Skip to main content

8. Two-step security

Two-step security adds a second check after your password: a six-digit code from an authenticator app on your phone. DFFMS also gives you recovery codes and, for some roles, passkeys.

Who can do it: every staff member, for their own account. The Platform Super Administrator can make two-step security mandatory for all staff (section 11).

Before you start

  • Install an authenticator app on your phone. Any standard authenticator app works.
  • Keep your phone with you during setup.
  • Have a safe place ready for your recovery codes. Do not store them on the same phone, or in a shared document.

8.1 Set up an authenticator app​

  1. Sign in. If prompted, go to Account security. You can also open it from the profile menu (click your name, then Account security).
  2. Read the heading Secure your account.
  3. In Current password, type your password.
  4. Click Begin authenticator setup.
  5. The screen shows:
    • a setup key (a long text code). Click the copy button labelled Copy authenticator setup key to copy it.
    • a QR code. Use this instead of the key if you prefer.
  6. In your authenticator app, choose Add account (or the plus sign). Then either:
    • scan the QR code on the screen, or
    • choose Enter a setup key and paste the key.
  7. The app starts showing six-digit codes that change every 30 seconds.
  8. Back in DFFMS, under Single-use recovery codes, copy or write down every code. Store them in an approved secure location.
  9. Tick I saved these recovery codes in an approved secure location.
  10. In Six-digit verification code, type the code now showing in your app.
  11. Click Verify authenticator. The screen shows Authenticator verified.

8.2 Recovery codes​

  • Recovery codes are for when you cannot get a code from your phone.
  • Each code works only once.
  • Store them offline, in a safe place. Treat them like cash.
  • If you use a code, make a fresh set as soon as you can.

Common problems

  • The setup key was pasted into a chat or email. Treat the old authenticator setup as exposed. Tell your administrator. Set up a new authenticator from a clean start.
  • You lost your phone. Use a recovery code to sign in. Then set up a new authenticator app from Account security.
  • The button is greyed out. You must tick the box for the recovery codes first.

8.3 Passkeys​

A passkey is a sign-in method stored on your device, such as a fingerprint or face unlock. It is harder to fake than a password.

  • The Platform Super Administrator must register a device passkey when two-step security is mandatory. The page says: Platform Super Administrators must also register a phishing-resistant device passkey.
  • Other staff can add a passkey from the same screen if it is offered.
  • To add one, click Register this device passkey (or the passkey button on Account security) and follow your device prompts.
  • Register a passkey on each device you use to sign in.

Common problems

  • The passkey prompt does not appear. Check you are on the DFFMS address in your browser, and that your device allows passkeys.
  • You see "Setup interrupted". Your secure session may have ended. Sign in again and start from Account security.

8.4 Mandatory two-step security​

  • By default, two-step security is off for general portal access.
  • The Platform Super Administrator can turn on Require MFA before staff portal access in the Security centre. Then every staff member must set up an authenticator.
  • Some actions always need two-step security, even when the policy is off. See section 10.