Skip to main content

Multi-factor authentication

Backoffice sign-in starts with your email and password. Multi-factor authentication (MFA) adds a second step: a Passkey or a six-digit code from an authenticator app.

A Passkey can be stored on a device, in a password manager, or on a security key. Your device may confirm it with Touch ID, Face ID, a PIN, or another unlock method. Backoffice does not receive your biometric data.

Add a method​

Open Account > Security and choose Add Passkey or Add authenticator.

  1. For a Passkey, edit the suggested two-word name if needed. Names must be unique within your account, from 1–64 characters. You can store up to ten Passkeys.
  2. Confirm your current password. If you already have MFA, also verify an existing method. This approval is only for the selected action.
  3. Start setup. Passkey creation opens only after you click Create Passkey. For an authenticator, scan the QR code or enter the setup key, then verify its current code.
  4. For your first method, save all eight recovery codes and confirm that you saved them. The method is not activated until you finish.

When setup is required at sign-in, choose either available method and complete the same saved-code step before entering Backoffice. There is no separate account session before setup is complete.

Each environment has its own methods and recovery codes. A staging Passkey is not a production Passkey, even if both are saved in the same password manager.

Sign in​

After a correct password, Backoffice attempts a configured Passkey once when the browser supports it. If you cancel, retry with Use Passkey, use your configured authenticator, or choose the separate recovery-code option. An authenticator option appears only if you configured one.

Five failed authenticator or recovery-code attempts lock both code methods for 15 minutes. The screen shows the remaining wait; Passkeys remain available. Password-login lockout is separate.

Save and replace recovery codes​

One shared set of eight codes covers every MFA method on your account in that environment. Each code works once. Copy or download them explicitly and store them securely.

Account Security shows the number of unused codes. Regenerate recovery codes requires your password and an existing method. Previous codes keep working until you confirm that the new set is saved. Adding another Passkey or authenticator does not replace the active recovery codes.

warning

Recovery codes cannot be displayed again after confirmation or recovered if lost. If you lose all methods and codes, ask an authorized administrator to reset your MFA.

A successful recovery-code use is audited and sends a security notification. It does not disable your methods or prevent a normal session.

Remove a method​

Account Security lists each Passkey's name, creation date and last-use date, plus whether an authenticator is configured. Remove a specific method after confirming your password and another available proof.

If MFA is required, add another method before removing the last one. If MFA is optional, removing the final method also deletes your recovery codes. Ordinary method changes keep your sessions active.

If setup was interrupted after your device saved a Passkey, check Account Security before deleting that device-side entry. A lost final response does not necessarily mean setup failed. For a temporary request error, use Retry request; after expiry, start again.

Required MFA​

  • A role marked Requires 2FA requires an ordinary MFA method at the next sign-in or refresh. Already-authorized access is not immediately terminated by the role setting.
  • The operator's Enforce 2FA setting keeps its existing behavior: affected users are signed out and must meet the requirement when signing in again.
  • Cross-operator accounts also require MFA unless they are system super-administrators.

The existing policy controls retain their 2FA labels, but either Passkey or authenticator satisfies the requirement. Recovery codes alone do not.

Reset another user's MFA​

An authorized administrator can choose Reset MFA in Users after confirming the affected person's identity. The action is unavailable on your own account and requires a 5–1000 character reason. Tenant visibility and the existing reset permission apply.

Reset removes every Passkey, the authenticator, recovery codes and unfinished MFA actions, and ends all the target user's sessions. It does not unlock a password-login lock or reactivate an inactive account. The action is audited and sends a notification.

The user signs in again; required MFA must be set up before continuing.

Application updates​

If Backoffice requires an update during sign-in or refresh, save any unsaved work before choosing Reload application. Temporary refresh failures preserve the stored session and offer retry. An application update is not a reason to delete Passkeys or reset MFA.