Company security settings
Copy for AI
Your company decides whether its people may, or must, use two-step verification. This page is for the person who sets that rule. Each person’s own methods are explained on Sign-in security.
Before you start
Section titled “Before you start”- Your role needs the Manage sign-in security control, under Role administration in the role editor, and System View to open System settings. The Administrator role has both. Without the control, the Two-step verification section does not appear.
- To choose Required for everyone, turn on two-step verification for your own account first. Until you do, the page says so and Save stays unavailable.
- Tell your team before you choose Required for everyone, and point them to Use an authenticator app.
- Select System settings in the sidebar, then Users & permissions in the side navigation, and find the Two-step verification section. It shows how many users have it on.
- Under For everyone in the company, choose Off — not offered, Optional — each person chooses or Required for everyone.
- For Required for everyone, choose a Grace period: None — at the next sign-in, 7 days, 14 days or 30 days.
- Under Ask for a code, choose On new devices (30 days) or At every sign-in.
- Tick or untick Allow email codes for people without an authenticator app.
- Select Save. If you chose Required for everyone, answer the question Require two-step verification for everyone? with Require it. Complete Confirm it’s you if asked.
If the section says Two-step verification is not available for your company yet., there is nothing to set.
The settings
Section titled “The settings”| Setting | Choices | Default |
|---|---|---|
| For everyone in the company | Off — not offered · Optional — each person chooses · Required for everyone | Optional |
| Grace period (Required only) | None, 7, 14 or 30 days, counted from when you save | 14 days |
| Ask for a code | On new devices (30 days) — a trusted device skips the step for 30 days, for one person per browser · At every sign-in | On new devices |
| Allow email codes for people without an authenticator app | Ticked · Unticked | Ticked |
- Off hides two-step verification from people who have not set it up, and nobody can add a new passkey. People who already have it keep being asked for their code, and keep their passkeys.
- While Required for everyone is on, the section shows Required from and the date the grace period ends. Choosing a grace period again sets a new end date.
- Switching to At every sign-in forgets every trusted device in the company.
- Unticking email codes stops new email-code set-ups. People who already use email codes keep them; to move one of them to an app, reset their two-step verification.
Every change is recorded in the audit trail.
See who has it on
Section titled “See who has it on”The Users list on User accounts has a Two-step verification column, and each user’s page has a Two-step verification section. They show App, Email, Passkey or Off; under Required for everyone also Grace until a date or Required – not set up. Passkey unusable – recovery codes only, re-enrol means the person’s passkeys can no longer be used.
What people see at sign-in
Section titled “What people see at sign-in”Read a row for your company’s setting, then the column for the person.
| Company setting | Person without 2FA | Person with 2FA | Person with a passkey |
|---|---|---|---|
| Off | Password only; cannot turn 2FA on | Password, then second step — they keep it | Passkey on its own, or password then passkey |
| Optional | Password only; may turn 2FA on | Password, then second step | Passkey on its own, or password then passkey |
| Required, in grace | Password, and a banner on every page to set up before the grace period ends | Password, then second step | Passkey on its own, or password then passkey |
| Required, after grace | Password, then setup is forced before anything else opens | Password, then second step | Passkey on its own, or password then passkey |
Legend: second step = a code from the authenticator app or email, a passkey, or a recovery code. Person with 2FA uses an authenticator app or email codes; a passkey also counts as 2FA under Required. With On new devices (30 days), a trusted device skips the second step.
- The banner reads Your administrator requires two-step verification from the end date, with a Set up button that opens My profile.
- Forced setup is Set up two-step verification, with Use an authenticator app and, where you allow email codes, No smartphone? Email me codes instead.
- A person added while Required for everyone is on gets the same grace period as everyone else; after it ends, they set up two-step verification at their first sign-in.
- A person whose two-step verification an administrator resets while Required for everyone is on sets it up again at their next sign-in, with no grace period.
- A person already signed in when the grace period ends carries on until that session ends; the next sign-in asks for setup.
Who can do what
Section titled “Who can do what”| Action | Regular user | User Edit (All records) | Administrator | Only Administrator, locked out |
|---|---|---|---|---|
| Turn 2FA on or off for yourself ¹ | Needs confirm it’s you | Needs confirm it’s you | Needs confirm it’s you | Not allowed |
| Add or remove your passkey ² | Needs confirm it’s you | Needs confirm it’s you | Needs confirm it’s you | Not allowed |
| Generate your recovery codes | Needs confirm it’s you | Needs confirm it’s you | Needs confirm it’s you | Not allowed |
| Create a personal token ³ | Needs confirm it’s you | Needs confirm it’s you | Needs confirm it’s you | Not allowed |
| Connect an AI app ⁴ | Needs confirm it’s you | Needs confirm it’s you | Needs confirm it’s you | Not allowed |
| Change the company security settings ⁵ | Not allowed | Not allowed | Needs confirm it’s you | Not allowed |
| Reset another user’s password ⁶ | Not allowed | Needs confirm it’s you | Needs confirm it’s you | Not allowed |
| Change another user’s sign-in email ⁶ | Not allowed | Needs confirm it’s you | Needs confirm it’s you | Not allowed |
| Reset another user’s 2FA ⁶ | Not allowed | Needs confirm it’s you | Needs confirm it’s you | Not allowed |
| Forget all your trusted devices | Allowed | Allowed | Allowed | Not allowed |
| Get your own 2FA reset after losing every method | Not allowed — ask an administrator | Not allowed — ask an administrator | Not allowed — ask another Administrator | Contact easySales |
Legend:
- Allowed — goes ahead straight away. Forget all never asks for anything.
- Needs confirm it’s you — goes ahead after Confirm it’s you.
- Not allowed — the action is refused; the cell says whom to ask where there is someone.
- Contact easySales — email [email protected]. easySales checks your identity, a second person reviews the request, and every step is recorded; see Get back in.
- Locked out means you cannot sign in, so nothing in that column is possible until your access is restored.
Notes:
- Turning on is not offered while the company setting is Off. Turning off does not use Confirm it’s you: it asks for your password and a code every time, and is not offered while the company setting is Required for everyone.
- Not possible to add while the company setting is Off. Renaming asks nothing. Removing your last passkey, when you have no app or email codes, turns 2FA off: it asks for your password and the passkey or a recovery code, and is refused under Required for everyone.
- Needs your company’s AI access switched on; see Company AI access.
- The approval screen asks for a code, your passkey or a recovery code, unless you signed in or confirmed with one in the last 15 minutes. Without 2FA you cannot connect a new app, except while the company setting is Off: then the approval asks for your password.
- Needs the Manage sign-in security control. A custom role can have it without User Edit; that person has the Regular user column for every other row.
- Only an Administrator can do this to another Administrator. With User Edit at Own records only, you reach only your own account, so these are not allowed. Nobody resets their own password, email or 2FA here: use My profile, or ask another administrator. Reset two-step verification in a user’s ··· menu can be selected when their two-step verification shows App, Email, Passkey or Passkey unusable – recovery codes only, re-enrol; otherwise it is greyed out with This user has no two-step verification to reset.
Why it works this way
Section titled “Why it works this way”One unprotected account exposes everyone’s work. Colleagues share customers, quotations and invoices. Requiring two-step verification means a leaked password at any desk no longer opens those records.
The grace period avoids a locked-out Monday. People set it up at a time that suits them, with a banner naming the date, instead of meeting a forced setup on their way to a customer call.
You go first. Requiring it is possible only once your own account has it, so you have tried what you ask of the team and cannot lock yourself into a setting you have never used.
Relaxing the rule never removes anyone’s protection. Optional or Off stops asking those who have not set it up; nobody who has it on is quietly downgraded to a password alone.
Work faster
Section titled “Work faster”- Send the how-to with the announcement. Point the team to Use an authenticator app and, for those without a smartphone, Use email codes.
- Check progress at a glance. The section shows how many users have it on, and the Two-step verification column on User accounts shows who has not. See User accounts.
- Set session rules on the same page. Session timeout and Concurrent sessions per user sit beside the two-step verification rules and save with the same Save. See System settings.
- Use At every sign-in for shared computers. It forgets every trusted device at once, so a reception or showroom computer never skips the code. See Sign-in security.
Examples
Section titled “Examples”Mei Tan’s switch to Required for everyone, day by day, is example B on Security examples.
Counting the grace period. Mei saves Required for everyone with a Grace period of 14 days on Monday 6 October at 10:00. The section shows Required from 20 October (6 + 14). On 7 October she decides a week is enough, chooses 7 days and saves again: the new end date is 14 October (7 + 7), counted from the second save.
A shared computer at reception. Lim & Co lets visiting clients look at mood boards on the reception computer, and Daniel Lim ticked Don’t ask again on this device for 30 days there yesterday. Mei switches Ask for a code to At every sign-in and saves. Every trusted device in the company is forgotten, so Daniel’s next sign-in at reception, and everyone’s everywhere, asks for the second step.
Common questions
Section titled “Common questions”- How do I make two-step verification mandatory for all users? Choose Required for everyone, pick a Grace period and select Save, then Require it.
- What happens when the grace period ends? Anyone without two-step verification must set it up at their next sign-in before anything else opens. Anyone already signed in carries on until that session ends.
- Can I see which users have two-step verification turned on? Yes. The Two-step verification column on User accounts shows App, Email, Passkey or Off for each person; under Required for everyone also Grace until a date or Required – not set up.
- Why can’t I choose Required for everyone? Turn on two-step verification for your own account first; until then Save stays unavailable for that choice.
- What happens if I switch two-step verification to Off? Nobody new can set it up or add a passkey; people who already have it keep being asked for their code.
- Can I stop people using email codes? Untick Allow email codes for people without an authenticator app. New set-ups then use an app; people already on email codes keep them.
- Who can change the company’s two-step verification settings? Anyone whose role has the Manage sign-in security control, which the Administrator role includes.