---
title: "Two-factor authentication and open sessions"
description: "Turn on two-factor authentication by app or email, require it for a role, manage an employee's methods and close the sessions open on an account."
url: "https://illizeo.com/en/centre-aide/security-two-factor-authentication/"
updated: "2026-11-05"
category: "Platform / Security & compliance"
---

# Two-factor authentication and open sessions

Two-factor authentication adds a second factor to the password: a code shown by an authenticator app, or a 6-digit code received by email. This article explains how to turn it on for yourself, how to require it for the members of a role, how to manage an employee's methods, and how to close the sessions open on an account. It is for employees and administrators alike.

## Before you start

- For yourself: no permission is needed to turn your two-factor authentication on or off. Your account page opens from your profile (**My Profile**), ⋮ menu, **Manage account**. This entry only appears for roles holding the "View an employee's account status (access, invitation, last sign-in)" permission, given by default to administrators and HR managers. Other employees set up two-factor authentication at sign-in, when their role requires it.
- Requiring two-factor authentication for a role: the "View role cards" permission to read the screen, "Create a new role" at the **Execute** level to tick a box (Roles & permissions menu of the matrix).
- Managing an employee's two-factor authentication: the "Manage an employee's two-factor authentication (view, disable, regenerate)" permission (Employee management, Employee actions section). The **Access** level lets you see their methods, the **Execute** level lets you act. Permissions are set in **Settings › Manage Employees › Employee Roles** (see [Permissions & roles](https://illizeo.com/en/docs-category/platform-en/platform-roles-permissions/)).

## Turning on two-factor authentication for yourself

1. On your account page, open the **Two-factor authentication** tab. Two lines appear, **Authenticator app** and **Email code**, each with its **Enabled** or **Disabled** badge.
2. Click **Set up** on the line you want. The **Two-factor authentication** page opens on **Pick your method**: choose, then click **Continue** (or **Skip for now** to do it later).
3. App: click **Show QR code**, scan it with your app (Google Authenticator, Authy, 1Password…) or enter the **Manual key**. Type the 6-digit code shown, then **Verify & enable**.
4. Illizeo then shows 10 recovery codes, only once. Click **Download codes**, store them somewhere other than your phone, tick "I have saved my recovery codes somewhere safe." and click **I've saved them**.
5. Email code: confirm your current password, click **Send me a code**, enter the code you receive, then **Verify & enable**.

![The Two-factor authentication tab of the account page: the Authenticator app line and the Email code line, each with its Enabled or Disabled badge and its buttons](https://i0.wp.com/illizeo.com/wp-content/uploads/2026/11/security-two-factor-authentication-01.en_.png?resize=800%2C270&quality=80&ssl=1)
Manage account › Two-factor authentication: the two methods.

If both methods are active, **Set as preferred** chooses the one asked for first at sign-in; it then shows "· Preferred".

## At sign-in

After the password, or after a sign-in link received by email, the **6-digit code** screen appears:

- with the app, enter the code shown, which refreshes every 30 seconds;
- by email, enter the code sent to your address (masked on screen). It expires after 5 minutes; **Resend code** sends a new one;
- **Use authenticator app**, **Use email code** and **Use a recovery code** switch method. A recovery code works only once.

Click **Verify and sign in**.

## Recovery codes and turning off

- **Regenerate recovery codes** (app method): confirm with your password, then **Generate new codes**. The old codes stop working; the new ones are shown only once, with **Download codes**.
- **Disable** the app: enter your password and a current code from the app, then **Confirm disable**. Your recovery codes are deleted.
- To remove the email code, ask an administrator (see below).

## Requiring two-factor authentication for a role

1. Open **Settings › Manage Employees › Security**. The **Two-factor enforcement** card lists the roles, in the colours of the roles screen.
2. Tick **Require 2FA** on the role's line. It is saved at once and a message confirms it.

![The Security page of the employee settings: the Two-factor enforcement card with the list of roles, their colour dot and the Require 2FA box](https://i0.wp.com/illizeo.com/wp-content/uploads/2026/11/security-two-factor-authentication-02.en_.png?resize=800%2C500&quality=80&ssl=1)
Settings › Manage Employees › Security: requiring two-factor authentication per role.

At their next sign-in, a member of this role without two-factor authentication sees the "Set up two-factor" screen. Under **Choose your method**, they choose **Authenticator app** (scan the QR code, enter the code, **Confirm and sign in**) or **Email me a code instead**. With the app, they save their recovery codes, tick "I have saved these codes somewhere safe." and click **Continue**. Until they have set it up, they cannot get in.

Unticking the box lifts the requirement. Members who had only set up two-factor authentication because it was required lose it and receive an email; those who had turned it on themselves keep it. The confirmation message says how many people are affected.

The requirement applies to sign-in by password and by email link. For single sign-on (SSO), the second factor is a matter for your identity provider.

## Managing an employee's two-factor authentication

1. Open the employee's profile, ⋮ menu, **Manage account**, **Two-factor authentication** tab.
2. You see their methods and preferred method. You cannot turn them on for them: the line says "The employee must set this up themselves."
3. At the Execute level: **Set as preferred**, **Regenerate recovery codes** (the new codes are shown to you, to be passed on securely) and **Disable**. These actions are confirmed without a password; disabling the app also deletes their recovery codes.

The employee receives the "Two-factor authentication was removed from your Illizeo account" email, which names you. On your own account, these actions do not go through this tab: use your account page, which asks for your password.

## Open sessions

- For yourself: the **Open sessions** tab ("Your open sessions") lists the devices signed in to your account, with their IP address and last activity; yours shows "This session". **Close** signs a device out; **Sign out everywhere else**, confirmed with **Close all**, closes all the others.
- For an employee: with "View an employee's account status…", the tab lists their sessions. At the Execute level, **Close all access** signs them out everywhere, including from an administrator consultation in progress; they will have to sign in again.

![The Open sessions tab: list of devices signed in to the account with IP address and last activity, This session label, Close and Sign out everywhere else buttons](https://i0.wp.com/illizeo.com/wp-content/uploads/2026/11/security-two-factor-authentication-03.en_.png?resize=800%2C220&quality=80&ssl=1)
Manage account › Open sessions.

## Security alerts

- "New sign-in to your Illizeo account": sent when an account signs in from a device and IP address pair never seen before, with the device, address and date.
- "Two-factor authentication was removed from your Illizeo account": sent to the holder each time a method is removed, by themselves, by an administrator or when a requirement is lifted, with the method still active.

These emails are always sent: your company cannot turn them off.

## Good to know

- A new email code can only be requested once a minute.
- Avoid giving the same role "Manage an employee's two-factor authentication" and "Set an employee's password directly": together, these two permissions make it possible to get into any account.
- Sign-ins are recorded in the user logs: see [Governance & security](https://illizeo.com/en/docs-category/platform-en/platform-governance-security/).

## FAQ

### I have lost my phone.

At sign-in, click **Use a recovery code**, or **Use email code** if the email code is active. With neither, ask an administrator to disable your app, then set it up again on your new phone.

### I received a sign-in alert I do not recognise.

Change your password, close the unknown sessions in **Open sessions** and tell your administrator.

### *Similaire*