Aller au contenu principal

Account security

Open your profile through the account menu. Personal security controls apply to your own account; organization policy and other people's sessions require separate authority.

Password and recovery​

Use the password-change card to enter your current password and a matching new password/confirmation, then follow the session guidance. If you cannot sign in, use Forgot password at sign-in and the newest valid link sent to your account email. Password reset and organization invitation are different flows.

Do not forward reset links or ask colleagues to use your account. If you no longer control the email address, follow your organization's identity-recovery procedure with the administrator and support.

Set up multifactor authentication​

  1. Open the MFA card and start setup.
  2. Verify your current password when requested.
  3. Add the displayed QR code or setup key to your authenticator.
  4. Enter its current verification code to complete enrollment.
  5. Store the displayed recovery codes privately. Do not include the QR code, setup key, or recovery codes in documentation screenshots.
  6. Confirm MFA is enabled and use the authenticator on your next sign-in when requested.

Recovery codes are account credentials for situations where your authenticator is unavailable. Regeneration invalidates previous codes; save the new set securely. Disabling MFA or changing security-sensitive settings may require fresh authentication and may be restricted by organization policy.

Organization MFA policy​

An authorized administrator can manage the available tenant MFA policy card. Enforcing the policy requires the administrator's own enrollment first. Review affected users and recovery readiness with your organization before changing policy. A policy setting is separate from each user's enrollment.

Review sessions​

The session card shows active sessions, current-session marker, creation/last-use information, and authentication strength where available. Revoke an unfamiliar or retired session, or use Revoke other sessions to retain the current one. Revoking the current session signs you out. Browser/device descriptions help investigation but do not prove the physical identity of a device.

For access to another site or environment use Roles and permissions. For suspicious activity contact your security administrator; use Support without sending authentication secrets.