Your first sign-in and the setup checklist

A correct password always signs you in. Once you have a passkey or an authenticator app, a sign-in from a browser your account knows still needs only the password, and one that looks unusual (a new browser or place) asks for the passkey or the app, or lets you choose Continue with my password only (limited session). See The second step.

If you type an email address whose domain belongs to an organization that requires single sign-on, the next page is titled Sign in with your organization and says that organization manages sign-in for your email address. Select Continue with the organization name to sign in there, or Use another method to carry on in the usual way; the organization's requirement is still enforced when you enter it. The page is the same whether or not an account exists for the address you typed. This applies only where the platform has turned on tenant connections (flag tenant_connections, which defaults OFF) and the organization has chosen to require single sign-on.

Signing in describes every method and every extra step the sign-in page can ask for.

You may be asked to choose a password#

Every account has a password. If yours does not (for example an account created with a passkey only), a page titled Choose a password follows the other checks and says Every account needs a password. Choose one to finish signing in. Fill in the two fields and select Save password and continue. An account that already has an authenticator app or a passkey is first asked for that second step, so a password is never set on the strength of an emailed link alone. Accounts that an organization manages, and accounts that are not people (such as service accounts), are not asked.

You may be offered a passkey#

If you signed in without a passkey, the page may offer Add a passkey. It says that a passkey signs you in with your device lock, with no password to type or steal. Select Create a passkey to add one, or Skip for now. The platform remembers that the offer was shown, so it is not repeated at every sign-in. You can add a passkey at any time from your account. See Add a passkey.

While your account is new, the Overview page greets you with a welcome and your name, shows a Setup in progress badge, and says Your account is new. Finish setting up to protect it. Below it is a panel titled Finish setting up, with a count such as 3 of 6 done.

The checklist is not shown forever. It appears only during the first seven days of the account and only while at least one step is not done. When every step is done, or the seven days pass, it goes away and the Security posture panel carries on the same advice.

If something needs your attention more urgently, such as an unread security event, the page says Some things need a look. and leads with that instead.

The six steps#

Each step is one check from your security checkup. A step is done when the checkup says it is good, and a step that is not done has a Set up button that opens the page where you fix it.

For example, an account created with a password and no passkey starts with Password (where the breach check is available) and Sessions done, and Passkey, A way back in, Recovery codes and Second email waiting for you.

Changing how you sign in is a sensitive action. The page can ask you to confirm first, for example with a passkey or an authenticator code, and the platform emails a security alert about the change to your verified addresses. This is expected, and What a security alert email means explains the message.

If you have only a password#

Every account is created with a password, so until you add a passkey or an authenticator app yours signs in with a password only. You can still add either from the Security area. Where this protection applies, a password-only sign-in from a new browser may see This browser is new to your account, which explains that a sign-in method can be added from a browser your account has known for at least 24 hours. The password must be that old too: a password you chose at registration, or at a Choose a password step, does not count until it has been in place for the same time. A sign-in that used a passkey or a second factor is not held back by the age of the browser. In that case, use a browser you already sign in from, or sign in here once with an emailed link or code and come back after a day: a password alone does not make a browser known, so repeating it changes nothing. The same applies to the optional extra steps on the Two-step verification page.

If you cannot get in at all, see If you are locked out.

• Security and passkeys, for the tabs behind each Set up button.
• Security levels explained, for what the checkup words Strong, Fair and Needs attention mean.