Two-factor authentication adds a second check to your sign-in. After your password, you enter a six-digit code. A stolen or guessed password alone is then not enough to open your account.
Two-factor applies to staff and trainers. HR administrators always use it. For other staff it depends on a setting your HR administrator controls (see Requiring two-factor for your workspace). Candidates are never asked for a code.
If your workspace does not require it, you can still turn it on for yourself: set up an authenticator app from your profile, and from then on every sign-in asks for a code. In a workspace that does not require it, you can turn it off again yourself from your profile.
Trainers have no profile page, so the self-service steps on this page that start from the profile do not apply to them. A trainer who needs to change or remove their setup, or who is locked out, asks an HR administrator of the workspace to reset their two-factor; they set it up again at their next sign-in.
Set up an authenticator app
The first time you sign in to a workspace that requires two-factor, Jadiroon asks you to set it up. You can also change it any time from your profile.
- Sign in with your email and password as usual.
- On the setup screen, scan the QR code with an authenticator app (Google Authenticator, Microsoft Authenticator, 1Password, or any app that supports standard time-based codes). If you cannot scan, type the secret shown under the QR code into the app instead.
- Enter the six-digit code the app shows. The app is saved only after that code is accepted.
If you cannot set up the app right now, choose Email me a code this time on the same screen. The emailed code signs you in this time only: nothing is saved, the device cannot be trusted, and your next sign-in shows the app setup (and the email option) again. Email is never your saved method. HR administrators do not get this option: they set up the app at their first sign-in.
Sign in with a code
After your password, the code screen opens.
- Authenticator app: enter the current code from your app.
- Email me a code instead: if your phone is not at hand, choose this on the code screen. The emailed code works for this sign-in only; next time the screen asks for your app code again. It is valid for 10 minutes and works once. You can ask for a new one after a minute, up to five times an hour.
Each sign-in attempt lasts 10 minutes from the password step. If it runs out before a code is accepted (for example while you install an authenticator app, or when an email code arrives late), you go back to the password with "This sign-in attempt expired, start again." Five wrong codes cancel the attempt too: you see "Too many wrong codes. Start again." and start again from the password, and we email you that wrong codes were entered for your account. After 20 wrong codes in an hour, sign-in is paused: you see "Too many wrong codes. Try again in an hour." No session is created until the code is accepted.
Trust this device
Tick Trust this device for 30 days on the code screen and Jadiroon skips the code on that browser for the next 30 days. Use it only on a device you own. Each workspace account is trusted on its own, so trusting one workspace does not undo another. A trusted device is forgotten when you change your password, when an administrator resets your two-factor, or when you revoke it yourself.
Change or remove the app
Open your profile (/{slug}/app/profile, or /{slug}/me/profile) and find the Two-step verification card. It shows whether your authenticator app is set up, and since when.
-
Set up authenticator app / Change authenticator app (for a new phone) asks for a current code first, from your app or by email.
-
Trusted devices lists the browsers you have trusted. Revoke one, or Revoke all, which also signs you out of your other sessions.
-
Turn off two-factor (only when your workspace does not require it, and never for HR administrators) asks for a current code, then removes your app and forgets your trusted devices. Sign-ins no longer ask you for a code.
Changing or removing the app signs you out of your other sessions and sends you a confirmation email.
If you lose your phone
- You can still receive email. Choose Email me a code instead on the code screen to sign in this once, then set up the app on your new phone from your profile.
- You cannot sign in at all. Ask your HR administrator to reset your two-factor. At your next sign-in you set it up again. Your password does not change.
- You are an HR administrator. Ask another HR administrator of your workspace, or the Jadiroon platform operator, to reset yours.
You receive an email whenever your two-factor is reset, so a reset you did not ask for does not go unnoticed.
Next
HR administrators control who is asked for a code: Requiring two-factor for your workspace.