What extra checks protect your account beyond the password, and what the "Two-factor" setting on an account means today.
Who uses it
Everyone who signs in. Administrators with Users and roles: Edit manage devices on the Security page.
What exists today
| Protection | Works today? | What it does |
|---|---|---|
| Device approval | Yes | When an account is limited to its own devices, a new phone or computer is held as pending until an administrator approves it. |
| Sign-in lock | Yes | 5 wrong passwords in 15 minutes locks sign-in for 15 minutes. |
| One sign-in at a time | Yes | Signing in somewhere else ends the earlier session. |
| Session limits | Yes | 45 minutes without activity, or 12 hours in all, signs you out. |
| One-time code by SMS | Not on screen | An account can be marked Two-factor: On. The system then makes a 4-digit code when you sign in, but the sign-in screen does not ask for it at present, and no screen lets an administrator switch it on or off. |
So, today, the second step is device approval, not a code.
Tasks
Sign in from a new device when your account is limited
- Sign in as usual. If you see Approval needed, the device has been recorded.
- Tell your administrator which device you used (for example "Chrome on my new laptop").
- When they approve it, sign in again.
Approve a new device (administrators)
- Open Administration and select Security.
- Select the Trusted devices tab.
- Find the device with the state pending and the person's username.
- Select the tick button (Approve this device).
- Ask the person to sign in again.
Limit an account to its own devices (administrators)
- On Security, select the Device access tab.
- Turn on the switch in Access for the person.
- Set Limit to the number of devices they may use (1 to 9).
- The next sign-in registers the device they use. Only devices beyond the limit need approval.
See whether an account has Two-factor on
- Open Administration, select Users and open the account.
- Look at Two-factor in the Account panel: On or Off.
Questions
Will I get an SMS code when I sign in?
Not at present. The sign-in screen does not ask for a code, even when the account shows Two-factor: On.
What does the SMS gateway in System settings have to do with this?
The SMS gateway settings send messages, including one-time codes. They must be set for codes to reach a phone, but the sign-in screen still does not ask for a code today.
Why does my new phone say "Approval needed" but my colleague's does not?
Your account is limited to its own devices on the Device access tab. Accounts that are not limited can sign in from any device.
I changed my laptop. My account says "Device not allowed". What now?
Your old device or this one was revoked. Ask an administrator to revoke the old device on the Trusted devices tab and approve the new one.
How long is a device remembered?
About 60 days from its last sign-in. After that it signs in as a new device.
Does clearing my browser make it a new device?
Yes. Clearing cookies removes the device's mark, so the next sign-in looks like a new device.