with Make new codes. The old codes stop working at once.
• With no phone and no codes left, they need a reset from someone who manages the team (the steps above).

If something goes wrong

• Reset two-step (lost phone) is missing: the person has not set it up, or it is your own row. Change your own two-step sign-in in My account.
• Change your own two-step sign-in from My account: you tried to reset yourself.
• … has not set up two-step sign-in: there is nothing to reset.
• Only an owner can change this for an owner: ask an owner.