Multi-factor authentication

Not yet checked on the product

This chapter was written from the product's source code and has not yet been checked by a person on a running Cogneris. If what you see on screen differs, the screen is right — please tell your Cogneris contact so the chapter can be corrected.

Canonical home of multi-factor authentication for every satellite manual.

Content status: From source; not observed (id-fe 919a10c, sso-be 020840c, 2026-10-22; updated for WOR-172). The My space › MFA and Force all users to use MFA screens are from admin-fe a915204.

Multi-factor authentication (Cogneris calls it two-factor authentication) adds a second step to signing in: after your password, you type a 6-digit code from an authenticator app on your phone. Someone who learns your password still cannot sign in without your phone.

What Cogneris offers

Method	What it is	When you use it
Authenticator app	A 6-digit code that changes every few seconds, shown by any authenticator app that reads a QR code (time-based codes).	Every time you sign in.
Backup codes	8 single-use codes of 8 letters and digits, shown once when you set up the authenticator.	When you do not have your phone. Each code works once.

Cogneris does not send second-factor codes by SMS or e-mail. The codes sent by e-mail or SMS while you create an account or reset a password are a different thing: they prove you own the address or phone, and are not a second factor.

Before you start

• Install an authenticator app on your phone.
• Have a safe place ready for the backup codes (a password manager, or a printed copy kept somewhere secure).
• Two-factor authentication is set up on your account: each person sets up their own.

Set up a second factor

There are two ways to reach the setup: you turn it on yourself, or your company requires it and Cogneris asks you at sign-in.

Turn it on yourself

1. Sign in and open My space › MFA. The Two-factor authentication page opens: Add an extra layer of security to your account.
2. Status shows Disabled. Select Enable two-factor authentication.
3. Under Scan this QR code, follow Scan the QR code below with your authenticator app, then enter the 6-digit code it generates. If you cannot scan, type the code under Or enter this code manually into the app.
4. Under Backup codes, read Save these one-time codes somewhere safe. Each one works only once, if you ever lose access to your authenticator app. Save them now, or select Download backup codes. You do not see them again.
5. Type the 6-digit code from the app in Verification code and select Verify and enable. Cancel stops the setup.

Expected result: Two-factor authentication is now enabled. and Status shows Enabled. From the next sign-in, Cogneris asks for a code.

When your company requires it

If your company administrator turned on Force all users to use MFA and you have not set up two-factor authentication, Cogneris stops after your password and shows MFA setup required: Your company requires MFA. Set up an authenticator now; after verification, sign in again to complete an MFA-protected session.

1. Scan the QR code with your authenticator app, or type the Manual entry code into it.
2. Save the codes listed under Backup Codes: Save these codes securely. Each can be used once if you lose access to your authenticator. Select Download backup codes to save them as a text file, or copy them. You do not see them again.
3. Type the code from the app in Enter the 6-digit code from your authenticator and select Verify & Enable.

Expected result: Cogneris signs you out and returns you to the sign-in page, which shows Two-factor authentication is on. Sign in to continue. Sign in again: this time Cogneris asks for a code, as described below.

Sign in with a second factor

1. On the sign-in page, type your e-mail and password and select Continue.
2. The Two-Factor Verification page opens: Enter the 6-digit code from your authenticator app.
3. Type the code shown by the app in Enter the 6-digit code from your authenticator. Select Verify.
4. Without your phone, select Use a backup code instead. The page explains Enter one of the backup codes you saved when you set up two-factor authentication. and the field changes to Backup Codes; type one of your backup codes (letters are not case-sensitive) and select Verify. That code then stops working. Use authenticator app switches back.
5. Back to Login returns to the sign-in page.

Expected result: the sign-in continues as in Sign in.

Complete this page within 5 minutes of entering your password. After that, every code is refused; select Back to Login and sign in again.

If your company signs in with SAML

If you sign in through your company's own sign-in page (Sign in with SAML), Cogneris may ask for a code after it. The page shows Additional verification and Verify it is you: Use a code from your authenticator or a recovery code.

1. Type a code from your authenticator app, or one of your backup codes, in Authenticator or recovery code (Enter one code to continue securely.).
2. Select Verify and continue (it shows Verifying…).
3. Return to sign in leaves the page.

You have 5 minutes to complete this page.

Turn it off

1. Open My space › MFA. Status shows Enabled.
2. Select Disable two-factor authentication. The page asks: Enter a current code from your authenticator app to disable two-factor authentication.
3. Type the current 6-digit code from the app in Verification code and select Disable two-factor authentication. A backup code is not accepted here.

Expected result: Two-factor authentication has been disabled. and Status shows Disabled.

You cannot turn it off while your company requires two-factor authentication (Force all users to use MFA): Cogneris refuses with Your organization requires two-factor authentication, so it cannot be turned off. and Status stays Enabled. If Cogneris cannot check your company's policy at that moment, it refuses too, with We could not check your organization's policy. Nothing was changed; try again later.

What your administrator can require

A company administrator can require two-factor authentication for everyone in the company: Company administration › Organization › Company and branding, section Account security, switch Force all users to use MFA (Users who have not enabled MFA must enroll the next time they sign in.). Cogneris confirms with MFA policy saved., or shows Unable to save the MFA policy.

Users who already have two-factor authentication are not affected. The others see MFA setup required at their next sign-in (see When your company requires it).

If something goes wrong

What you see	What it means	What to do
Invalid code. Please try again.	On Two-Factor Verification or MFA setup required: the code is wrong, already used (backup code), or the page waited more than 5 minutes.	Type the code currently shown by the app. Check that your phone's clock is set automatically. If it keeps failing on Two-Factor Verification, select Back to Login and sign in again.
That code didn't work. Check your authenticator app and try again.	On My space › MFA: the code is wrong.	Type the code currently shown by the app.
Your organization requires two-factor authentication, so it cannot be turned off.	On My space › MFA, while turning it off: your company requires two-factor authentication.	Keep it on. To move it to a new phone, see the last rows of this table.
We could not check your organization's policy. Nothing was changed; try again later.	On My space › MFA, while turning it off: Cogneris could not confirm your company's policy, so it refused.	Try again later.
Enter the 6-digit code. / The code must be 6 digits.	On My space › MFA: the code is empty or not 6 digits.	Type the 6 digits from the app.
Failed to load data.	My space › MFA could not read your status.	Reload the page.
Unable to start MFA setup. Please sign in again.	MFA setup required could not start.	Sign in again.
Too many attempts. Try again in … seconds.	Too many codes were tried.	Wait for the countdown, then try again.
The code could not be verified. Try again.	SAML verification: the code is wrong.	Type a current code or an unused backup code.
Too many attempts. Wait a moment before trying again.	SAML verification: too many tries.	Wait, then try again.
Verification is temporarily unavailable. Try again.	SAML verification could not be done.	Try again.
This verification request is no longer valid. Return to sign in.	The SAML verification page expired (5 minutes) or was opened without a sign-in.	Select Return to sign in and sign in again.
We could not continue securely. Return to sign in.	The SAML sign-in could not resume after the code was accepted.	Select Return to sign in and sign in again.
Your account needs two-factor setup before you can decline. Finish the setup, then open the invitation link again.	You tried to decline an invitation, and your company requires two-factor authentication you have not set up.	Set it up, then open the invitation link again.
You lost your phone and your backup codes.	You cannot finish signing in without a code.	Ask a company administrator to reset your two-step verification (Teams › Manage access › Reset MFA). You receive an e-mail when it is done; then sign in with your password and, if your company requires it, set up two-step verification again with your new phone.
You lost your phone but have backup codes.	Each backup code works once.	Sign in with a backup code, then in My space › MFA turn two-factor authentication off and on again with your new phone. Turning it off needs a code from the authenticator app, and is refused while your company requires two-factor authentication; in either case, contact Cogneris support.

---

Last reviewed 2026-10-22 · Version 1.0.0 · Owner: product-documentation