How do I turn on two-factor authentication?

How do I turn on two-factor authentication?

Open Account security. Two-factor authentication adds a verification step when signing in.

Set up a method

• Authenticator app: follow the setup, scan the QR code with your authenticator app, and enter its six-digit code.
• Email verification: request and enter the code sent to your account email.

The page may require an existing verification method before changing security settings. Some staff roles require an authenticator app and cannot disable it while that requirement applies.

Keep recovery codes

Generate and save recovery codes somewhere secure, such as a password manager. Each code can be used once. Generating a replacement set invalidates the earlier set; never send recovery codes to a school or support agent.

Signing in and managing devices

Follow the verification step shown after your normal sign-in. Where offered, only remember a device you control. Account security also lets you review active sessions and revoke other sessions. Revoking a session requires that device to sign in again.

To change or disable a method, use the controls on the same page and complete the verification requested.

I cannot complete two-step sign-in

Start at Sign in and complete the first sign-in step. On the verification page, enter the requested code on the website and complete any human verification shown.

If you cannot use the current method, select Try another way. Use only an alternative actually offered for your account: Email me a code instead, Use my authentication app, or Use a recovery code. An alternative is not available to every account. A recovery code is used once; keep the remaining codes secure. When email verification is offered, check the account inbox and spam folder and use the page's resend option if needed.

If the sign-in attempt has expired, return to Sign in to begin a new attempt. Do not open or share a copied verification URL as a substitute for that sign-in step. Resetting your password does not disable two-factor requirements.

If you cannot use any offered method or recovery code, use Account Support while signed in or the public Contact form while signed out. State which method you could not use and the error wording. Never send codes, passwords, QR setup secrets or sign-in links to the assistant or a support agent. The assistant cannot bypass verification or promise account recovery.