Your profile and account security

See how you appear in the workspace, change your password, and protect your account with two-factor authentication and recovery codes.

Contents: Who can use it · My Profile · Account and security · Change your password · Two-factor authentication · Sign in with two-factor · Recovery codes · Lost phone · Sessions · Example · FAQ

Who can use it

Every signed-in person manages their own profile and security. Administrators can see who has two-factor on and reset it for a colleague (Security).

Where: your user menu (bottom of the sidebar) → My Profile and Account & security.

My Profile

My Profile opens a panel titled Profile ("How you appear across the workspace") showing your Name, Email and Role. Click Okay to close it. Your name, email and role come from your employee or member record; ask an administrator to change them (see Team members). To add a photo, use the Add your photo item on the Getting started card.

Account and security

Account & security ("Password, session and 2FA") has two parts: Password and Two-factor. People who sign in through single sign-on manage their password at their company's identity provider.

Change your password

1. Open Account & security.
2. In Password type your Current password.
3. Type a New password. The strength meter shows how strong it is.
4. Type it again in Confirm new password.
5. Click Update password.

If you forgot the current password, sign out and use Forgot password? on the sign-in page.

Two-factor authentication

Two-factor adds a 6-digit code from an authenticator app (such as Google Authenticator or Microsoft Authenticator) after your password, so a stolen password alone is not enough.

The Two-factor panel shows Authenticator app with a status:

Status	Meaning
Off	Sign-in asks only for your password. Click Set up two-factor
On ("On since {date}")	Sign-in also asks for a code. Shows how many recovery codes are left
Required by your workspace	An administrator made it mandatory; you cannot turn it off

Turn it on

1. Click Set up two-factor.
2. Under Connect your app scan the QR code with your phone's authenticator app. If you cannot scan, open Can't scan it? Enter the key instead, and copy the key (Copy key).
3. Enter the 6-digit code shown in the app and click Verify and turn on.
4. Under Save your recovery codes use Copy codes or Download .txt, store them somewhere safe, tick I have saved these codes somewhere safe, and click Done.

If your workspace requires two-factor, 9bx takes you to this screen ("Set up two-factor authentication") at your next sign-in and you cannot continue until it is done. Choose Sign out if you opened the wrong account.

Turn it off

1. Click Turn off in the Two-factor panel.
2. Confirm with your password and a code from the app (or a recovery code).

The button is unavailable when your workspace requires two-factor.

Sign in with two-factor

After your password, the Two-factor verification page asks for the 6-digit code ("The code changes every 30 seconds"). Tabs let you choose Authenticator, SMS (if offered; Resend SMS code) or Recovery. After too many wrong codes the page says "Too many wrong codes" and locks for a few minutes. Use a different account returns to the sign-in page.

People who sign in with single sign-on use their identity provider's multi-factor instead.

Recovery codes

Recovery codes are one-time codes that sign you in when you cannot use the app. Each works once.

Task	How
Check how many are left	Look at the Two-factor panel ("{n} recovery codes left"). When fewer than a few remain, 9bx warns you
Create new ones	Click New recovery codes, enter a code from your app, click Create codes. The old codes stop working immediately
Use one	On the sign-in verification page choose Recovery and enter one code

Lost phone

If you have recovery codes, sign in with one and set up two-factor on the new phone: turn it off, then on again. If you have none, ask an administrator to reset your two-factor (Settings → Security → Reset). You then sign in with your password and set it up again. The reset is recorded.

Sessions and staying signed in

Choosing Remember me for 30 days on the sign-in page keeps you signed in on that device. Sign Out (user menu) ends your session on the current device. At the time of writing there is no screen listing your other signed-in devices; if you lose a device, change your password.

Push notifications and browsers connected for click to dial are listed in Notification preferences and the Browser extension page, where each can be disconnected.

Example scenario

Nusrat gets a new phone. She signs in with a recovery code, opens Account & security, clicks Turn off, confirms, then Set up two-factor again and scans the QR code with the new phone. She saves the fresh recovery codes in the company password manager. Her colleague Imran lost his phone and codes; Rafiq (Owner) opens Settings → Security, finds Imran, and clicks Reset.

Tips

• Keep recovery codes outside your phone (a password manager or printout).
• Choose a long password you do not use elsewhere.
• Turn on two-factor even if the workspace does not require it.

Troubleshooting and FAQ

The code is always wrong. Check your phone's clock is automatic; codes depend on time.

I cannot find Turn off. Your workspace requires two-factor.

I changed my password but I am still signed in elsewhere. Sign out on those devices; there is no remote sign-out list yet.

Why can't I edit my name? It comes from your member or employee record; ask an administrator.

Related pages

Notification preferences · Security and single sign-on · First login