Two-factor authentication and open sessions

Two-factor authentication adds a second factor to the password: a code shown by an authenticator app, or a 6-digit code received by email. This article explains how to turn it on for yourself, how to require it for the members of a role, how to manage an employee’s methods, and how to close the sessions open on an account. It is for employees and administrators alike.

Before you start #

• For yourself: no permission is needed to turn your two-factor authentication on or off. Your account page opens from your profile (My Profile), ⋮ menu, Manage account. This entry only appears for roles holding the “View an employee’s account status (access, invitation, last sign-in)” permission, given by default to administrators and HR managers. Other employees set up two-factor authentication at sign-in, when their role requires it.
• Requiring two-factor authentication for a role: the “View role cards” permission to read the screen, “Create a new role” at the Execute level to tick a box (Roles & permissions menu of the matrix).
• Managing an employee’s two-factor authentication: the “Manage an employee’s two-factor authentication (view, disable, regenerate)” permission (Employee management, Employee actions section). The Access level lets you see their methods, the Execute level lets you act. Permissions are set in Settings › Manage Employees › Employee Roles (see Permissions & roles).

Turning on two-factor authentication for yourself #

1. On your account page, open the Two-factor authentication tab. Two lines appear, Authenticator app and Email code, each with its Enabled or Disabled badge.
2. Click Set up on the line you want. The Two-factor authentication page opens on Pick your method: choose, then click Continue (or Skip for now to do it later).
3. App: click Show QR code, scan it with your app (Google Authenticator, Authy, 1Password…) or enter the Manual key. Type the 6-digit code shown, then Verify & enable.
4. Illizeo then shows 10 recovery codes, only once. Click Download codes, store them somewhere other than your phone, tick “I have saved my recovery codes somewhere safe.” and click I’ve saved them.
5. Email code: confirm your current password, click Send me a code, enter the code you receive, then Verify & enable.

If both methods are active, Set as preferred chooses the one asked for first at sign-in; it then shows “· Preferred”.

At sign-in #

After the password, or after a sign-in link received by email, the 6-digit code screen appears:

• with the app, enter the code shown, which refreshes every 30 seconds;
• by email, enter the code sent to your address (masked on screen). It expires after 5 minutes; Resend code sends a new one;
• Use authenticator app, Use email code and Use a recovery code switch method. A recovery code works only once.

Click Verify and sign in.

Recovery codes and turning off #

• Regenerate recovery codes (app method): confirm with your password, then Generate new codes. The old codes stop working; the new ones are shown only once, with Download codes.
• Disable the app: enter your password and a current code from the app, then Confirm disable. Your recovery codes are deleted.
• To remove the email code, ask an administrator (see below).

Requiring two-factor authentication for a role #

1. Open Settings › Manage Employees › Security. The Two-factor enforcement card lists the roles, in the colours of the roles screen.
2. Tick Require 2FA on the role’s line. It is saved at once and a message confirms it.

At their next sign-in, a member of this role without two-factor authentication sees the “Set up two-factor” screen. Under Choose your method, they choose Authenticator app (scan the QR code, enter the code, Confirm and sign in) or Email me a code instead. With the app, they save their recovery codes, tick “I have saved these codes somewhere safe.” and click Continue. Until they have set it up, they cannot get in.

Unticking the box lifts the requirement. Members who had only set up two-factor authentication because it was required lose it and receive an email; those who had turned it on themselves keep it. The confirmation message says how many people are affected.

The requirement applies to sign-in by password and by email link. For single sign-on (SSO), the second factor is a matter for your identity provider.

Managing an employee’s two-factor authentication #

1. Open the employee’s profile, ⋮ menu, Manage account, Two-factor authentication tab.
2. You see their methods and preferred method. You cannot turn them on for them: the line says “The employee must set this up themselves.”
3. At the Execute level: Set as preferred, Regenerate recovery codes (the new codes are shown to you, to be passed on securely) and Disable. These actions are confirmed without a password; disabling the app also deletes their recovery codes.

The employee receives the “Two-factor authentication was removed from your Illizeo account” email, which names you. On your own account, these actions do not go through this tab: use your account page, which asks for your password.

Open sessions #

• For yourself: the Open sessions tab (“Your open sessions”) lists the devices signed in to your account, with their IP address and last activity; yours shows “This session”. Close signs a device out; Sign out everywhere else, confirmed with Close all, closes all the others.
• For an employee: with “View an employee’s account status…”, the tab lists their sessions. At the Execute level, Close all access signs them out everywhere, including from an administrator consultation in progress; they will have to sign in again.

Security alerts #

• “New sign-in to your Illizeo account”: sent when an account signs in from a device and IP address pair never seen before, with the device, address and date.
• “Two-factor authentication was removed from your Illizeo account”: sent to the holder each time a method is removed, by themselves, by an administrator or when a requirement is lifted, with the method still active.

These emails are always sent: your company cannot turn them off.

Good to know #

• A new email code can only be requested once a minute.
• Avoid giving the same role “Manage an employee’s two-factor authentication” and “Set an employee’s password directly”: together, these two permissions make it possible to get into any account.
• Sign-ins are recorded in the user logs: see Governance & security.

FAQ #

I have lost my phone. #

At sign-in, click Use a recovery code, or Use email code if the email code is active. With neither, ask an administrator to disable your app, then set it up again on your new phone.

I received a sign-in alert I do not recognise. #

Change your password, close the unknown sessions in Open sessions and tell your administrator.