Limit or restore how one person signs in with an expiry date on the account, a switch that shuts password sign-in, or clearing two-factor authentication for someone locked out of their authenticator.
Before you start
The tasks in this article need different permissions. The table gives the default roles for each task.
| Task | Default roles |
|---|---|
| Set when an account expires and stop someone signing in with a password | Organisation Admin and User Manager |
| Turn off two-factor authentication for a user | Organisation Admin |
If your organisation uses custom roles, yours may grant more or less than this.
Set when an account expires
Open the person's Edit User form.
-
Set Expires At to a date and time.
Select Submit.
The Edit User form reloads and shows the date and time you set in Expires At. The time is in UTC, which the form shows next to the field.
Once that moment passes, the person can no longer sign in, either with a username and password or through single sign-on. The account is not deleted and nothing is lost. To let them back in:
- Clear Expires At on the person's Edit User form.
- Select Submit.
The Edit User form reloads and Expires At is empty.
Stop someone signing in with a password
- Open the person's Edit User form.
- Tick Disable manual login.
- Select Submit.
The Edit User form reloads and Disable manual login is ticked.
The person can no longer sign in with a username and password, and a password reset is refused.
Single sign-on is not affected, so this is the way to close password access on an account that should only arrive through single sign-on. To restore password sign-in:
- Untick Disable manual login on the person's Edit User form.
- Select Submit.
The Edit User form reloads and Disable manual login is unticked.
Turn off two-factor authentication for a user
If your organisation uses two-factor authentication, an Organisation Admin can clear it for someone who has lost access to their authenticator.
-
Select the pencil button in the Actions column of the user list.
Select Disable 2FA.
Confirm when asked.
The message "Saved successfully" appears and Disable 2FA becomes unavailable for that person. They are not sent an email or any other notification. At their next sign-in they enter their username and password as usual and are not asked for a two-factor code.
Warning
This cannot be undone. The person has to set up two-factor authentication again themselves. You cannot do it for them.
Troubleshooting
If a password reset is refused with "Manual login is disabled for this account", the Disable manual login box is ticked on the account.
If a person has not set up two-factor authentication, Disable 2FA is visible but unavailable for them.