Two-factor authentication adds a second step to signing in to Amplify with a password: a code from an authenticator app on your phone, such as Microsoft Authenticator or Google Authenticator. Even if someone learns your password, they can't sign in without the code. Users can turn it on for themselves, and administrators can require it for everyone.
This article covers both the Advanced and Simple Models. Requiring two-factor authentication, and resetting it for a user, needs administrator access.
Note Two-factor authentication only applies to signing in with a password. Users who sign in through single sign-on use your identity provider's security instead. See Single Sign-On.
Requiring two-factor authentication
Administrators can require every user who signs in with a password to use two-factor authentication. To require it:
- Navigate to Administration > Authentication.
- Under Two-Factor Authentication, check Enforce all users to use two-factor authentication.
- Choose the date in Enforce two-factor authentication after.
- Click Update Two-Factor Settings.
Until the date, users without two-factor authentication are reminded to set it up, with the date it becomes required, and can dismiss the reminder. From the date, they can't dismiss it, and must set it up before they can use Amplify.
The Manage Users list shows whether each user has two-factor authentication turned on. See Managing Users.
Setting up two-factor authentication
Before you start, install an authenticator app on your phone. To set up two-factor authentication:
- Click your account icon.
- Select My Account.
- Under Two Factor Authentication, click Enable Two Factor Authentication. A QR code is shown, under 1. Scan QR Code.
- In your authenticator app, add an account.
- Scan the QR code with your phone. Amplify is added to the app, which shows a code for it.
- Under 2. Confirm One Time Password Code, enter your Amplify account password.
- Enter the code your authenticator app shows in One Time Password.
- Click Confirm and Enable Two Factor. Two Factor Authentication Backup Codes opens, with your backup codes.
- Click Download Backup Codes.
- Click Confirm.
Where you can't scan the QR code, type the code shown below it into your authenticator app instead.
Keep your backup codes somewhere safe. They're only shown once, and each one can only be used once. They're your way to sign in if you lose your phone, or can't use your authenticator app.
Signing in with two-factor authentication
Once two-factor authentication is set up, sign in with your email address and password as usual. Amplify then asks for a code. Enter the code your authenticator app shows for Amplify.
Where you can't use your authenticator app, enter one of your backup codes instead. Where you've lost your backup codes too, ask your administrator to reset your two-factor authentication.
Turning off two-factor authentication
To turn off two-factor authentication:
- Click your account icon.
- Select My Account.
- Under Two Factor Authentication, click Disable/Reset 2FA.
- Confirm.
Where your administrator requires two-factor authentication, you're asked to set it up again straight away.
Resetting a user's two-factor authentication
Where a user has lost both their authenticator app and their backup codes, an administrator can reset their two-factor authentication, so they can sign in again. To reset it:
- Navigate to Administration > Manage Users.
- Click the user's name.
- Under Two Factor Authentication, click Reset.
Two-factor authentication is turned off for the user. Where it's required, they're asked to set it up again the next time they sign in.
For the other ways users sign in, see Authentication.