Overview
Two-factor authentication (MFA) adds a second layer of security to your portal account. After entering your password, you'll also need a time-based code from your authenticator app. This makes it much harder for anyone who gets your password to access your account.
What You Need
An authenticator app on your phone or computer. Any standard TOTP authenticator works, including:
- Microsoft Authenticator
- Google Authenticator
- Authy
- 1Password
- Apple's built-in Passwords app
Setting Up MFA
- Sign in to the portal and click Account in the sidebar (sometimes labeled My Account or your name).
- Find the Security section and click Enable next to Two-Factor Authentication.
- A QR code appears on screen. Open your authenticator app, tap the option to add a new account, and scan the QR code.
- Your authenticator app will start showing a 6-digit code that changes every 30 seconds.
- Type the current code from your app into the portal's confirmation field and click Verify.
- MFA is now active on your account.
Recovery Codes
Immediately after enabling MFA, the portal shows you a list of recovery codes. These are one-time backup codes you can use to sign in if you lose access to your authenticator app.
Save these now. Options:
- Print them and store in a safe place
- Save them in a password manager
- Write them down and keep them somewhere secure
Each recovery code can only be used once. After you use one, it's gone. You can generate a fresh set of 10 codes at any time from the MFA section of your Account settings.
Signing In With MFA Enabled
Once MFA is set up, your sign-in process changes:
- Enter your email and password as normal and click Sign In.
- The portal asks for a 6-digit code.
- Open your authenticator app, find the entry for the portal, and enter the current code.
- Click Verify. You're in.
Codes change every 30 seconds, so if one doesn't work, wait for the next code to appear and try again.
What to Do If You're Locked Out
If you have your recovery codes: At the MFA code prompt, click Use a recovery code and enter one of your saved codes. You'll be signed in. After using a recovery code, generate a fresh set from your Account settings.
If you've lost both your phone and your recovery codes: You cannot recover access on your own — this is by design, to prevent attackers from bypassing MFA. Contact your IT provider. They can reset MFA on your account after verifying your identity.
Disabling MFA
If you need to turn MFA off (not recommended):
- Go to Account → Security.
- Click Disable next to Two-Factor Authentication.
- Enter a current code from your authenticator app to confirm.
MFA will be removed from your account.
Frequently Asked Questions
My authenticator code says "invalid" even though I typed it correctly.
TOTP codes are time-based. If your phone's clock is even slightly off, codes won't match. Go to your phone's settings and enable "Set time automatically" (or "Automatic date and time"). Then try again.
I got a new phone. How do I move my authenticator?
Most authenticator apps have a built-in account transfer or export feature. Use it before you wipe your old phone. If you already switched phones and are locked out, use a recovery code or contact your IT provider.
Do I need MFA every time I sign in?
Yes — every sign-in session requires MFA verification when it's enabled on your account.
Can my provider require MFA for everyone?
Yes. Your IT provider can require MFA for specific roles. If your account requires MFA, you'll be prompted to set it up the first time you sign in.