Turn on two-step verification for your mailbox

Once turned on, every time you sign in to Webmail you enter your password and then the 6-digit code currently shown in your authenticator app. Someone who knows your password but does not have your phone cannot get into Webmail.

Turn it on

1. Install an authenticator app on your phone: Google Authenticator, Microsoft Authenticator or a similar app.
2. In Webmail, open Settings → Security Settings, and on the Two-Step Verification tab click Turn On Two-Step Verification.
3. Re-enter your mailbox password.
4. Scan the QR code with the app (if you cannot scan it, enter the key shown below the code instead), then enter the 6-digit code the app displays.
5. Save the 10 recovery codes: click Copy or Download .txt, keep them somewhere safe, check I have saved these codes somewhere safe, then click Done.

Once it is on, the mailbox is signed out of every other device — sign back in there with the password and a code.

Signing in without your phone

At the code step, click Use a recovery code and enter one. Each code works once. Running low, go back to the Two-Step Verification tab and click Generate new codes — the old set stops working.

Changing phones

On the new phone with the authenticator app installed, go to the Two-Step Verification tab, click Set up on a new phone and scan the QR code again. The code on the old phone stops working.

Lost your phone and out of recovery codes

Contact your domain administrator. They can turn off two-step verification for the mailbox from the console; you then sign in again with the password and turn it back on.

Too many wrong codes

Five wrong codes in a row locks the code step for 15 minutes. If you were not the one signing in and still hit this lock, someone else has your password — change it right away.