Protect your account in Profile
Change your own password, enroll an authenticator and keep recovery codes available without altering the permissions assigned by the administrator.
Open your own profile
Open Profile from your account. Check the displayed identity and the two-factor policy before making changes. The profile contains your password form and 2FA status; it is not the administrator’s editor for users, reusable access profiles or live resource scopes.
Update authentication
For a password change, enter the current password, the new password and its confirmation, following the displayed policy. Complete one operation before beginning another so that you can verify which change was saved.
Enroll an authenticator
Start 2FA enrollment with your current password. Add the displayed setup to your authenticator and confirm its current code to finish enrollment.
Store recovery codes
Save the displayed recovery codes in a protected location separate from the phone. Generating a replacement set invalidates the previous set; update your stored copy.
Manage 2FA through its complete lifecycle
The administrator selects the account’s two-factor policy; the account holder associates the authenticator in Profile. Starting enrollment or displaying a setup code is not the final step: confirm a current authenticator code and check that the profile reports 2FA as enabled.
| Situation | Action |
|---|---|
| New authenticator | Authenticate with the current password, add the displayed configuration to your authenticator and complete code confirmation before closing the setup. |
| Recovery-code replacement | Use the protected regeneration action and store the newly displayed set. The earlier set stops being valid; do not keep it as a second working set. |
| Lost phone or rejected code | Check time synchronization for current codes. If the authenticator is unavailable, use an unused recovery code or the supported administrator recovery path. |
| Required 2FA | The assigned policy prevents personal disabling while it remains required. Changing personal preferences does not override that policy. |
Verify a new login
Confirm the success message and enabled 2FA status, then test a fresh login with the new credentials and authenticator. Check that device time is synchronized if current codes are rejected. Required 2FA cannot be disabled through the personal profile while that policy remains assigned.
Recover without losing associations
If the phone is unavailable, use an unused recovery code or contact the administrator for the supported account recovery. Repeated guesses can trigger temporary limits. After a configuration restore, authenticator associations remain valid but old recovery codes must be replaced; the server’s protected 2FA key also needs preservation.
Use the controls, understand what changes
Displaying an authenticator setup is not the final enrollment step. Confirm a current code and check the enabled status. A newly generated recovery-code set replaces the previous set; store the new codes before leaving the confirmation screen.
Complete product screenshots
Illustrative data. Open the screenshot to enlarge it and match the controls to the instructions in this chapter.
Open complete screenshot
Read the workspace section by section
Match the numbers and panels below to the complete workspace. These screenshots use illustrative data; the procedures above explain how to work with your own installation.
Two-step verification
Check the authentication policy and manage authenticator protection and recovery codes.
Account and password
Check the account identity and change the password using the current-password verification.