The Security overview

Security settings change how you sign in, so the pages ask for a recent second factor before they show anything. If you have not used one in the last 30 minutes, the page shows Confirm it is you to open security settings and explains that it asks for a second factor used in the last 30 minutes. Select Confirm it is you. A dialog titled Confirm it is you offers what your account has:

• Use a passkey, then approve on your device.
• Authenticator code, a six digit code from your authenticator app, then Confirm.
• Continue with and the name of a linked provider, where one is linked. You leave the page to sign in again at the provider and come back. The page tells you to repeat what you were doing, because nothing has been changed.
• Under Other ways to confirm, Account password, then Confirm with password. This is offered only when your session began with a passkey or with a linked account's own second factor, and your account has a password. It is never offered after you signed in with a password, an email link or a recovery code.

If nothing on the account can confirm it, the dialog says No second factor on this account can confirm this here. Sign in again with a passkey or an authenticator app. The Checkup tab is the exception: it is open to any signed-in session, because a person with no second factor needs it most.

The same dialog appears on the page where you try a sensitive change, such as removing a passkey or changing your primary email address, if the last confirmation is older than 30 minutes.

1. Use a passkey, then approve on your device.
2. The six digit code from your authenticator app, then Confirm. This is offered when your sign-in began with a password.

1. The notice Recommended next step, with an Open button.
2. A sign-in method with its status. Here Authenticator app is Off.
3. The Security checkup row, with the level and the score.

Under Sign-in methods there is one row for each method.

Below the list, Security checkup shows your level as Strong, Fair or Needs attention, how many checks are good (for example 4 of 6 checks are good.) and your score out of 100. It opens Security checkup. If the checkup could not be loaded, the row says so and to reload the page.

Notices appear above the list when something needs your attention.

• Recommended next step: followed by the name of the first action the checkup suggests, for example Recommended next step: Passkey, with its explanation and an Open button.
• Your account joined an organization through its verified domain: shown when an organization that has verified your email's domain brought your account in. It says which domain.
• A second factor is required here: shown when this account must have a passkey or an authenticator app to keep signing in. It says to set one up.
• A recovery was started for this account: someone began recovering the account. It says If this was not you, cancel it now. and has a Cancel the recovery button, which answers The recovery was cancelled.
  • On a session opened with the lost-passkey email code, cancelling a recovery needs a second factor you used in the last 30 minutes, like the other actions that session is held back from. See Sessions.
• Your account joined an organization through its verified domain followed by the domain: shown when the account joined an organization because its address is on a domain that organization verified.
• A result after you linked or confirmed with a provider, such as Account linked. See Linked accounts.

An account that signs in with a password and has no second factor has a shorter overview. Where the platform offers it, the page is titled Add a second factor and says You sign in with a password only. Confirm your current password to set up an authenticator app. It offers two ways:

• Type your Current password and select Start setup to set up an authenticator app.
• Under Or add a passkey, confirm your current password and select Add a passkey. See Passkeys.

The other tabs are hidden until you have a second factor. If your browser is new to the account the page instead says This browser is new to your account and that a sign-in method can be added from a browser the account has known for 24 hours (the default; a platform setting can change it). Use a browser you already sign in from, or sign in here once with a link or code emailed to you and come back after a day; a password alone does not make a browser known.

An account that does have a passkey or an authenticator app but was signed in with Continue with my password only (limited session) meets the Confirm it is you dialog on every sensitive page and action instead of a plain refusal; confirming with the passkey or authenticator app lifts the limit. See The second step.

An account that an organization manages (a managed identity) cannot add, change or remove its own sign-in methods here: those requests are refused, because the organization's directory connection is its only way in.

• Security checkup
• Signing in
• Sessions and devices
• Notifications