Two-factor authentication

Two-factor authentication (2FA) asks for a 6-digit code from an authenticator app after your password. Use this page to turn it on for your account, keep your recovery codes safe and turn it off when your company allows it.

Check whether 2FA is available

Your company decides whether 2FA is used at all. An administrator controls it in Admin > System Configuration > Security, on the Global 2FA panel; Sign-in security explains the modes.

Your profile shows Set up 2FA only when Global 2FA is on and your role allows you to manage your own 2FA. If you cannot see it, ask your administrator to turn Global 2FA on or to give your role the Require 2FA For Self permission.

If 2FA is required for your account and you have not set it up yet, sign-in walks you through the setup before you continue.

Turn on 2FA

Click your name at the bottom of the sidebar, then click Profile.
Click the Set up 2FA quick action. The Turn on two-factor authentication dialog opens.
Click Set up 2FA in the dialog to start. A QR code appears.
Scan the QR code with your authenticator app. If the app cannot scan it, click Enter Code Manually and enter the Setup key in your app; the hint reads "Enter this key in your authenticator app." Click Scan QR to go back to the code. The copy button next to the key copies it and shows a check mark.
Enter the 6-digit code your app shows. The form reads "Enter the 6-digit code from your authenticator app to enable 2FA." and submits as soon as the sixth digit is typed. You can also click Enable 2FA, which shows Enabling... while it works.
DataMind OS confirms with "Two-factor authentication is now enabled" and shows your ten recovery codes with "Save your recovery codes in a secure place before continuing."
Click Download to save the codes as a text file in your downloads folder, then click Done.

Important

Your recovery codes are shown only once. Save them somewhere only you can reach before you click Done.

Sign in with a code

When 2FA is on for your account, sign-in asks for a 6-digit code from your authenticator app after your password. If you cannot use the app, click Use recovery code? and enter one of your recovery codes, written as four groups of seven characters separated by dashes. Each recovery code works once.

The code step, and the setup that starts when 2FA is required for your account, are described in Sign in and sign out.

Regenerate recovery codes

Regenerate your codes when you are running low, or when you have lost them. A new set replaces the old one.

Open Profile and click Regenerate recovery codes. This action appears only when 2FA is on for your account.
Enter the 6-digit code from your authenticator app. The dialog reads "Enter the 6-digit code from your authenticator app to regenerate your recovery codes." and submits as soon as the sixth digit is typed; you can also click Regenerate (it shows Regenerating... while it works). A recovery code is not accepted here.
Save the new codes with Download, then click Done. The dialog reads "New recovery codes generated. Your previous codes no longer work."

If you sign in with your last recovery code, DataMind OS shows the Recovery codes exhausted dialog before you reach the app. It warns: "You have no recovery codes left. If you lose access to your authenticator app, you will be locked out of your account. Regenerate new recovery codes now, or contact an administrator if you are unable to do so." Click Regenerate recovery codes and follow the same steps. The dialog then reads "New recovery codes generated. Your previous codes no longer work. Save these before continuing." You can also close the dialog, continue and regenerate later from your profile.

Turn off 2FA

Open Profile and click Disable 2FA. The dialog is titled Disable two-factor authentication.
Click Disable 2FA. The dialog reads "Enter the 6-digit code from your authenticator app to disable two-factor authentication."
Enter the 6-digit code from your app and click Disable 2FA (it shows Disabling... while it works). If the form offers Use recovery code?, you can enter one of your recovery codes instead.

DataMind OS confirms with "Two-factor authentication has been disabled". Turning 2FA off also removes your recovery codes; if you turn it on again, you get a new set.

Permissions

What you want to do	What you need
Set up or turn off 2FA on your account	Global 2FA is on, and your role includes Require 2FA For Self, in the 2FA User or 2FA Manager bundle. Administrators who hold a general permission to edit users can do this too.
Regenerate your recovery codes	2FA is on for your account. No extra permission.
Reset another user's 2FA	Reset 2FA For Others. See Two-factor authentication for users.
Change the platform-wide mode	Manage Global 2FA. See Sign-in security.

Your profile lists the permissions you hold. For how roles and permissions combine, see Roles and permissions.

Limits and edge cases

When your company requires 2FA platform-wide, the dialog says "Two-factor authentication is required platform-wide and can't be turned off." and shows no disable button.
When an administrator requires 2FA for your account alone, the dialog still shows Disable 2FA, but turning it off is refused with "2FA cannot be disabled because it is required for your account."
A wrong code shows "Invalid TOTP code" when you set up, turn off or regenerate 2FA. At sign-in, it shows "Invalid 2FA code". The full message list is in Troubleshooting.
Regenerating recovery codes needs a code from your app; a recovery code is not accepted there. Turning 2FA off accepts either.
Each recovery code works once. When your remaining codes drop to 3, 1 or 0, DataMind OS emails you a warning, if your company has email set up.
If an administrator resets your 2FA, every session you have open is signed out and your recovery codes are removed. While Global 2FA is on, you set 2FA up again at your next sign-in. Administrators reset 2FA as described in Passwords, locks and limits for a user.

Questions, answered

I do not see Set up 2FA in my profile. Why?

Global 2FA is off, or your role does not allow you to manage your own 2FA. Ask your administrator to turn Global 2FA on or to give your role Require 2FA For Self, which is in the 2FA User and 2FA Manager bundles.

Which authenticator app can I use?

Any app that can scan a QR code or accept a setup key, and then shows 6-digit codes.

My code is always rejected. What should I check?

Codes depend on the time. Set your phone's clock to automatic time, then enter the code your app shows now. Enter the newest code straight away: a code stops working after a short time, and an older one is refused. If a code is refused, wait for the next one and enter it as soon as your app shows it.

Can I use a recovery code instead of my app code?

At sign-in, yes: click Use recovery code? and enter one of your codes. To turn 2FA off, choose Use recovery code? when the form offers it. To regenerate recovery codes, no; that needs a code from your authenticator app.

I used my last recovery code. What now?

The Recovery codes exhausted dialog opens when you sign in. Click Regenerate recovery codes and enter a code from your app. If you cannot do that, contact an administrator.

Do my old recovery codes still work after I regenerate them?

No. Once the new set is created, your previous codes stop working.

I lost my phone and my recovery codes. What now?

Ask an administrator with the Reset 2FA For Others permission to reset your 2FA. Your recovery codes are removed, and you set 2FA up again when sign-in asks.

Why can't I turn 2FA off?

Your company requires 2FA for everyone, or an administrator has required it for your account. DataMind OS refuses the change. Ask your administrator if you need it off.

Will I get a warning before I run out of recovery codes?

Yes, if your company has email set up. When your remaining codes drop to 3, 1 or 0, DataMind OS emails you.

Does 2FA apply when I sign in with SSO?

No. When you choose Sign in with SSO, DataMind OS does not ask for a code from your authenticator app; your identity provider runs its own sign-in checks.