Two-Step Verification

Open Account and stay on the Profile tab. The block Two-step verification shows the status:

Every change to your own two-step verification needs a web sign-in. A script that holds an access token cannot make it.

Nothing changes until the code is confirmed, so a mistyped address cannot lock you out. The page then shows Two-step verification is on. After several wrong codes the attempt ends, and you ask for a new code.

Press Turn off in the block, enter your current password and confirm with Turn off. While the organization’s policy requires two-step verification of you, the button is not shown. Turning off keeps your backup codes and your authenticator app.

The block Authenticator app shows Not set up or Set up on <date>. You can set up an app while two-step verification is off, because confirming the first app turns it on.

The QR code and the setup key are shown once. The setup stays open for a few minutes and ends after several wrong codes.

Any app that follows the TOTP standard (RFC 6238) works. The dialog names Google Authenticator, Microsoft Authenticator and Aegis. The app lists the entry as CityScreen Deals:<username>. Codes change every 30 seconds, and each code works once.

Confirming the first app turns two-step verification on, and it selects the app as the kind of sign-in code when you have not chosen a kind yet.

Replace sets up a new app and keeps the old one working until the new one is confirmed. Remove asks for your current password and stops the app from working; sign-in then asks for a code sent to your e-mail address. You can remove the app even when the organization’s policy requires two-step verification.

Once an app is set up and two-step verification is on, the profile shows the field Sign-in codes, which sets the kind of code that sign-in asks for.

Sign-in asks for a code sent to the employee’s e-mail address, for a code from the authenticator app, or for either of the two. A backup code always works.

The options are Code sent to my e-mail, Code from the authenticator app and Either: e-mail or authenticator app. The choice is saved at once and needs no password. This table shows what sign-in asks for:

An administrator can choose the kind of code for an employee, as described in Helping an employee.

The block Backup codes appears while two-step verification is on or required. It shows <n> left, created <date>, or No backup codes yet.

Generate backup codes creates 10 single-use codes in the form XXXXX-XXXXX. The codes are shown once, and a new set replaces the old one.

The dialog closes only with I saved them; Esc and a click outside leave it open, because nobody can show the codes again. Each code works once, and the codes of an older set stop working when you generate a new one. When you type a code, case, spaces and hyphens do not matter.

Administrators decide in Settings > General, field Two-step verification, whom the organization asks for it.

An administrator sets the policy to Not required, Required for everyone or Required for selected roles. A required employee needs no setup, because the next sign-in asks for a code sent to their e-mail address.

A role counts when the employee holds it through a group membership, that is, when the role is assigned to the employee in that group. A default role that a group type defines does not count. The main administrator is covered by Required for selected roles only when they hold one of the roles.

Changing the policy does not sign anyone out. Employees who are now required see the status Required by your organization and cannot turn the verification off. Saving the setting needs the Edit permission on Organization settings. The other fields of the page are described in Organization Settings.

An administrator opens Employees, then the employee, and finds the block Two-step verification. The block is not shown on your own record. It shows the status On, Required or Off.

None of these actions asks for a password, so before you act on a request that comes by phone, e-mail or chat, make sure it comes from the employee, for example by calling them back at a number already on record. An employee turns two-step verification on or off and generates backup codes in their own profile.

Two permissions in the role editor control the block, each at group or organization scope:

With the group scope, an administrator manages only employees in their groups. For any other employee they see You can manage two-step verification only of employees in your groups, and this employee is not one of them. Holders of either permission also get the column Two-step verification in the employee list. The roles are described in Roles & Permissions.

An employee who has two-step verification cannot sign in to a mail client or another program over LDAP with the account password. Such a program needs an app password. App passwords are created on the App passwords tab of your account. This function is licensed. If your organization’s license does not include it, contact CityScreen. See Access Tokens and App Passwords and LDAP Directory.

Deactivating an employee deletes their backup codes and their authenticator app. After the account is activated again, sign-in asks for an e-mail code until the employee sets up an app, and the employee generates a new set of backup codes.