Authentication App

All Access IDM uses a time-based one-time password (TOTP) from an authenticator app as your second factor during sign-in. Your administrator sets up your initial token. Use this guide if you need to replace it because you got a new phone, lost your device, or switched apps.

Replacing your authenticator app token

Sign in with your email address and password as usual. On the page that asks for your code, click Lost Token?.
Enter your email address and submit. A recovery link will be sent to your email.
Click the link in the email and enter your email address and password to continue.
You'll be sent a text message with a 6-digit code — enter it to continue. If you can't receive it, click Use a recovery code instead and enter one of your recovery codes. With no mobile number on file, you are asked for a recovery code straight away.
A QR code is displayed. Open your authenticator app (Google Authenticator, Authy, Microsoft Authenticator, or similar), add a new account, scan the QR code, then enter the 6-digit code the app shows and click Activate. If the code doesn't match, the same QR code is shown again — nothing is saved until it does.

Your old authenticator entry keeps working until you click Activate. If you stop partway through, nothing has changed. Once you do, you're shown a new set of recovery codes, and your old ones stop working.

Note: Recovery links expire after a limited time. If yours has expired, start the process again from the sign-in page.

Note: Recovery is only for an authenticator you have set up before (or if you're still the only user on a brand-new account). If you never finished setup and someone else on your account already has, there is nothing to recover: no recovery email is sent, and the system tries to notify your administrator instead (at most once an hour, and only if your account has one). If you don't hear back, contact your administrator directly. The page still says instructions were sent — it gives the same answer for every address, so it never reveals which accounts exist.

Tip: Once your new token is set up, register a security key and use that to sign in day to day — it's faster than typing a code and resistant to phishing, and you'll only need your authenticator app when you're on a new device. See Security Keys (WebAuthn).

Recovery codes

Recovery codes let you in if you lose your authenticator app, without a text message and without waiting for your administrator. You get a set of eight whenever you set up an authenticator app, and each one works once. Use one in place of the text-message code when you replace a lost authenticator (above) or reset a forgotten password.

They are shown only once, right after you click Activate. Save them in a password manager or print them, and keep them separate from your phone.
We never email recovery codes, and nobody from All Access IDM will ask you for one.
To see how many you have left, or to get a new set, open Account Settings and find Recovery Codes. Generating a new set needs the current code from your authenticator app, and your old codes stop working.
Codes are not case-sensitive, and the dash is optional.

Supported authenticator apps

Any TOTP-compatible app works. Common choices include:

Google Authenticator (iOS / Android)
Microsoft Authenticator (iOS / Android)
Authy (iOS / Android / desktop)
1Password, Bitwarden, and other password managers with built-in TOTP support