Security
What this screen is for
This screen manages your own account: how you sign in, where you are signed in, and what happened to your account recently. It is opened by Security in the account menu of the header, and it is the same for every person, platform administrator or tenant member.
Your passkeys, authenticator app, recovery codes and password belong to your account, not to one tenant. What you add here serves every tenant you belong to whose sign-in requirements admit it, and no administrator can manage it on your behalf.
What must exist first
- A session of your own. No permission is needed: every action here is authorized by the account you signed in with.
- While you act in a tenant under support access, the menu entry is hidden and this page offers no action: it would manage your own account, not the tenant's.
- A browser and an authenticator that support passkeys, to add one: this device's fingerprint, face or screen lock, a password manager, or a security key.
Decisions you make here
Passkeys and authenticator app
Passkeys and authenticator app lists every passkey with its name, when it was added and last used, and what it establishes: phishing-resistant, verifies you on every use, syncs to your other devices or is bound to one device, hardware-backed, attested by its maker, discoverable. There is no strength score: a tenant names the properties it requires, and each passkey states its own. The authenticator app is listed as not phishing-resistant.
Add a passkey asks your device to create one for this site. A tenant that requires a hardware-backed, attested or device-bound passkey refuses one that cannot prove it, and nothing is added. Rename changes a passkey's name only.
A passkey belongs to the console's host name. The server decides, for the address the console is open on, whether a passkey can be used there, and the page shows what it says. On the deployment's host name Add a passkey is offered. When the console is open on the host's IP address, passkeys cannot be used: the page offers no passkey and tells you to open the console on the host name to add or use one, while the authenticator app is still offered where it serves you. A passkey added under a previous host name of the deployment is listed as not usable on this host name: it is never offered when you sign in, and you can rename or remove it and add a new one here.
Add an authenticator app shows a QR code, the setup key and a link, once. Scan it with the authenticator app on your phone and enter the code the app shows; a wrong code leaves the setup open for the next one. A platform administrator is offered one too while the platform accepts a password with an authenticator app; it does not where the platform requires a phishing-resistant passkey.
Each is offered only when it would serve one of your sign-ins: no passkey when every tenant you belong to signs you in through its identity provider, no authenticator app when none of your tenants admits one.
If a tenant you belong to requires an authenticator you have not added, switching into it from the header asks you to prove yourself with one; until you add it here, the switch is refused and you stay where you are.
Remove stops an authenticator from working at once. It is refused when it is the last way you can sign in to one of your memberships, and nothing is removed; the refusal never names the tenant. Add another authenticator first. A platform super administrator's removal is also refused when no platform super administrator could sign in afterwards; emergency access does not count.
Recovery codes
The first passkey or authenticator app you add gives you ten Recovery codes, shown once. Store them away from the device that holds your passkey. If you lose every passkey and authenticator app, a recovery code lets you sign in once to add a new one; every other session of yours then ends, and the code is used up.
Generate new recovery codes replaces the whole set: every earlier code, used or not, stops working at once.
Password
While you hold a password, Change password replaces it, and the new one follows the password policy: 15 to 128 characters, not a common or compromised password, not containing the name of your e-mail address, and different from your last five. A change ends every session of yours, this one included, so you sign in again.
If every tenant you belong to accepts a passkey, Remove password lets you sign in with your passkeys only. It is refused while one of your memberships is entered only with the password, or when it is the last way any platform super administrator signs in. A new password can later be set through the password reset.
Confirming your identity before a change
Adding, renaming or removing a passkey or an authenticator app, generating new recovery codes, and changing or removing your password ask for a recent confirmation of who you are. If you last confirmed it more than a few minutes ago, Confirm your identity to continue opens with your own sign-in steps: a passkey, your password and an authenticator-app code, or your identity provider. Nothing has changed yet; once you confirm, the change goes through.
A change that carries your password or a code is not sent again for you: enter it again and submit once more. If you close the confirmation or it fails, nothing is changed. If this session cannot be confirmed here, for example because you have no passkey or authenticator app, sign in again and repeat the change.
Where you are signed in
Where you are signed in lists your sessions in every tenant, marks the current one, and ends one session, every other session, or all of them.
Recent security activity
Recent security activity lists your sign-ins and refused sign-ins, the end of your sessions, the changes to your authenticators, recovery codes and password, and an account recovery performed on your account, in every tenant, newest first. Each row says what it concerns, its outcome, the tenant and, when it was recorded, where it came from. Only your own events appear, never what an operator did on your behalf.
The outcome is one of:
- Succeeded: the action completed.
- Refused: the action could not complete, for example a wrong password or code.
- Refused by policy: a rule refused it, for example a correct password refused because your account holds a passkey or an authenticator app, or the removal of an authenticator you still need.
- Result withheld: the action was performed, but its result was withheld because its record could not be confirmed.
An account managed by an identity provider
If you sign in through your organization's identity provider, it holds your password and second factors and you change them there. The page says so and keeps your sessions and your security activity.
How it relates to other screens
The requirements your authenticators must meet are set by each tenant on its settings screen:
A person who lost every authenticator and every recovery code is recovered by the platform, at the request of a tenant administrator: