Reminders to turn on two-step sign-in
An owner or admin can email the members who have not turned on two-step sign-in, asking them to. The reminder says who asks and links to the page where they set it up. On Enterprise with an email connector, it comes from your own domain.
TL;DR
| Question | Answer |
|---|---|
| Who can send them? | The owner and the admins, signed in to the portal. A key or a connected agent cannot. |
| Which plan? | Every plan with organisations. The reminder goes through your email connector when the organisation has one, which is Enterprise. |
| Who gets one? | The members you choose, or every member without two-step sign-in. A member who has it on is never reminded. |
| How often? | At most once a day for each member, from one organisation. A member reminded less than a day ago is skipped, and the answer says when they can be reminded again. |
| How many at once? | Up to 200 members a time. |
| What does it say? | Which organisation asks, who sent it, whether the organisation requires two-step sign-in, and a link to the account's Security page. |
| Is it recorded? | Yes, in the organisation's audit log as orgs.security.reminder, with how many were sent and how many skipped. Not who. |
Send reminders
- Open the organisation, then Security in its sidebar.
- Under Who has it on, find the members without two-step sign-in.
- Remind one member, or every member without it at once.
The page then shows who was reminded, and who was skipped because they had a reminder less than a day ago.
What the member does
The reminder links to the Security page of their own account, where they set up an authenticator app in four steps. Two-step sign-in has the steps. Once it is on, they drop off the list, and no further reminder can go to them.
With an email connector
| Organisation | The reminder comes from |
|---|---|
| Enterprise, with an email connector that is on | Your own From address, through your provider |
| Enterprise, with a connector that fails | Plotwork's address. The Connectors tab shows why your provider refused it. |
| Any other | Plotwork's address |
An email from your own domain, signed by your own provider, reads as an internal request, so members are less likely to mistake it for phishing. See Connectors.
Through the API
| Task | Endpoint |
|---|---|
| See who is without it, and when each was reminded | GET /orgs/{org}/security |
| Remind members | POST /orgs/{org}/security/reminders, with userIds, or none for every member without it |
The answer lists sent, the members a reminder went to, and skipped, each with nextAt, when they can be reminded again.
See also
| Page | Why |
|---|---|
| Two-step sign-in | Turning it on, and requiring it for an organisation |
| Connectors | Sending the reminders from your own domain |
| Email through your own domain | Setting up the email connector |
| Audit log | Where each round of reminders is recorded |