Skip to main content

Admin Console Two-Factor Authentication

Signing in to the Beak admin console requires a password and a six-digit code from an authenticator app. This applies to every administrator — the platform super administrator, tenant administrators, and delegated administrators alike. There is no setting that turns it off.

This is separate from the two-factor policy you set for a tenant's own users. That one is configured per tenant under Security; this one governs the console you are reading about, and is not configurable.

It cannot be turned off​

There is deliberately no switch — not in Settings, not per tenant, and not as an environment variable.

The console previously carried a platform setting for this. It defaulted to on, no screen displayed it, and it could still be changed through the API — so it was a control that nobody could see and that could remove the second factor for every administrator on the platform at once. It has been removed rather than surfaced.

What this means in practice:

  • Every administrator enrols. An administrator who has not yet enrolled is taken through enrolment the next time they sign in, and holds no session until it is finished.
  • The recovery lever is a reset, not an exemption. When someone loses their device you clear their authenticator and they enrol a new one. There is no state in which the console has no second factor.
  • A faulty enrolment path has no workaround. If enrolment itself ever breaks, there is no flag to fall back on — the fix is to roll back the release. This is the accepted cost of not shipping a switch that can disable the second factor.

Set up your authenticator at first sign-in​

An administrator with no authenticator meets this the first time they sign in, after their password is accepted:

  1. Enter your email address and password as usual, then choose Sign in.
  2. The console shows a QR code. Scan it with an authenticator app — 1Password, Authy, Microsoft Authenticator and Google Authenticator all work.
  3. If you cannot scan, add the setup key shown beneath the code by hand, as a time-based (TOTP) key.
  4. Enter the six-digit code the app shows and choose Confirm and sign in.

You are signed in as soon as the code is accepted. There is no way to skip the step and no way back to the password form — the enrolment expires after ten minutes, and starting again simply means signing in again.

Note: The sign-in form always offers an optional code field, whether or not your account has an authenticator. It does not ask first, because asking would tell anyone who reached the login page which email addresses are administrators with two-factor enabled. Leave it empty if you have not enrolled yet.

Move to a new phone​

Replacing an authenticator you still have is self-service — you do not need another administrator, and you do not need to be locked out first.

  1. Choose your avatar in the top right of the console, then Security.
  2. Choose Replace authenticator.
  3. Enter your password and a current code from the authenticator you are replacing.
  4. Scan the new QR code, then enter a code from the new app to confirm.

Your old authenticator stops working the moment you confirm. The current code is required because a password alone — or a session alone — must not be enough to change the factor that protects the account.

The same screen shows whether your account currently holds an authenticator, so you can check without signing out.

Note: If you have already lost the device, you cannot use this screen — there is no current code to enter. Ask another administrator to reset your authenticator instead.

Reset an administrator who lost their device​

Resetting clears the authenticator on the account. The administrator is then asked to enrol a new one at their next sign-in; nothing else about the account changes and their password is untouched.

  1. Open Administrators.
  2. Find the administrator and choose Reset MFA in the row's actions.
  3. Confirm.

Tell them to sign in again — they will be walked through enrolment.

The action is offered on every row, including administrators who have not enrolled yet (where it does nothing) and the super administrator. It is not offered to a delegated administrator whose own permissions do not extend to managing administrator accounts.

Reset a platform administrator​

The platform administrator account — the one provisioned from the platform's own configuration rather than created in the console — appears on the Administrators list marked as a platform account. Its only row action is Reset MFA; it is managed through configuration, so the console does not edit, disable or delete it.

Resetting it requires an administrator with global reach, not merely the permission to manage administrators. It is the account of last resort, so a tenant-scoped administrator cannot strip its second factor.

Every reset of a platform administrator is written to the audit log with who performed it and how many credentials were cleared.

What the Administrators list shows​

The MFA column reports the authenticator on the console account itself:

  • On — the administrator holds an authenticator and can sign in.
  • Not enrolled — the account exists but has not finished enrolment. They will be asked at their next sign-in.
  • Unknown — the identity platform could not be reached, so the state could not be read. It is shown as unknown rather than as off, because the two mean very different things on this column.

Note: This column reflects the console authenticator. An administrator who also uses a Beak product may have a separate authenticator for that product, shown on the tenant's Users page. The two are independent, and resetting one does not affect the other.

Best Practices​

  • Enrol a second administrator before you need one. Recovery from a lost device runs through another administrator, so a platform with exactly one console account has no recovery path but a rollback.
  • Use an authenticator that is backed up. 1Password and Authy sync their keys; a device-bound app means a lost phone is always a reset.
  • Replace, do not reset, for a planned phone change. Replacing keeps the account protected the whole time; a reset leaves it waiting to enrol.
  • Watch the MFA column after inviting administrators. A row sitting at Not enrolled is someone who has not signed in yet.