Two-factor authentication

Two-factor authentication adds an authenticator code to your sign-in. You can turn it on yourself, and in some cases it is required of you.

Turning it on yourself

Go to “Settings”, then “Security”. The card is headed “Two-factor authentication”.

Scan the code with an authenticator app, type the six-digit code it gives you, and press “Verify & enable”. The card then reads “Two-factor authentication is enabled”.

You are given recovery codes at the same time. Keep them somewhere other than the phone holding the authenticator, because they are what gets you in when that phone does not.

Managing it afterwards

The same card offers “Regenerate recovery codes”, which needs a current six-digit code, and “Disable two-factor authentication”, which will accept either a current code or your account password.

When it is required of you

Two-factor authentication can be required rather than chosen. That can come from a platform-wide policy or from a policy on your own account. When it applies, the card says so.

There are two shapes this takes.

At sign-in. If a policy applies and you have no authenticator set up, sign-in stops and hands you an enrolment screen instead. No session is created until you finish. This is not an error and retrying will not clear it: set up the authenticator and you are through.

Inside the app. If a policy applies and your current session predates it, the app holds you on a setup prompt rather than letting you into a shell where every action would be refused. Setting up the authenticator, or signing in again with your code, clears it.

If you are locked out

Use a recovery code at the sign-in prompt. If you have neither your authenticator nor a recovery code, contact support from the address on your account. Nobody in the app can bypass the check for you.