Two-Step Verification (MFA)

Two-step verification, also called multi-factor authentication (MFA), asks for a 6-digit code after your password each time you sign in to the supplier portal.

How it works​

When two-step verification is on, signing in takes two steps:

1. Enter your email and password as usual.
2. Enter a 6-digit code from one of your verification methods.

Two-step verification belongs to your user, so it applies wherever you sign in with that email address. You are asked for a code if either of these is true:

• You have turned on at least one verification method yourself.
• An MFA policy that covers your account requires it. In that case you can't turn it off, and you may be limited to certain methods.

Verification methods​

You can turn on both methods.

Turning on two-step verification​

1. Click your name at the top right of the portal, then select Account.
2. Scroll to the Security section. Each method shows Enabled or Not enabled, and when it was last used.

Set up an authenticator app​

1. Click Enable next to Authenticator app.
2. Scan the QR code with your authenticator app. If you can't scan it, click Copy key and enter the setup key in the app by hand.
3. Enter the 6-digit code the app shows, then click Verify.
4. Save your recovery codes. Use Copy all or Download, tick I've saved these codes, then click Done.

Set up email codes​

1. Click Enable next to Email codes.
2. Check your inbox for an email titled Your verification code.
3. Enter the 6-digit code, then click Verify.

Signing in with two-step verification​

After you enter your password, the Verify it's you screen opens.

• Authenticator app: enter the current 6-digit code from the app, then click Verify.
• Email codes: click Send code, enter the 6-digit code from the email, then click Verify. If the email doesn't arrive, you can click Resend code after 60 seconds.

You have 10 minutes to finish this step. If the time runs out, click Back to sign in and enter your password again.

If an MFA policy requires two-step verification and you haven't set up an allowed method yet, the Set up two-step verification screen opens after your password. Follow the steps on screen. If you set up an authenticator app there, save the recovery codes it shows you before you continue.

Recovery codes​

Recovery codes let you sign in if you lose access to your authenticator app.

• You get 8 codes when you set up an authenticator app. Each looks like ABCDE-FGHIJ.
• Each code works once.
• The codes are shown only once. Store them somewhere safe, such as a password manager.

To sign in with a recovery code, click Use a recovery code on the Verify it's you screen, enter one of your codes, then click Verify.

Regenerating recovery codes​

When you have 2 or fewer codes left, the Security section shows how many remain.

1. Click Regenerate codes next to Authenticator app.
2. Enter the current code from your authenticator app, then click Regenerate codes.
3. Save the new codes and click Done.

Removing a method​

1. Click Remove next to the method in the Security section.
2. Enter your password. If you sign in with Google or SSO, leave the password blank.
3. Click Remove.

Removing the authenticator app also deletes your recovery codes. If an MFA policy requires two-step verification, you can't remove your last allowed method.

Troubleshooting​