1. Docs
  2. Account Settings
  3. Administrator Sign-In

Administrator Sign-In

Require a second factor of every administrator of the Account, set the grace period, decide whether single sign-on counts, and choose how long a remembered browser skips the step.

Require two-factor authentication

In the Admin Workspace, Settings → Administrator Sign-In holds the Account's policy for the people who administer it. A second factor belongs to the person, not the Account: an administrator enrols an authenticator app or a passkey once on their profile, and it counts for every Account they belong to.

Application
Admin Workspace
Path
SettingsAdministrator Sign-In
Opens with
  • account.manage Edit the account's profile and general settings: its name, the details that identify it, and how its administrators sign in (whether a second factor is required, and the grace, single sign-on and remembered-device rules around it). This does not include billing, and it does not include anything inside an environment.
Context
Account-wide, for administrators who govern the Account.
Require two-factor authentication
Enrol a second factor of your own first, from Your Profile in the avatar menu. The API refuses to turn the requirement on for someone who could not meet it.Open Settings → Administrator Sign-In from the left nav and switch on Require two-factor authentication.Set the Grace period: how many days an administrator without a factor has, counted from their next sign-in, before they can no longer sign in. Zero means they enrol before they get in at all.Decide whether Challenge after an SSO sign-in is on. Off, an identity provider's own sign-in satisfies the policy; on, Canopy asks for the factor as well.Set Remember a device for: how many days a browser an administrator asked to remember skips the second factor on password sign-ins. Zero means every sign-in asks.Click Save changes and confirm. Administrators without a factor are told at their next sign-in and see the deadline in a banner until they enrol; the Two-factor column under Administrators → Users shows who has.

Lost your device?

No one in the Account can reset another administrator's second factor, the owner included. That is deliberate: a reset by a colleague would be the weakest link in the policy. An administrator who loses their device has two ways back.

Lost your device?
Sign in with one of the recovery codes issued when the first factor was enrolled. Each works once; Your Profile shows how many remain and issues a fresh batch on request.Without a recovery code, contact Canopy support from the email address on the account. Support verifies the person and clears their factors, and the next sign-in enrols a new one.
If you don't see this

Each control on this page exists only for someone who may use it. When something described above is missing, one of these is why:

Administrator Sign-In is not in the left nav. Opening it needs account.manage, the same capability as General.Saving refused the requirement. Turning it on needs a second factor of your own; enrol one on your profile and save again.
Change the Account Name → Invite and manage administrators →
Environment
API version
v1.0
 On this page Was this page helpful?

Tell us how we can improve this guide.

Canopy