Two-factor authentication (2FA) protects your Diri account with a 6-digit code from an authenticator app on your phone, in addition to your password. Even if someone learns your password, they cannot sign in without your phone.
Two-factor authentication in Diri applies to password sign-in only. If you sign in with Microsoft, your organisation's Microsoft account protects your sign-in, and you do not set up two-factor authentication in Diri.
- An authenticator app on your phone, for example Microsoft Authenticator, Google Authenticator, 1Password or Bitwarden.
- Your Diri password.
- A safe place to store your recovery codes, such as a password manager.
Setup takes about two minutes.
You can start setup in two ways: answer Yes, set it up when Diri asks “Set up two-factor authentication?” after you sign in, or start it yourself from My Account:
- Open My Account from the user menu in the top right corner.
- Under Two-factor authentication, click Set up.
- Enter your Password and click Continue. This stops anyone from adding their own phone to your account from a browser you left signed in.
- Scan the QR code with your authenticator app. If you cannot scan it, add an account in the app by hand and enter the key shown (use Copy key). The QR code is valid for a limited time; if it expires, start again.
- Enter the 6-digit code the app shows for Diri and click Turn on.
- Save your recovery codes: use Copy codes or Download as text file, and store them somewhere safe. This is the only time they are shown.
- Tick I have saved my recovery codes and click Done.
Turning two-factor authentication on signs you out of Diri in every other browser.
If you answer No, thanks to the question at sign-in, you will not be asked again. You can turn it on at any time from My Account.
- Enter your email and password as usual.
- On Enter your code, open the authenticator app and enter the 6-digit code it shows for Diri.
- Click Verify.
After five wrong codes in a row, code entry is paused for 15 minutes and you receive an email about it. If the sign-in takes too long, enter your email and password again.
Recovery codes let you sign in if you do not have your phone. Each code works once.
- To use one, click Use a recovery code instead on the code step and enter one of your saved codes.
- My Account shows how many unused recovery codes you have left, and warns you when few are left.
- To get new codes, click New recovery codes on My Account and confirm with a code from your authenticator app. Your old recovery codes stop working.
- To turn it off, click Turn off on My Account and confirm with a code from the app or a recovery code. This signs you out in every other browser.
- To move to a new phone, turn it off and set it up again on the new phone.
- If your organisation requires two-factor authentication, you cannot turn it off yourself. For a new phone, ask your administrator to reset it, then set it up again at your next sign-in.
¶ Lost your phone and your recovery codes?
Ask your administrator to reset two-factor authentication for your account. After the reset you are signed out everywhere, receive an email, and are asked to set up two-factor authentication again the next time you sign in.
Administrators of a top-level organisation can require two-factor authentication for everyone who signs in with a password. The requirement covers every sub-organisation and every user who belongs to any of them. Users who sign in with Microsoft are not affected.
- Go to Users & Access → Organisation.
- Open the settings for your top-level organisation (the settings icon on the organisation bar).
- On the General tab, find Require two-factor authentication and switch it on.
- Choose Required from. Choose today to require it at once, or a later date (up to a year ahead) to give people time to install an authenticator app.
- Click Require.
What users experience:
- Before the date: users without two-factor authentication are asked to set it up at each sign-in, but can choose Later.
- From the date: sign-in waits until the user has set it up. Setup runs as part of sign-in and takes about two minutes.
- While it is required, users cannot turn two-factor authentication off themselves.
To stop requiring it, switch the setting off and confirm with Stop requiring. Users can then turn it off themselves, and new users are only asked whether they want it.
The setting is only available on the top-level organisation. Diri staff and super admins must always use two-factor authentication.
In Users & Access → Users, the Two-factor column shows each user's status:
- On – the user signs in with a password and a code from an authenticator app.
- Off – the user signs in with a password only.
- Microsoft sign-in – the user signs in with Microsoft, so their organisation's Microsoft account handles two-factor authentication.
If the column is not shown, add it with Configure on the table.
Use a reset when a user has lost both their phone and their recovery codes.
- Go to Users & Access → Users and open the user.
- Under Two-factor authentication, click Reset two-factor.
- Confirm with Reset.
Two-factor authentication is turned off for the user, they are signed out everywhere and receive an email, and they are asked to set it up again at their next sign-in. The reset is recorded in Latest Events.
- You can reset two-factor authentication only for users in organisations you administer.
- You cannot reset your own; turn it off under My Account instead.
- Only a super admin can reset two-factor authentication for Diri staff and super admins.