Two-factor sign-in
Set up an authenticator app, use "Remember this device", and what to do if you change phone.
Two-factor sign-in means that, as well as your password, you enter a 6-digit code from an app on your phone. Someone who learns your password still can't get in.
Your administrator may make it compulsory. If so, you're taken to the setup page the next time you sign in, and you can use the portal again as soon as it's done.
Setting it up
- Install an authenticator appMicrosoft Authenticator, Google Authenticator or any TOTP app.
- Open My settings → Two-factor sign-in → Set upA setup key is shown.
- Add the account in the appTap "Open in authenticator app" on your phone, or type the key in.
- Enter the 6-digit codeThen press Turn on.
- DoneFrom now on you'll be asked for a code after your password.
Remember this device
When you enter a code, you may see Remember this device for N days. Your administrator sets the number of days. Tick it on your own phone or laptop and you won't be asked for a code there until the time runs out.
- Don't tick it on shared or public computers.
- See and remove remembered devices under My settings → Two-factor sign-in → Remembered devices.
- Changing your password, or an administrator resetting your two-factor, forgets all your devices.
New phone or lost phone
Ask an administrator to Reset 2FA on your account (Admin → Users). Then sign in and set it up again on the new phone.
Engineers using "Sign in with Microsoft"
Microsoft sign-in already uses your Amax Microsoft 365 MFA. Your administrator decides whether that counts as two-factor for the portal. If it doesn't, and you have an authenticator app set up, you enter its code after Microsoft sign-in.
Before you can use "Sign in with Microsoft", link your account once: sign in with your password, open My settings and press Link Microsoft account. (Your administrator may instead let the first Microsoft sign-in link it by matching your email.)
For administrators
Admin → General → Security controls:
| Setting | What it does |
|---|---|
| Require two-factor sign-in for | Tick Administrators, Engineers / staff and/or Customer contacts. People in a ticked role must set up an authenticator before they can use the portal. |
| Microsoft sign-in counts as two-factor | Untick to make engineers also use an authenticator app after signing in with Microsoft. People already signed in with Microsoft are asked for their code on their next click. |
| Link Microsoft accounts by email on first sign-in | Off by default. When off, each engineer links Microsoft from My settings after signing in with their password, which proves it's really them. |
| Offer "Remember this device" | Turn the option on or off. Turning it off makes every remembered device ask for a code again straight away. |
| Remember for (days) | 1–365. Changes apply to devices remembered from then on. |
| Forget all remembered devices | Use this if a device may have been lost or compromised. |
All changes are recorded in the audit log. A change that makes signing in less strict asks for your password and is emailed to every administrator.