Two-factor authentication setup

Two-factor authentication means signing in takes something you know (your password) and something you hold (your phone). A stolen password on its own stops being enough.

It is off by default. Somebody has to turn it on, per account — including yours.

Turn it on

1. Go to Settings → Security → Two-Factor Authentication.
2. Scan the QR code with an authenticator app — Google Authenticator, Microsoft Authenticator, 1Password, Authy or any other TOTP app will do.
3. Enter the six-digit code the app shows, to prove the two are talking to each other.
4. Save the backup codes. More on this below.

From then on, every sign-in asks for a code after the password.

The backup codes

You are given a set of single-use backup codes. Each one signs you in once, without the phone.

Put them somewhere that is not the phone: a password manager, or printed and locked in a drawer. Losing the phone with the codes on it is the same as losing both.

If you ever use one, cross it off. They do not work twice.

When the code is refused

Almost always a clock problem. TOTP codes are generated from the current time, and a phone whose clock has drifted by a minute produces codes the server has already moved past.

Turn on automatic time in the phone’s date and time settings, wait for it to correct itself, and try the next code.

Losing the phone

Sign in with a backup code, turn two-factor off, and set it up again on the new phone. Without the phone and without a backup code, an admin at your firm has to help — which is the whole reason the codes exist.

Who should turn it on

Anybody who can reach more than their own documents. That is every CPA and every admin at the firm, without exception. Clients are worth encouraging but not worth blocking over.