# Reminders to turn on two-step sign-in

> Page: https://docs.plotwork.dev/connectors/two-step-reminders. Index of every page: https://docs.plotwork.dev/llms.txt

An owner or admin can email the members who have not turned on two-step sign-in, asking them to. The reminder says who asks and links to the page where they set it up. On Enterprise with an email connector, it comes from your own domain.

## TL;DR

| Question | Answer |
|---|---|
| Who can send them? | The owner and the admins, signed in to the portal. A key or a connected agent cannot. |
| Which plan? | Every plan with organisations. The reminder goes through your email connector when the organisation has one, which is Enterprise. |
| Who gets one? | The members you choose, or every member without two-step sign-in. A member who has it on is never reminded. |
| How often? | At most once a day for each member, from one organisation. A member reminded less than a day ago is skipped, and the answer says when they can be reminded again. |
| How many at once? | Up to 200 members a time. |
| What does it say? | Which organisation asks, who sent it, whether the organisation requires two-step sign-in, and a link to the account's Security page. |
| Is it recorded? | Yes, in the organisation's audit log as `orgs.security.reminder`, with how many were sent and how many skipped. Not who. |

## Send reminders

1. Open the organisation, then **Security** in its sidebar.
2. Under **Who has it on**, find the members without two-step sign-in.
3. Remind one member, or every member without it at once.

The page then shows who was reminded, and who was skipped because they had a reminder less than a day ago.

## What the member does

The reminder links to the Security page of their own account, where they set up an authenticator app in four steps. [Two-step sign-in](https://docs.plotwork.dev/two-step-sign-in.md#turn-it-on) has the steps. Once it is on, they drop off the list, and no further reminder can go to them.

## With an email connector

| Organisation | The reminder comes from |
|---|---|
| Enterprise, with an email connector that is on | Your own From address, through your provider |
| Enterprise, with a connector that fails | Plotwork's address. The Connectors tab shows why your provider refused it. |
| Any other | Plotwork's address |

An email from your own domain, signed by your own provider, reads as an internal request, so members are less likely to mistake it for phishing. See [Connectors](https://docs.plotwork.dev/connectors/overview.md).

## Through the API

| Task | Endpoint |
|---|---|
| See who is without it, and when each was reminded | [`GET /orgs/{org}/security`](https://docs.plotwork.dev/api/get-orgs-org-security.md) |
| Remind members | [`POST /orgs/{org}/security/reminders`](https://docs.plotwork.dev/api/post-orgs-org-security-reminders.md), with `userIds`, or none for every member without it |

The answer lists `sent`, the members a reminder went to, and `skipped`, each with `nextAt`, when they can be reminded again.

## See also

| Page | Why |
|---|---|
| [Two-step sign-in](https://docs.plotwork.dev/two-step-sign-in.md) | Turning it on, and requiring it for an organisation |
| [Connectors](https://docs.plotwork.dev/connectors/overview.md) | Sending the reminders from your own domain |
| [Email through your own domain](https://docs.plotwork.dev/connectors/email.md) | Setting up the email connector |
| [Audit log](https://docs.plotwork.dev/audit-log.md) | Where each round of reminders is recorded |