Security and two-factor authentication

Settings › Security is where you look after your own account. It has four cards: Two-factor authentication, Password, Connected sign-in methods and Sessions.

These settings are personal: they apply to your account in every organisation you belong to.

Confirming it's you

Sensitive changes on this page (changing your password, turning two-factor authentication on or off, revoking sessions, and connecting or disconnecting a sign-in method) may ask you to verify yourself again first. You see Confirm your password, or Confirm it is you if two-factor authentication is on. Enter your password or a current code and click Confirm.

Change your password

1. Go to Settings › Security.
2. In the Password card, enter your Current password.
3. Enter a New password of at least 12 characters. The meter shows how strong it is.
4. Type it again in Confirm new password.
5. Click Change password.

You see Password changed. Every other session of your account is signed out; you stay signed in on this device.

Forgotten your current password? Sign out and use Forgot your password? on the sign-in page. See Create an account and sign in.

Set up two-factor authentication

Two-factor authentication adds a second step to signing in: a 6-digit code from an authenticator app on your phone, such as 1Password, Google Authenticator or Authy.

1. Go to Settings › Security.
2. In the Two-factor authentication card, click Set up two-factor authentication.
3. Scan: open your authenticator app and scan the QR code. If you can't scan it, type the key shown (without the spaces) into the app instead; Copy key copies it. Click Next.
4. Verify: enter the 6-digit code your app now shows for IconEngage and click Verify and enable.
5. Recovery codes: you see Two-factor authentication is on and a list of recovery codes. Click Copy codes or Download and store them somewhere safe, away from your phone.
6. Click Done.

The card now shows On. From your next sign-in, you'll be asked for a code after your password.

To use a recovery code, click Use a recovery code instead on the two-factor sign-in screen.

If your organisation requires two-factor authentication

Some organisations require every member to use two-factor authentication. If yours does and you haven't set it up, IconEngage takes you to Settings › Security after you sign in and shows Your organisation requires two-step verification — set it up to continue. Set it up as above to carry on.

Turn off two-factor authentication

1. In the Two-factor authentication card, click Turn off two-factor authentication.
2. Read the warning: signing in will need only your password, and your recovery codes stop working.
3. Click Turn off, then enter a current code when asked.

Connected sign-in methods

This card lists the ways you can sign in: your Password and, if available, Google and Facebook.

• Connect links your Google or Facebook account, so you can use Continue with Google or Continue with Facebook on the sign-in page.
• Disconnect removes that link.

Keep at least one way in. You can't disconnect your only sign-in method: you see This is your only way in. Set a password or connect another account first.

If you signed up with Google or Facebook, your password shows as Not set. Click the set a password link: it opens the password reset page, which emails you a link to choose one. That gives you a second way in.

If you only sign in with Google or Facebook, you're asked to sign in again with that provider before connecting or disconnecting. You then have 5 minutes to make the change.

Sessions

The Sessions card lists every device and browser where your account is signed in, with its IP address, when it was last active and when it signed in. The current one is marked This device.

• Click Revoke next to a session to sign that device out immediately.
• Click Sign out everywhere else to sign out every session except this one.

Do this if you've signed in on a shared or lost device, or if you see a session you don't recognise (and then change your password).

What's recorded

Password changes, two-factor changes, recovery code use and revoked sessions are recorded in the organisation's audit log. See Audit log.