2-step verification, app passwords and password reset

2-step verification

With 2-step verification on, signing in to webmail asks for your password and a 6-digit code from the authenticator app on your phone. Even if someone learns your password, they cannot get into your account.

To turn it on:

1. Install an authenticator app on your phone (Google Authenticator, Microsoft Authenticator, Aegis, 1Password etc.).
2. In webmail go to Settings → Account → 2-step verification (direct link).
3. Scan the QR code with the app and type the code the app shows.
4. Print or safely store the 10 recovery codes. If you lose your phone you sign in with one of them; each code works once.

On a computer you trust, tick Remember this device for 30 days and that browser will not ask for a code for 30 days.

Your company's administrator can make 2-step verification mandatory for all employees, and can reset it in the panel for an employee who lost their phone and has no recovery code.

App passwords

An app password is a random 20-character password made for one program only. Even if it leaks, it cannot be used to sign in to webmail or to change your password, and it is revoked with one click.

1. In webmail go to Settings → Account → App passwords (direct link).
2. New app password: give it a name (e.g. "iPhone", "Office Outlook") and choose the services it may use:
   • Exchange (EAS): iPhone/Android Exchange account, Outlook mobile
   • IMAP and SMTP: Outlook, Thunderbird, Mac Mail
   • Calendars and contacts (DAV): CalDAV Synchronizer, DAVx5, Mac Calendar
3. Copy the password shown and paste it into the password field of the program. It is shown only once.
4. If you lose the device, Revoke that password on the same page; the device loses access immediately.

Open sessions and devices

Settings → Account → Security (direct link) lists the browsers, mail programs and phones connected to your account. If you see a session you do not recognise, end it and change your password. You can erase company mail from a lost phone here (phones connected with Exchange).

When someone signs in to webmail from a device we have not seen before, a "new sign-in" notice arrives in your inbox.

I forgot my password

• If your account has a recovery email address, the password reset page sends a link valid for 60 minutes to that address.
• Without a recovery address, your company's email administrator can set a new password in the customer panel.
• After a password change, enter the new password on all your devices; sessions still open with the old password are closed.

A strong password

Use at least 12 characters; do not include your name, your company's name or your email address. Do not reuse the password on other sites.