Why 2FA?#
With two-factor authentication (2FA) on, signing in to EJO asks for the 6-digit code from your authenticator app after your password. A stolen password alone is no longer enough to get into your account.
2FA is for accounts that sign in with a password. For accounts that use company SSO or sign in with Google or GitHub, the identity provider owns the second factor. See Google and GitHub sign-in.
Prerequisites#
- An authenticator app such as Google Authenticator, Microsoft Authenticator, Authy or 1Password.
Turn on 2FA#
- Open the Account page next to your username at the bottom left.
- On the Two-factor authentication card, press Set up authenticator app.
- Scan the QR code with your authenticator app. If you cannot scan it, enter the key shown into the app by hand.
- Enter the 6-digit code the app shows.
- EJO shows you 10 recovery codes. Save them somewhere safe or download them, then press I saved them.
Warning: Recovery codes are shown only once. Each one works once if you lose your phone.
Sign in with 2FA#
After your username and password, enter the 6-digit code from your authenticator app. If your phone is not at hand, you can use one of your recovery codes instead.
Wrong codes count like wrong passwords: after 10 failed attempts the account is locked for 15 minutes.
Renew recovery codes#
Create new codes on the Account page generates a new set of 10. You need to enter a code from your authenticator app or a recovery code. The old recovery codes stop working. The card also shows how many codes are left.
Turn off 2FA#
On the Account page, press Turn off and enter a code or a recovery code. If your organization requires 2FA, you cannot turn it off.
A user who lost their phone#
For a user who has no recovery code either, an admin uses Reset 2FA on the Users page. The user's sessions end and they can sign in with their password. If 2FA is required, they are asked to set it up again at their next sign-in.
Require it for the whole organization#
- As an admin, first turn on 2FA for your own account. The setting cannot be saved until you do, so nobody can lock the organization out.
- On Settings > Security, turn on Require two-factor authentication.
- Press Save security policy.
Once it is on:
- Password accounts without 2FA are signed out. At their next sign-in they see a QR code after their password and set up 2FA.
- Users cannot turn 2FA off themselves. An admin reset still works.
- Accounts that use company SSO or sign in with Google or GitHub are not affected.
Only admins can change this setting.