Multi-factor authentication adds a second step to signing in. After your password, you enter a six-digit code from an authenticator app on your phone, so a stolen password alone cannot open your account.
Who must use it
Admins, Managers and Proposal Leads must set up multi-factor authentication before they can use the dashboard. The first time you open the dashboard with one of those roles, Propivix takes you to the setup page, which says that MFA is required for your role. You cannot use the rest of the dashboard until you finish.
For Contributors, Reviewers and Viewers it is optional, and Propivix does not ask them for a code when they sign in.
Setting it up
You need an authenticator app on your phone, such as Google Authenticator or Authy.
- Open the setup page. Propivix opens it for you when your role requires it. Otherwise open Settings, select the Security tab and select Enable 2FA, or select Manage multi-factor authentication on the General tab.
- The page, Set Up Two-Factor Authentication, shows a QR code. Scan it with your authenticator app, which adds an entry for Propivix.
- Type the six-digit code the app shows into Verification Code.
- Select Verify & Enable.
The page shows MFA Enabled and takes you back to the dashboard. Your profile page then shows 2FA Status as "Enforced"; see Your profile.
If the QR code does not load, the page shows the error with a Try Again button. Select it to start over. If a code is refused, wait for the app to show a new code and enter that one. The codes depend on your phone's clock, so check that the phone sets its time automatically.
When Propivix asks for a code
If your role requires multi-factor authentication, Propivix asks for a code each time you sign in. After your password, the page Verify Two-Factor Authentication asks for "the 6-digit code from your authenticator app to verify your session". Enter it and select Verify & Continue.
Some actions also need a code entered recently, within the last 30 minutes:
- sending a team invitation or a reminder
- saving the Business Profile
If one of these is refused with a message that your MFA session has expired, sign out and sign back in. Propivix asks for a new code, and you can then repeat the action. To sign out, open Settings, select the Security tab and select Sign Out.
If you lose your phone
Propivix does not issue recovery codes, and it has no screen for removing an authenticator or moving it to a new phone. If you lose access to your authenticator app and your role requires multi-factor authentication, you cannot finish signing in. Email support from the address you sign in with to regain access; see Contacting support.
To avoid this, keep your authenticator app backed up, or set it up on a second device when you first scan the QR code.
Good practice for your team
- Give the Admin, Manager and Proposal Lead roles only to people who need them; see Roles and Permissions.
- Tell anyone you invite as an Admin, Manager or Proposal Lead to have their phone and an authenticator app ready, because Propivix takes them to set it up the first time they open the dashboard.