Skip to main content
Applies to Settings → Security for accounts with credentials managed through Risk Portal. Security settings provide password changes and app-based two-factor authentication. The available controls depend on the account’s sign-in configuration. For provider-managed credentials, use the organization’s identity-provider process.

​
What is required before changing security settings?

  • Access to the intended signed-in account.
  • The current password for a password change.
  • A compatible authentication app for app-based two-factor authentication.
  • Access to the configured support contact if sign-in becomes unavailable.
A visible Change Password card does not establish compatibility with every single sign-on account. Do not enter an external provider’s password into an unsupported portal workflow.

​
How to change the account password

  1. Open Settings → Security.
  2. Enter the current password in Old Password.
  3. Enter the replacement password in New Password.
  4. Repeat the replacement in Confirm Password.
  5. Check the displayed validation messages.
  6. Select Update Password.
Verify that Password Changed appears. Select Remain to stay on the page or Return to Homepage to leave it. The application does not automatically sign out after a password change. If success is followed by an error, do not assume the password remained unchanged. Check sign-in with the new password before attempting another change.

​
How to enable an authentication app

The setup barcode and Two-factor secret contain sensitive enrollment information. Keep these values private and out of screenshots or shared documents.
  1. Open Settings → Security.
  2. Select Enable two-factor authentication.
  3. Select Set up using an app.
  4. Scan the displayed barcode with the authentication app.
  5. Enter the app’s current six-digit code in the code field.
  6. Select Enable Two-factor.
Verify Successfully setup MFA and the return to Security. The action should now read Disable two-factor authentication. The displayed status should identify app-based authentication as configured. Displaying or scanning the barcode alone does not enable authentication. If scanning is unavailable, select enter this code and enter the revealed secret into the authentication app. Then complete the code verification and Enable Two-factor steps. The enrollment secret is not a recovery code. When sign-in requests an app code, enter the current code on Confirm two-factor code. Select Confirm to continue. An app challenge is not guaranteed on every sign-in.

​
How to disable app-based authentication

Disable two-factor authentication submits immediately without another confirmation dialog. The action removes the additional app-code requirement for supported portal authentication.
  1. Open Settings → Security.
  2. Select Disable two-factor authentication only when removal is intended.
Verify Successfully disabled MFA and the return of Enable two-factor authentication. This action does not change an external identity provider’s authentication policy. A signed-in session is required; this is not a lost-device recovery procedure.

​
What if sign-in is unavailable?

For a forgotten portal password, use forgot password? on the local sign-in form. For sign-in and recovery entry points, see the sign-in guide. Password reset does not remove app-based authentication. If the authentication app is unavailable, contact the configured support contact for the supported recovery process. Do not send passwords, setup secrets, or authentication codes with the request. This procedure covers app-based authentication; it does not provide SMS setup or recovery-code instructions. For programmatic credentials, see API keys.