Account Security
Protect your account with strong authentication, MFA where available, careful session management, and the site’s required Step-Up checks.
- Review account protectionsCheck the security settings available to your account.
- Enable an additional factorEnroll and verify MFA where the account offers the option.
- Store recovery materialKeep recovery codes private and separate from the account.
- Review sessionsRevoke sessions or connected access you no longer recognize.
- Complete sensitive checksSatisfy genuine MFA or Step-Up prompts for protected actions.
Strengthen sign-in
Use a unique password for a password-based account and protect the email identity used for verification and recovery. Open account security settings after signing in to review the MFA options available to you. Enrolment requires completing the site’s verification flow; simply opening the settings page does not enable a factor. Organisation-managed SSO may also involve controls administered by your identity provider, so coordinate with that administrator when the account’s security policy is managed centrally.
- Review the security settings from your signed-in profile.
- Enroll an offered MFA method and complete its verification.
- Protect the recovery address and any account recovery material.
Protect recovery codes and factors
Recovery codes can help restore access if an enrolled factor is unavailable, so keep them private and store them somewhere separate from the account they protect. Do not send codes to support or enter them into a link received unexpectedly. If your authenticator is lost or compromised, use the account’s available replacement or recovery process and follow any fresh verification required. Recovery actions can invalidate old factors or sessions; read the confirmation shown before completing them.
- Save recovery codes in a protected location outside the account.
- Never disclose a one-time code or recovery code to another person.
- Use the official security flow to replace a lost or compromised factor.
Review and revoke sessions
Use the sessions page to inspect the active sessions and connected access presented for your account. Revoke sessions or trusted devices that you no longer recognize or use, and review connected application access separately where shown. Revoking access can interrupt your own active work, so confirm the selected entry before acting. If you see activity you cannot explain, secure the account first, then contact support with a time and description rather than sharing authentication secrets.
- Open the account sessions page and inspect its entries.
- Revoke unfamiliar sessions, devices, or connected applications.
- Change compromised credentials and report unexplained activity.
Respect MFA and Step-Up checks
Some actions require fresh authentication or an additional factor even after a successful sign-in. Complete the prompt in the same genuine account flow and verify that the requested action succeeded before leaving the page. A Step-Up check is an intentional security boundary; changing routes, browser state, or account details is not a substitute for the required evidence. If you cannot complete a challenge, use the official recovery path or contact support rather than asking another person to bypass the control.
- Complete the MFA or Step-Up challenge shown by the application.
- Confirm the protected action’s resulting status or confirmation.
- Use account recovery or support if you cannot satisfy the challenge.
Frequently asked questions
Does signing in once remove later MFA checks?
No. Sensitive actions may require a fresh MFA or Step-Up check. Complete the challenge when requested.
Where should I keep recovery codes?
Store them privately and separately from the account. Do not share them with support or enter them on an unexpected page.
What should I do about an unfamiliar session?
Revoke it from the sessions page, secure your credentials, and contact support if the activity remains unexplained.
Can support bypass a lost MFA factor?
No. Use the official account recovery or factor replacement process, which may require additional verification.