Two-factor login: a second step after your password

Turn on two-factor login so a stolen or guessed password is not enough to open your account. Choose a code sent by SMS, a code sent to your email, or a code from an authenticator app, and learn what to do if you lose your phone.

Checked on the ShuleOS demo school Who: Anyone who signs in to the admin portal (teachers have the same option in the teacher portal) 5 min read

Two-factor login adds a second step after your password: a six-digit code that only you can get. A thief who learns your password still cannot sign in without it. It is switched off until you turn it on, and each person turns it on for their own login.

Pick the way that suits you. You can use any one of the three:

Way	How the code reaches you	Good to know
SMS code	A text message to your mobile number.	Easiest for most people. The text is sent through your school's own SMS account, so it uses a little of the school's SMS. Needs SMS set up in Messaging settings.
Email verification codes	An email to your login address.	Needs nothing on your phone. Only as safe as your email account, so keep that password strong.
Authenticator app	A code from an app on your phone, such as Google Authenticator, Microsoft Authenticator or Authy.	Works without signal or internet and is the strongest. Gives you recovery codes for a lost phone.

Turn it on

Click your name at the top right and choose Two-factor login.
Under the way you want, click Set up.

SMS code. Type your mobile number, click Send the code, then type the six-digit code that arrives and click Turn on. The code must be sent to the same number you typed. If it says SMS is not set up, ask a school administrator to set it up, or choose email.

Email verification codes. A code is sent to your login email at once. Type it in and confirm.

Authenticator app.

Open the app on your phone and scan the QR code. If you cannot scan it, type the key shown under the code into the app.
Type the six-digit code the app shows now and click Next.
Write down or save your recovery codes now. They are shown only this once.

The page then shows the way you chose as Enabled. You only need one.

Signing in afterwards

Enter your email and password as usual.
A second box asks for the 6-digit code. For SMS and email, the code is sent to you at that moment: it lasts 4 minutes and works once. Click Send a new code if it did not arrive. A few new codes can be asked for in a short time, then you must wait.
Type the code and sign in.

If the code is refused, check you typed the newest one. For an authenticator app, also check your phone's date and time are set automatically.

If you lose your phone

Authenticator app: on the code box, click Use a recovery code and type one you saved. Each works once. After signing in, set two-factor up again on your new phone and save the new recovery codes.
SMS code: if you got a new phone number, you cannot receive the code. Ask an administrator to reset your two-factor login (below).
Email code: you need access to your email. If you lost that too, ask an administrator to reset it.

When a colleague has lost their way of getting codes (for example a new number and no recovery codes), an administrator can take two-factor login off their account:

Open Account → Users (or the Teachers list for a teacher's login).
On their row, click Reset two-factor login and confirm.

Their login goes back to a password alone, and they can set it up again from their menu. The reset is recorded in the Audit Log with who did it. The button only appears for someone who has two-factor turned on, and never on your own row: to switch off your own, click Disable on your Two-factor login page, which asks for a code first. If you are the only administrator, contact ShuleOS support.

Where you are signed in

Below the two-factor options, the same page lists every phone and computer that is signed in to your login now, with the browser, the address it connected from and when it was last active. Your own device is marked This device.

Sign out next to a device ends that session; whoever is using it has to sign in again at their next click.
Sign out all other devices ends every session except the one you are using. Use it if you lost a phone or signed in on a shared computer.
If you see a device you do not know, sign it out and change your password.

The list shows this portal only (for example the admin portal, or the teacher portal). Signing out a device ends its session in every portal in that browser. Each sign-out is recorded in the Audit Log.

Good to know

Turning it on, off or resetting it is recorded in the Audit Log, naming the way but never the code, the secret or your number.
The ShuleOS team's own console requires two-factor login on the live system, so nobody can open the whole platform with a password alone.
When ShuleOS support signs in to your portal to help you, they do not need your code and you are not asked for it.
Parents do not have this option: their portal only shows their own children.
Do not share a code with anyone, even someone who says they are from ShuleOS. Support never asks for it.

If something goes wrong

What you see	What it means and what to do
"SMS is not set up"	Your school has no SMS account switched on. Ask an administrator to set it up in Messaging settings, or choose email or the authenticator app.
The code never arrives	Click Send a new code. For SMS check the number; for email check the junk folder. If it still does not come, use another way, or ask an administrator to reset yours.
"The code is not right, or it has expired"	Codes last 4 minutes and work once. Ask for a new one and type the newest.
"A new code could not be sent"	Too many were asked for. Wait a few minutes and try again.
You cannot find Two-factor login	Click your name at the top right. It is in that menu.