Two ways to keep your account safe: two-factor authentication, which asks for a code from your phone when you sign in with your password, and Sign out everywhere, which ends every session at once if a device goes missing.
Two-factor authentication
With two-factor on, signing in with your password takes one more step: you also enter a 6-digit code from an authenticator app on your phone. Someone who learns your password still can't get in without your phone.
Two-factor is off until you turn it on. It applies to password sign-ins only. If your organization signs you in through single sign-on (Microsoft, Okta, Google and so on), your identity provider handles this step and you won't be asked for a code here.
Turn it on
- Open Profile Settings from the menu under your name.
- In Two-factor authentication, click Set up two-factor.
- Open an authenticator app (Microsoft Authenticator, Google Authenticator, 1Password, Authy or similar) and scan the QR code. On a phone, you can tap Open in an app on this device instead. Can't scan? Click Can't scan? Enter a key and type the key into the app.
- Enter the 6-digit code the app shows and click Turn on two-factor.
- Save your recovery codes. Use Copy or Download and keep them somewhere safe, like a password manager. This is the only time they're shown.
Signing in
Enter your email and password as usual. You'll then be asked for an authentication code: open your authenticator app and type the code shown for JAMS Incident Management. Each code works once and changes every 30 seconds.
The Android app asks for the code the same way. Setting up two-factor happens on the web.
Recovery codes
If you don't have your phone, click Use a recovery code on the sign-in screen and enter one of the codes you saved. Each recovery code works once. Profile Settings shows how many you have left. When you're running low, click New recovery codes to get a fresh set of 10. Your old codes stop working.
Lost your phone?
Sign in with a recovery code, then turn two-factor off and on again from Profile Settings to connect your new phone.
No recovery codes either? Ask an admin in your organization to reset your two-factor (see below). Then sign in with just your password and set it up again.
Turn it off
In Profile Settings, click Turn off and enter a current code from your app (or a recovery code). If your organization requires two-factor for admins, admins can't turn it off.
For admins
Require two-factor for admins
Open Notification Settings and find Sign-in Security. Tick Require two-factor for admins.
- Admins who haven't set it up yet are walked through setup the next time they sign in with a password, before they reach the dashboard.
- It only affects admins and only password sign-ins. Single sign-on and users who aren't admins are unaffected.
- You need two-factor on your own account before you can switch the requirement on. The card shows how many of your admins already have it.
Reset someone's two-factor
When a person has lost their phone and their recovery codes, open Users and click Reset 2FA next to them. A 2FA badge beside their last sign-in shows who has it on.
Resetting turns their two-factor off and signs them out on every device, in case whoever has the phone also has a session. They can then sign in with their password and set it up again.
Sign out everywhere
Left yourself signed in on a shared computer, or lost a laptop or phone? Open Profile Settings and click Sign out everywhere under Sessions. Every browser and the mobile app are signed out, this one included, and you sign back in as normal.
Admins can do the same for someone else: on Users, click Sign out next to the person.
Your alerts keep reaching you either way. Calls, texts and emails don't depend on being signed in, and Sign out everywhere leaves the Android app's alerts arriving on your phone; you just sign in again to use the app. (Signing out inside the app itself is different: that stops alerts going to that phone.)
A password reset also signs you out everywhere.