See the complete route index at https://docs.crusible.dev/llms.txt before following links.

# Secure your sign-in

Confirm it's you before a protected change, and get back in after you lose your authenticator app.

<!-- https://docs.crusible.dev/admin/secure-your-sign-in/ · doctype: how-to · role: both · reviewed: pending human review -->


Crusible asks you to confirm it's you before a protected change.
In Settings, resetting an SSO connection opens this prompt.
Settings has no page to add an authenticator app or a passkey.
An authenticator app or passkey that your account already holds works in the prompt.

![The Confirm it's you dialog with a password field, an authenticator code field and the Confirm button.](/docs-illustrations/secure-your-sign-in-paper.svg)



1. <p>Start the protected change. For example, choose <strong>Reset connection</strong> in <strong>SSO</strong> settings.</p>
 (Result: The **Confirm it's you** dialog opens over the action you started.)

1. <p>Enter your <strong>Password</strong>. If your account has an authenticator app, enter its code in
<strong>Authenticator code (if enabled)</strong>.</p>
 (Result: **Confirm** becomes available once the password field holds a value.)

1. <p>To confirm another way, choose <strong>Use passkey</strong> or <strong>Continue with identity provider</strong>
under <strong>or confirm with</strong>. Use a method only when your account has it.</p>
 (Result: Crusible shows **Waiting for identity provider** or waits for your device.)

1. <p>Select <strong>Confirm</strong>. Crusible accepts the confirmation for 30 minutes. Another protected
change in that window doesn&rsquo;t ask again. Signing out ends the window.</p>
 (Result: The dialog closes and the protected change continues.)

- **If this doesn't work:** <p>Select <strong>Cancel</strong> to stop without making the change.
If you see “Allow pop-ups to verify with your identity provider.”,
allow pop-ups for Crusible and try again.
After too many attempts, wait for the time the dialog shows before you retry.
If you have lost your authenticator app, ask your organisation owner to reset it.</p>





## Reset a member's authenticator app

There is no self-service reset for a lost authenticator app.
Your organisation owner or an administrator resets it from the member's profile.
A reset takes two different administrators. Nobody can reset their own authenticator app.

1. Open **Directory** in Settings and open the member's profile.
2. Select **Reset MFA**. Crusible records the request and shows
   “MFA reset requested. Another administrator must approve it by choosing Reset MFA for this member.”
3. A second owner or administrator opens the same profile and selects **Reset MFA** within 24 hours.
   Crusible shows “Multi-factor authentication reset.”

The reset turns off the member's authenticator app and invalidates their recovery codes.
It also signs the member out of every session. The member's passkeys stay registered.
**Reset MFA** appears only for an active member who has a second factor turned on.

- [Manage sign-in sessions](https://docs.crusible.dev/admin/manage-sign-in-sessions/) — Review your browser sessions and revoke access from a device you no longer use.- [Set up single sign-on](https://docs.crusible.dev/admin/single-sign-on/) — Configure an organisation identity provider, test sign-in and activate the connection.- [Roles and permissions](https://docs.crusible.dev/admin/roles-and-permissions/) — Organisation roles, settings access and the limits on changing another member’s access.