Sign-in methods, two-factor and trusted devices
Choose how members sign in, require two-factor authentication, and what people see with trusted devices and lockouts.
Sign-in rules are set per organization, in the Sign-in and security panel of Settings, General. They need the Manage organization settings permission and apply to everyone in the organization.
Choose how members sign in
Under Members can sign in with, pick at least one:
| Method | How it works |
|---|---|
| Email and password | A password of at least 10 characters. Halo refuses passwords known from breaches |
| Emailed code | A sign-in link and a 6-digit code, sent to their email. It expires after 15 minutes |
Save with the bar at the bottom of the page. You can't turn off the method you signed in with: sign in another way first, so you don't lock yourself out.
What members see
The sign-in page shows both methods, because Halo doesn't know the organization until someone signs in. Someone who uses a method your organization doesn't allow gets told which one to use. For a password, that's Use an emailed code, with Email me a code instead. The message appears only after the password is right, so it doesn't tell a stranger where someone works.
Someone already signed in another way is asked to sign in again when they next open your organization.
Narrowing the methods also stops AI tool connections made with a method you've turned off.
Require two-factor authentication
Turn on Require two-factor authentication in the same panel. Set it up for yourself first: Halo won't let you require it otherwise.
Members without an authenticator app are asked to set one up the next time they sign in. It takes about a minute. The Members page has a Two-factor column so you can see who's done it.
Set it up for yourself
In Account, under Two-factor authentication, press Set up.
Scan the QR code with an authenticator app such as 1Password, Google Authenticator or Authy.
Enter the 6-digit code the app shows for Halo.
Save the recovery codes. They're shown once, and each works once.
When your organization requires it, the Turn off button goes away and Account says who requires it. New recovery codes replaces the old ones.
Lost your phone
On the sign-in page, press Use a recovery code instead. If you've lost those too, you can't sign in, so ask an Admin in your organization to contact Halo. Halo can reset your two-factor authentication. That turns it off, removes your recovery codes, signs you out everywhere, forgets your trusted devices, and emails you. It appears in your organization's audit log.
Trusted devices
After entering a code, people can tick Trust this device for 30 days, so that browser skips the code. They still enter their password or emailed code. Don't use it on a shared computer.
In Account, Trusted devices lists these browsers with when they expire. Forget one or Forget all to ask for a code again.
Changing a password or two-factor authentication forgets them all, and so does a reset by Halo.
Lockouts
Halo slows anyone guessing, and it doesn't let them keep the real person out.
| What happened | What they see | What to do |
|---|---|---|
| 10 wrong passwords | "Too many failed attempts. Try again in 15 minutes, or reset your password." | Wait, or use Forgot password?. A reset clears the lock |
| 5 wrong two-factor or recovery codes in a row | Too many wrong codes, and two-factor sign-in pauses for 15 minutes | Wait. If it wasn't them, change the password |
A browser that has signed in to an account before keeps its own count of wrong passwords. It gets past a lock caused by someone else, and it still has to give the password and any second factor.
Wrong two-factor codes mean someone has the password, so Halo also ends sign-ins waiting on a code, emails the person and records it in the audit log. The email says to change the password if it wasn't them.
An emailed code allows 5 tries. Then ask for a new one.
Sessions
A session lasts up to 30 days, and ends after 14 days without use.
In Account, Where you're signed in lists your devices. Sign out any you don't recognize, then change your password. Sign out everywhere else ends all your other sessions. Changing your password does too.
Sign out everywhere doesn't disconnect AI tools. Do that under AI tools in Account, or change your password, which disconnects them.
See what happened
Sign-ins, failures, lockouts and changes to these settings are in the audit log. Filter by Sign-ins.