Skip to main content

Two-Factor Authentication for Staff

Last updated

Two-factor authentication (2FA) adds a second step to the staff login: after entering your email and password you must also enter a 6-digit code, either from an email sent to you or from an authenticator app on your phone. 2FA for staff is a feature that must be enabled for your school — contact support if you would like it turned on. Schools can also make 2FA compulsory for particular categories of users.

Two-factor authentication (2FA) adds a second step to the staff login: after entering your email and password you must also enter a 6-digit code, either from an email sent to you or from an authenticator app on your phone. 2FA for staff is a feature that must be enabled for your school — contact support if you would like it turned on. Schools can also make 2FA compulsory for particular categories of users.

How 2FA works at login

  1. Log in with your email and password as usual.
  2. A Two-Factor Authentication screen appears:
  • Email method — a 6-digit code is emailed to your registered email address. The screen says "Enter the 6-digit code from the email we sent you".
  • Authenticator app method — the screen says "Enter the 6-digit code from your authenticator app".
  1. Type the 6-digit code. It is checked automatically as soon as all six digits are entered.

Emailed codes are valid for 10 minutes and can only be used once. Each code (email or app) cannot be reused for a second login. If the code is wrong or has expired, the message "Invalid two-factor authentication code." is shown and you are returned to the login screen to start again.

2FA applies to email/password logins only. Signing in with Google or Office 365 is not challenged for an edge 2FA code — those providers have their own two-factor settings.

Screenshot: The Two-Factor Authentication screen with the 6-digit code field

Setting up 2FA on your profile

  1. From the Dashboard, click Edit Profile.
  2. Scroll to Login Preferences.
  3. Tick Enable Two Factor Authentication.
  4. Under Choose a 2FA method, select one of:
  • Email (send a code each time you log in) — no further setup; make sure your email address is up to date.
  • Authenticator app (Google Authenticator, Microsoft Authenticator, etc.) — a QR code is displayed. Scan it in your authenticator app, then enter the 6-digit code the app shows into the Verification code box. The setting will not save unless the verification code is correct.
  1. Choose a Require 2FA again after interval (see below).
  2. Save your login preferences.

If an incorrect verification code is entered when setting up the app method, the message "Invalid two factor authentication code. Settings have not been saved." is shown.

Screenshot: Login Preferences showing the Enable Two Factor Authentication option, method choices and QR code

The "Require 2FA again after" interval

This controls how long you can go before being asked for a 2FA code again. Options are 0 days (required every time), 1–5 days, 1 week, 2 weeks, 3 weeks and 4 weeks. The default is 0 days.

The "remembering" is based on where you log in from: after a successful 2FA code entry, your current network address is trusted for the chosen number of days. You may be prompted earlier than the interval if you log in from a different device or your network environment changes. If your school enforces a maximum interval, only options up to that maximum are available.

When 2FA is compulsory at your school

School administrators can require 2FA for categories of users (Admin Users, Teachers, and — where enabled — Students and Caregivers), each with a Maximum interval. These settings are on the School Settings page under Two-Factor Authentication Settings. If a user belongs to multiple categories, the most strict requirement applies.

If 2FA is made compulsory and you have not set anything up, email-based 2FA is enabled for you by default. You can switch to an authenticator app (recommended) at any time from your profile. When compulsory, your profile shows "Two Factor Authentication must be enabled for this account per school policy" and the enable option cannot be unticked.

The compulsory-2FA settings for students and caregivers are gated separately and must be enabled for your school — contact support.

Screenshot: School Settings — Two-Factor Authentication Settings with Require 2FA checkboxes and Maximum interval dropdowns

Lost your phone or can't receive codes?

  • Authenticator app lost or reinstalled — a user with system-access management permissions at your school can clear your 2FA from the Reset Passwords page (a Reset 2FA button appears for users who have 2FA enabled). You can then set 2FA up again from your profile.
  • Not receiving email codes — check your registered email address is current on your profile, and check spam/junk folders. If the code email cannot be sent at all, the login screen shows "Error sending two factor authentication code." — contact your school administrator.
  • To reconfigure the app method yourself (while you can still log in): switch to a different 2FA method, save, then reselect the authenticator app option, scan the new QR code, verify and save.

edge and Helix are separate

2FA settings are stored separately for edge and Helix. If your school moves to Helix, set up your 2FA method again on the Helix site.