Security and sign-in
See how people sign in, require two-factor sign-in for everyone, suspend or erase accounts, and read the audit trail of who did what.
On this page
People sign in with their email and a password, or with Google or Microsoft when your sign-in page offers it. One sign-in works for every company the person can reach. Two-factor sign-in adds a 6-digit code from an authenticator app on top, and you can require it for everyone in the workspace.
Admin can do everything on this page. A custom role needs users.manage for Users and access, Security and the Audit trail. Only Admin can erase an account's data.
See who signs in with a password alone
- Go to Settings and choose Users and access.
- The 2-step column shows On or Off for each person, and Last signed in shows when they last did.
When some people sign in with a password alone, a message above the list says how many, and a dot appears next to Users and access in the settings menu. Download the list saves the list as a spreadsheet.
Require two-factor sign-in for everyone
- On Users and access, choose Require it for everyone in the message above the list, then confirm.
- Or go to Setup and choose Workspace. On the Sign-in row, choose Review or Open. Turn on Require two-factor authentication and choose Save.
Nobody is locked out. Each person who has not set it up yet is walked through it the next time they sign in. To stop requiring it, turn the setting off on the same Security page and choose Save. Each person can also turn it on for themselves; see Your account.
Suspend, restore or erase an account
On Users and access, open More next to the person:
| Action | What happens |
|---|---|
| Suspend account | They are signed out everywhere and cannot sign in. Their record, approvals and history stay as they are. You can add a Reason. |
| Restore account | They can sign in again. They need at least one company to work in. |
| Erase account data | Removes their sign-in methods and personal data for good. The account must be suspended first, and you type their email to confirm. Only Admin can do this, and never on their own account. |
The Active, Invited and Suspended switch above the list shows each group of people.
Help someone who cannot sign in
- The sign-in page has a link for a forgotten password. It emails a link to set a new password, which expires in an hour.
- After too many failed attempts, sign-in is paused for a few minutes.
- Someone who lost their authenticator app can use one of their recovery codes instead: choose Use a recovery code instead when the code is asked for.
- An Admin can type a new Password for the person on their Edit page. Left blank, the saved password is kept.
When a person's role or companies change, or their password changes, they are signed out of open sessions and sign in again.
Check the audit trail
The audit trail records changes, approvals, downloads, sign-ins and who looked at hidden details.
- Go to Setup and choose Audit trail. Entries are grouped by day, newest first.
- Use the switch at the top to show Everything, Changes, Hidden details seen, Downloads, Sign-ins or Automatic.
- Narrow it with Period, Who, About and Company. Open an entry to see what changed, Before and After.
- Choose Download this view to save what you see as a spreadsheet.
Beside the list, This week counts the week's activity and shows Who looked at hidden details. Check now checks that no entry was changed or removed after it was written. You see entries for the companies you can reach, plus those about the whole workspace.