Two-factor authentication

You can now put a second factor on your Tediware account with any authenticator app, instead of a password being the only credential on it, and an organization admin can require it of every member.

Impact: nothing changes until you turn it on. Set it up from account settings, whether or not your organization asks for it, and expect a dashboard prompt until you do, returning 30 days after each time you dismiss it. If you administer an organization, set your own factor up first, then require it for everyone from the Organization page.

What to know once it is on:

• Turning the factor on, replacing it, or turning it off signs out every other session on the account.
• Turning it off requires a current code from the authenticator, and is refused while your organization requires one.
• You get ten single-use recovery codes at the end of setup, shown once, and you have to confirm you have stored them before you can continue. Account settings shows how many are left. Generating a new set invalidates the old one immediately, so anything you printed stops working.
• Five wrong codes in a row lock the account for 15 minutes.

The organization-wide requirement:

• An admin has to hold a factor before they can require one, otherwise turning it on would lock them out of their own organization on their next request. The same button lifts it again.
• Members without a factor are sent to setup on their next request. There is no grace period and no exemption by role, including read-only users, and nobody can turn their own factor off while the requirement stands.

This update was written with AI assistance. It has been reviewed and edited by a human.