Turn on two-factor sign-in (2FA)

Two-factor sign-in adds a second step next to your password: a six-digit, constantly changing code from an authenticator app. If your password ever leaks, your account still cannot be entered without your phone. You can switch it on for any account; the administrator account is your organisation’s most powerful access, so that is where it matters most.

Before you start

Account: any — the set-up page is available to every user.
Device: an authenticator app on your phone — Google Authenticator, Microsoft Authenticator, Authy, 1Password: any TOTP app works.

Steps

After signing in, open the “Account” page and follow the link on the “Two-factor authentication (2FA)” card.
“Scan with your authenticator app” — scan the QR code with your app. If scanning does not work, enter the key shown below the QR code manually (“If you cannot scan it, enter this key manually:”).
“Enter the 6-digit code shown by the app” — the page “Submits automatically after the last digit.”
“Save your recovery codes” — store the 10 single-use codes somewhere safe (a password manager). “They are shown for the last time now — if lost, generate a new set.”
Click “Continue →” — done, the app works as usual.

If it worked

The set-up page shows: “Two-factor authentication is ON for this account.” — with the time it was enabled and the number of usable recovery codes. From now on, after your password every sign-in shows the “Two-step verification” page asking for the app’s current six-digit code (“Enter the 6-digit code from your authenticator app.”); the “Use a recovery code instead” link lets you redeem a recovery code instead. Turning it on and off leaves an audit trail.

Common problems

What you see	Why	What to do
“Invalid code.”	The app’s code changes every 30 seconds — it expired, was mistyped, or your phone’s clock is off. The same code is never accepted twice.	Wait for the next code and enter it fresh; check that your phone’s clock is set automatically.
“Too many failed attempts. Please try again in a few minutes.”	The guessing protection kicked in.	Wait a few minutes and try with a fresh code.
“The code was not accepted — it is invalid, or you have just used it (wait for the next one).”	“Reset MFA” and “New recovery codes” ask for a fresh second factor; the code you just signed in with no longer works here.	Wait for the app’s next code (30 seconds at most), or enter an unused recovery code.
I lost my phone	Only that device produces the TOTP code.	Sign in with a recovery code, then on the set-up page enter a different, unused recovery code in the field and click “Reset MFA”; then set it up again with the new phone. If you have no recovery code either: ask your organisation’s administrator to reset your two-factor on the Control panel → Sign-in security tab (see below).
I ran out of recovery codes	Each works only once.	While you can still sign in with the app code: on the set-up page enter the app’s current code in the field and click “New recovery codes” — the old ones become invalid immediately.

Worth knowing

Turning it off is yours, the obligation is your organisation’s. “Reset MFA” turns two-factor off on your account, and we send a notification to your account’s e-mail address (if it was not you, you will know at once) — but if it is mandatory for you, the system immediately takes you to set it up again (the protection cannot be dropped, only moved to a new device).
The two weakening actions ask for a fresh code. “Reset MFA” and “New recovery codes” only run with the app’s current code (or a recovery code) — so a hijacked session cannot switch two-factor off or obtain new recovery codes.
Your setting does not affect how colleagues sign in — two-factor is per account. Anyone who has set it up is asked for the code at sign-in even if it is not mandatory for them. For a newly created organisation, administrator two-factor is required by default.

If you set your organisation’s policy

The Control panel → Sign-in security tab belongs to the administrator (or to whoever was given the “Two-factor policy” right in the permission matrix — e.g. the security officer).

Who must use it? You choose one of three levels: Nobody · Administrators · Everyone. Next to it you also see the “OPEREX minimum”: the policy in effect is the stricter of the two, and a level below the minimum cannot be chosen (“Not available: the OPEREX minimum is stricter.”). Every level shows how many colleagues it would redirect to set-up — you see who is affected before saving.
Tightening: save with the “Make it mandatory: …” button. Affected users who have not set it up are taken to the set-up page on their next page load; if it becomes mandatory for you too, so are you — the page warns you in advance.
Lowering: the “Lower it to: …” button asks for a fresh code from your own authenticator app (or a recovery code) — so you need two-factor set up yourself.
A colleague lost their phone: in the “Colleagues’ two-factor status” list, the “Reset” button next to their name deletes their set-up (it asks for your own code). The colleague’s existing sign-ins are ended (including the one on the lost phone) and they receive a notification e-mail. Their next sign-in works without a code, and if it is mandatory for them, they are redirected to set it up again. An administrator’s two-factor can only be reset by an administrator; your own cannot be reset here (switch it off on the Account page).
It is not worth making it mandatory for everyone everywhere: on a shared control-room terminal, or for colleagues without a company phone, a personal authenticator app can be a practical obstacle — that is what the “Administrators” level is for.
Session length: on the same tab you set how long a sign-in stays valid: 4 · 6 · 8 · 10 · 12 · 13 hours (8 by default). For 12-hour shifts choose 12 or 13 hours so nobody is signed out mid-shift. The time starts at sign-in; using the app does not extend it. The change applies immediately to people already signed in, counted from their own sign-in time. Lengthening asks for a fresh code from your own authenticator app; shortening does not.
Every policy change and reset leaves an audit trail.

Account settings: name, password and languageThe rest of your account settings — the two-factor card lives here too.