Security examples

These scenarios follow the people at Lim & Co, a five-person interior design firm, through the situations that raise the most questions about signing in. Each one lists what happens, day by day, and which page explains the step. The pieces themselves are explained on Sign-in security.

A. Ahmad’s new phone

Ahmad is a designer at Lim & Co. He uses an authenticator app, and his company requires two-step verification, so there is no Turn off button for him.

• Day 1, morning. His new phone arrives. He keeps the old one as it is and opens My profile, Sign-in & security: Recovery codes: 8 of 10 left.
• Day 1, morning. On the old phone he uses his authenticator app’s own transfer feature to move the easySales entry to the new phone. (Had he already had a passkey, he could instead select Remove authenticator app on the Passkeys card and Turn on again with the new phone.)
• Day 1, lunchtime. He tests it: in a private browser window, which is not a trusted device, he signs in and types the code from the new phone. The Dashboard opens.
• Day 1, afternoon. While he is at it, he adds a passkey that syncs with his phone’s password manager, so a future phone change is easier. When easySales asks him to confirm it’s him, he uses a code from the new phone. He keeps his recovery codes — see Set up a passkey.
• Day 2. Only now does he wipe the old phone.

If the old phone had been lost instead. On Day 1 Ahmad signs in with his password and selects Use a recovery code instead. He then asks Mei Tan, the administrator, to reset his two-step verification. Mei opens his user, selects Reset two-step verification in the ··· menu, confirms it’s her and selects Reset: Ahmad is signed out everywhere, his AI apps are disconnected and he gets an email notice. At his next sign-in, because Lim & Co requires two-step verification, setup opens at once; he scans the QR code with the new phone and saves ten new recovery codes. See Get back in.

B. Mei requires 2FA

Mei Tan has the Administrator role at Lim & Co. Two-step verification is Optional; only Ahmad uses it.

• Day 1. Mei tells the team at the Monday meeting and sends them the link to Use an authenticator app. She already uses an authenticator app herself, which Required for everyone needs. In System settings, Users & permissions, in the Two-step verification section, she chooses Required for everyone, a Grace period of 14 days, keeps On new devices (30 days) and leaves email codes allowed. She selects Save and confirms it’s her with her app code. The change is recorded in the audit trail.
• Day 1. Ahmad notices nothing: he already has it on.
• Day 2. Priya signs in and sees the banner, which names the date the grace period ends. She selects Set up and turns on email codes.
• Day 5. Sarah Goh turns on the authenticator app.
• Day 12. Daniel Lim still has not. The banner still shows the same date on every page.
• Day 15. The grace period is over. Daniel signs in with his password, and Set up two-step verification opens before anything else. He selects Use an authenticator app, scans the QR code, types a code, saves his recovery codes, and the Dashboard opens.
• Day 15. The AI app Daniel connected last month keeps working. When he connects a second one on Day 16, the approval asks for no password: he enters a code from his app and selects Allow. Had he signed in with a code in the last 15 minutes, Allow alone would do.
• Day 20. Farah joins. Mei creates her account and gives her a temporary password. The grace period has ended, so at Farah’s first sign-in Set up two-step verification opens first; then she chooses her own password in Choose a new password, and the Dashboard opens.

The settings and who sees what are on Company security settings.

C. One email, two companies

Sarah Goh is Lim & Co’s assistant. She also keeps the books for Kopi Corner, which uses easySales too. She has an account in each company with the same email, [email protected].

• Day 1, morning. Signed in to Lim & Co, she opens My profile, selects Add a passkey on the Passkeys card, types My phone as the Name, selects Continue and unlocks her phone. An email tells her a passkey was added.
• Day 1, evening. Signed in to Kopi Corner, she does the same. Another email arrives.
• Day 1, evening. Her phone now lists two passkeys: [email protected] · LIMCO and [email protected] · KOPI. The part after the dot is each company’s Licence code.
• Day 2. At the office she selects Sign in with a passkey, picks the LIMCO entry and unlocks her phone. Lim & Co’s Dashboard opens; she typed no password.
• Day 3. In a hurry she picks KOPI by mistake, and Kopi Corner’s Dashboard opens. She signs out and picks the LIMCO entry.
• Day 9. In Lim & Co she renames the passkey to Phone — Lim & Co. No email is sent for a rename.

Each company’s account keeps its own list of passkeys, with its own limit of 10. Removing the Lim & Co passkey does not touch the Kopi Corner one.

D. Priya’s new email

Priya is a designer at Lim & Co and uses email codes. Lim & Co moves its mailboxes to a new domain, so her address changes from [email protected] to [email protected].

• Day 1, 5 pm. Mei opens User accounts, Priya’s user, selects Edit and changes her Email. The form warns that this stops Priya’s email codes until she confirms the new address. When Mei saves, easySales asks her to confirm it’s her. From this moment Priya’s email codes are paused.
• Day 2, 9 am. Priya signs in with her password. No email code can be sent until she confirms the new address, so the second step asks only for a recovery code. She enters one of her saved codes and selects Verify. The Dashboard opens.
• Day 2, 9:05 am. On My profile, the Sign-in & security page says her email address changed. She selects Confirm new address, then Send code, and enters the code sent to [email protected]; her recovery-code sign-in five minutes ago counts as confirming it’s her, so nothing more is asked (after 15 minutes she would confirm with another recovery code). The card now shows Recovery codes: 9 of 10 left, and both addresses get an email that codes now go to the new one.
• Day 3. At sign-in her email code arrives at the new address, as before.

Had Priya set up a passkey, she could have used it on Day 2 instead of a recovery code. See Use email codes.

E. A client’s computer

Daniel Lim visits Harbour Café to walk the owner through a quotation, and signs in on the café’s office computer.

• Day 1, 11 am. Out of habit he ticks Don’t ask again on this device for 30 days with his code. An email tells him a device was trusted.
• Day 1, 3 pm. Back at his own laptop, he opens My profile, Sign-in & security. Under Trusted devices he finds Chrome on Windows, expiring 30 days from today, selects Forget and confirms in Forget device. The café computer will now ask for a code at the next sign-in.
• Day 1, 3:05 pm. To be sure nobody is still signed in there, he changes his password. He confirms it’s him with a code when asked, and every session ends, the café’s and his own. He signs in again on his laptop with the new password and a code. See Sign-in security.

F. Priya leaves

Priya’s last day at Lim & Co is a Friday.

• Friday, 4 pm. Mei opens User accounts, Priya’s user, and selects Transfer records in the ··· menu to hand her records to Sarah Goh. See Transfer records.
• Friday, 6 pm. Mei selects Deactivate user and confirms with Deactivate. Priya is signed out everywhere at once; her AI app and personal token stop working and her calendar link stops updating. Her email codes, recovery codes and passkeys can no longer sign in to Lim & Co, because nobody can sign in to a deactivated account.

Why it works this way

Every story has a second way in. Ahmad tests the new phone before wiping the old one, Sarah keeps a passkey per company, Priya has recovery codes when her email codes pause. A method you have not set up cannot rescue you on the day you need it.

Security changes leave a trace you can follow. Each step above is announced by email to the person it affects and, for administrators’ changes, recorded in the audit trail, so a team can always work out afterwards who changed what.

Work faster

• Rehearse a phone change. Sign in once in a private browser window, which is not a trusted device, to check the new phone’s code works. See Use an authenticator app.
• Roll out with a grace period. 14 days gave Lim & Co time to set up without a locked-out morning. See Company security settings.
• Clean up after a shared computer. Forget under Trusted devices, then change your password if you were signed in. See Get back in.

Common questions

• Can I use the same email address in two companies? Yes. Each company gives you a separate account with its own passkeys and methods; your device lists each passkey with that company’s Licence code.
• What should I do if I ticked “Don’t ask again” on someone else’s computer? Select Forget beside it under Trusted devices, and change your password if you may still be signed in there.
• What happens to a leaver’s sign-in when their user is deactivated? Every session, AI app, personal token and calendar link ends, and nobody can sign in to that account again.
• Does changing a colleague’s email affect their two-step verification? If they use email codes, yes: codes pause until they confirm the new address. App codes and passkeys are not affected.
• Does requiring two-step verification disconnect AI apps already connected? No. Existing personal tokens and AI app connections keep working.

Related

• Sign-in security
• Company security settings
• Get back in
• Set up a passkey