Skip to main content

Set Up an Authenticator App

Goal​

Set up an authenticator app so signing in asks for a six-digit code as well as your password.

Platform accounts must have one. The Shell and the Admin Control Center hold every customer's commercial record, so the first time you sign in without an authenticator app you are taken straight to this screen and cannot go anywhere else until it is done. It takes about a minute.

If you are a customer signing in to parsware.com, this is optional — offered, never required.

Prerequisites​

  • An authenticator app on your phone. Microsoft Authenticator, Google Authenticator, 1Password, Bitwarden and Authy all work — this is standard two-step sign-in, not a Microsoft feature, so use whichever you already have rather than installing another.
  • Somewhere safe to keep ten recovery codes. A password manager is ideal; a photo in your camera roll is not.

Steps​

  1. Sign in with your email and password as usual. If your account has no authenticator app yet, the Set up an authenticator app screen appears by itself.

  2. Open your authenticator app and scan the square code on screen.

    If the camera will not read it, use the key printed underneath instead: in your app choose to add an account manually, then type the key exactly as shown. The spaces are only there to make it readable — your app will ignore them.

  3. Your app now shows a six-digit code that changes every thirty seconds. Type the current one into Enter the six-digit code from your app and select Verify.

    If it is refused, the usual cause is your phone's clock. Two-step codes are calculated from the time, so a phone a minute out produces codes the platform will not accept. Turn on automatic date and time on the phone and try again.

  4. Save your recovery codes. Ten codes appear. Each one signs you in once if you do not have your phone.

    This is the only time they are shown. The platform stores them the way it stores a password, so nobody — including support — can read them back to you later.

  5. Tick I have saved these codes somewhere safe and select Finish setup.

  6. Sign in again, this time entering a code from your app when asked.

    You are asked to sign in again because the limited sign-in that got you to the setup screen deliberately cannot do anything else.

What happens next​

From now on, signing in asks for a code after your password. Some actions ask for one again even while you are signed in — changing somebody's roles, for example. That is deliberate: those are the actions where somebody who walked up to an unlocked laptop would do real damage, so the platform asks you to prove it is you, not just that the session is open.

If you lose your phone​

Use one of your recovery codes in place of the six-digit code. Each works once.

If you have lost your phone and your recovery codes, support cannot switch two-step sign-in off for you. That is not unhelpfulness — "I have lost my phone, please disable my two-step sign-in" is exactly what somebody trying to break into your account would say, and a support desk that agrees to it is a support desk that has removed the protection for everyone. Recovering such an account is a deliberate administrative act on the server by whoever runs your deployment.

What this protects you from, and what it does not​

It stops somebody who has your password — from a reused password, a leak, or a guess — from signing in as you.

It does not stop a convincing fake sign-in page: a site that collects your password and your code can use both within thirty seconds. Treat a sign-in page reached from a link in an email with the same suspicion you would treat any other, and check the address bar says the address you expect.