Sign up

Require a second step

On Security, Require two steps is off until you turn it on. Off, an email code is enough. On, everyone needs a second step.

Open Security. The section is Require two steps. The switch saves at once and the section says Saved.

Off and on

The note is Off: an email code is enough. On: everyone needs a second step. Google, Microsoft or SSO can satisfy both steps unless you require a separate company second step. Otherwise, people use an accepted passkey, authenticator app or phone code, subject to the settings here. An emailed code alone is one step.

Right now says A second step is optional. or A second step is required. With the separate-step box clear, it also says Google, Microsoft or SSO can satisfy both steps when available. With that box checked, it says Google, Microsoft and SSO also need a separate company second step.

Which second steps count

  • Open Which second steps this company accepts, and whether SSO needs a local second step.
  • The boxes are Passkey and Authenticator app. Clearing the last one does not save. The section says At least one second step has to be accepted.
  • Require our own second step even after SSO means Google, Microsoft and single sign-on still need a passkey, authenticator app or phone code afterwards.
  • Each person adds their own under the user menu, Sign-in & security: Add an authenticator app or Add a passkey. With none, and with this switch off, that page says You haven't added a second step. You can keep signing in without setting up an authenticator app or passkey.

Phone codes

Phone codes starts on. The note is On: people can get a code by text, RCS or a call as their second step. Passkeys and authenticator apps stay the safer choice. While it is on, Administrators use a passkey or authenticator app can be turned on. That note is On: administrators can't use phone codes, because a number can be moved to another SIM. It starts off. Turning Phone codes off hides that row.

Who has one set up

  • While Require two steps is on, the section counts people. The table Second-step setup has Second step set up and No second step set up.
  • Names with none are listed, then Sign-in access also depends on the company policy and sign-in method.
  • See on People opens People.

Check again before risky changes is a different switch on the same page. Its note is Studio asks people to confirm it's them, then not again for 15 minutes. It does not replace Require two steps.