Get early access
In this section (15)

Two-step verification and passkeys

Protect your sign-in with an authenticator app, recovery codes or a passkey, see where you are signed in, and require it for your team.

3 min read

Two-step verification asks for a second proof after your password, so a stolen password alone is not enough. ChaosDesk supports authenticator apps, recovery codes and passkeys. It works on every plan.

Your security settings are in your profile menu, under Security.

Set up an authenticator app

  1. Open your profile menu and choose Security.
  2. Under Authenticator app, choose Set up.
  3. Scan the QR code with an app such as Google Authenticator, Microsoft Authenticator, 1Password or Authy. Can’t scan it? Type the key shown below the code.
  4. Enter the 6-digit code from the app and choose Turn on.
  5. Save your recovery codes (see below).

From now on, ChaosDesk asks for a code from the app each time you sign in with your password.

Recovery codes

When you set up your first authenticator app or passkey, you get 10 recovery codes. Each one works once, for when your phone or passkey is not at hand.

  • They are shown only once. Copy or download them and keep them somewhere safe, such as a password manager.
  • The page shows how many codes are left.
  • Create new codes replaces the whole set. The old codes stop working.

Passkeys

A passkey lets you sign in without a password, with Touch ID, Face ID, Windows Hello, your phone or a security key such as a YubiKey.

  1. On the Security page, under Passkeys, choose Add a passkey.
  2. Give it a name, for example “MacBook Touch ID”.
  3. Confirm with your device.

To sign in, choose Sign in with a passkey on the sign-in page. You don’t need your email or password, and a passkey counts as both steps.

A passkey works only for the workspace it was created in. You can rename or remove passkeys on the same page.

Confirming it’s you

Turning the authenticator app off, removing a passkey and creating new recovery codes ask for your password or a current code first. If your workspace requires two-step verification, you cannot remove your last method.

Where you’re signed in

Where you’re signed in lists the devices signed in to this workspace, with the location and last activity. Choose Sign out next to a device you don’t recognise, or Sign out all other devices.

Change your email address

Under Email address, enter the new address and confirm with your password or a code. ChaosDesk sends a confirmation link to the new address, valid for 24 hours. Nothing changes until you click it. After the change, every session ends and your old address gets a notice.

Require two-step verification (admins)

  1. Open Admin Center, Security & compliance, Team security (or Security policies).
  2. Tick Agents, Admins or both.

People in those roles who have no second step yet are asked to set one up at their next sign-in. They can’t use ChaosDesk until they do.

On the same page, admins can sign an agent out of every device.

Lost your phone?

Use a recovery code. If you have none left, ask another admin of your workspace to Reset two-step verification for you in Team security. The admin should confirm it’s really you first, for example on a video call. The reset removes your app, recovery codes and passkeys and signs you out everywhere. You set up a new method at your next sign-in.

If you are the account owner or the only admin, contact ChaosDesk support from your account email address. For your safety, support checks your identity and waits 24 hours before resetting.

Single sign-on

When you sign in through Google, Microsoft, OpenID Connect or SAML, ChaosDesk does not ask for a second step. Your identity provider handles it, so turn on two-step verification there.

Every change to your security settings is recorded in the audit log, and you get an email about it.

Was this article helpful?