Create members of the access, set devices per member, require a second factor

What it is for

Members are personal accounts of your access. People use them to sign in in the program (card Access) and in the browser under My devices, and they see the devices of the access. You decide which devices a member sees, and you can require a second factor for all members. Members do not get into the console — that is what console accounts are for (B4).

What you need

• An access in the Cloud or on your own relay.
• A console account as administrator of the access.

How to do it

Create a member

1. In the console open Tenants. In the console an access is called a tenant.
2. In the row menu of your access (⋮) choose Users. The dialog Users of … opens with the list of members.
3. Enter New user * and Password *, click Create user.
4. Give the member the access name, user name and password.

Set devices per member

1. In the same list, in the member's menu (⋮), choose Set devices.
2. Choose Selected devices only and tick the devices — or All devices of the access (default).
3. Save. The column “Devices” then shows “selected” or “all”.

Require a second factor

1. Tenants → double-click the access (Edit tenant) → tab Governance policy.
2. Turn on Second factor required for users, Save.
3. Anyone without a second factor sets it up at their next sign-in under My devices in the browser. Until then the program refuses such accounts.

A member can set up the second factor voluntarily: sign in under My devices in the browser → Two-factor → Set up → scan the QR code → enter the first code.

Change password, delete a member, phone lost

In the member's menu (⋮):

• Change password — the console asks first and names devices that are still signed in via a member account.
• Reset second factor — only shown if the member has one. After that the password is enough again.
• Delete.

How you know it worked

• The member appears in the list Users of … with the columns “Devices” and “Second factor” (“active” or “—”).
• The member signs in in the browser under My devices and sees their devices. In the program they sign in in the card Access (C2).

Good to know

• Member or access password: without members, an access has one shared access password. It never signs in under My devices and has no second factor. Personal accounts are safer and traceable in the audit log.
• “Selected only” with nothing selected means: see nothing, never “everything”.
• The selection is first of all a view. Without “control only from the device's own tenant”, anyone who knows device ID and device password reaches the device. With Control only from the device's own tenant (tab Governance policy) the selection also applies when connecting, waking and restarting. Administrator accounts are never restricted.
• Changing the password or deleting a member invalidates their sign-ins immediately. Devices that joined via this account and do not yet carry their own proof no longer sign in afterwards. Since version 20261010.3 devices fetch their own proof when they sign in — so update the programs first, then change passwords.
• Revoke all tokens additionally invalidates all sign-ins via the access password and the devices' own proofs. Programs that joined must then join again. Use it only in an emergency.
• Turning on the second factor signs the member's program out; it signs in again with a code.
• A code works only once. Signing in twice within 30 seconds means waiting for the next code.
• A member who connects from the browser also enters the device's password (D6).

If it does not work