Google Authenticator

Add a second factor, so a stolen password is not enough on its own.

Find it at Google Authenticator

With the authenticator switched on, signing in takes a six-digit code from the user's phone as well as their password. The code changes every thirty seconds and never travels over the network, so someone who has stolen a password still cannot get in.

This is the single most effective control here. Geo-fencing, sign-in hours and travel detection all narrow where and when a stolen password can be used; a second factor makes the password insufficient by itself.

On this page

Google Authenticator

On or Off for the account you are signed in as. Off means password only.

The account the code below belongs to — worth checking before you scan.

QR code

Appears once the setting is on. This is what you scan to enrol your phone.

Verify field

Enter a code from your app to confirm enrolment worked before you rely on it.

Enrolling your own account

1 Set Google Authenticator to On and save.
2 Install Google Authenticator, or any TOTP app, on your phone.
3 Scan the QR code that appears with that app.
4 Type the six-digit code it shows into the verify field to confirm it works.
5 From your next sign-in, enter a fresh code after your password.

Always verify before signing out

Use the verify field while you are still signed in. If the enrolment did not take and you only find out at your next sign-in, you are locked out of your own account and need another admin to switch it off for you.

Each person enrols their own account

The QR code on this page belongs to whoever is signed in, so a user sets up their own phone. As an admin you can require the authenticator for others from their user record or with Bulk Manage Users, but you cannot scan the code for them.

Enrol before you require it elsewhere

Impossible travel can be set to demand an authenticator code on a suspicious sign-in. Anyone not yet enrolled is refused outright in that situation, so enrol people first and turn on the requirement afterwards.

If someone loses their phone

Switch the authenticator off for that user, then on again: a new secret is issued and they can enrol the replacement device. There is no self-service route, which is deliberate — it would be an obvious way around the second factor.

The code is generated on the phone

TOTP codes are computed from a shared secret and the clock, so they work with no signal and never travel over the network. If codes are rejected consistently, the usual cause is the phone's clock drifting rather than a wrong secret.

The page above is how a person enrols their own phone. Requiring the authenticator for someone else is done on their user record.

Requiring it for a user

1 Go to Users → All Users and open the person.
2 On the Security card, set Enable Authenticator to On.
3 Tell them to open Google Authenticator in their own account and scan the QR code.
4 Confirm they have enrolled before relying on it — an unenrolled user is refused.

Enable Authenticator on the Security card of a user record. An admin requires it here; the person still enrols their own phone from the page above.

Rolling it out to everyone

Users → Bulk Manage Users can set Authenticator across a selection. Check the Security column on Users → All Users afterwards to see who is still not enrolled.