Sign-in and security

Choose whether people may sign in with a passkey

1. Find Passkeys policy.
2. Choose Off, Allow passkeys or Require passkeys for admins.
3. Press Save changes on the bar at the foot of the page.
4. If you are asked, confirm it's you.

Then: The page says Saved. Allowed, everyone may add a passkey under Your account › Signing in and sign in with it from the sign-in page, and it counts as two-step sign-in. Off, nobody signs in with one and none can be added; the passkeys people added are kept, and work again if you allow them.

Rather not? Two-step sign-in for administrators, and how long a device may be remembered, are set on Details.

Who: Whoever changes how the whole organization signs in: an organization-wide role allows or requires passkeys, and the change is in the audit log. Turning them off, or no longer requiring them, is an Owner's alone, and every Owner is told at once.

Dara runs a network of twelve centers and wants staff to stop typing passwords on shared tablets. They choose Allow passkeys and press Save; the next morning Sokha adds a passkey from their phone and signs in with a fingerprint.

Require a passkey of every administrator

1. Add a passkey of your own first: open Your account, then Signing in, and press Add a passkey.
2. Come back here and choose Require passkeys for admins.
3. Press Save changes on the bar at the foot of the page.

Then: Anyone holding an organization-wide role who has no passkey is sent to Your account to add one before they can open anything else. Everyone else may still add one. Administrators your single sign-on covers are left out: they sign in through your provider and need none.

Rather not? An Owner chooses Allow passkeys and presses Save changes to stop requiring them; it asks them to confirm it's them, and every Owner is told.

Grace, an Admin, signs in with a password and a code on Monday after Mary Ann requires passkeys. Grace is taken to Your account, makes a passkey on their phone, and everything opens again.

Remind the administrators who have no passkey

1. Read the line under the choices: how many of your administrators have added a passkey.
2. Press the Remind button beside it. It says how many it reaches, such as Remind the 2.

Then: Each administrator without a passkey is told, by a notice and an email, to add one under Your account › Signing in. The page counts them and names nobody.

If an administrator can open nothing but Your account

1. Tell them to open Signing in on Your account, where they are sent.
2. Press Add a passkey there, on a phone or computer that can make passkeys.
3. Follow the phone's or computer's own steps: a fingerprint, a face or the device PIN.

Then: Once the passkey is added, everything opens again.

If the sign-in page has no passkey button

1. Check Passkeys policy here: Off means nobody signs in with one.
2. Check the address in the browser: passkeys work on your organization's ORG-APP address, not on a domain of your own.
3. Open the sign-in page at your organization's ORG-APP address and try again.