ScreenReviewed 2026-09-29

Two-factor sign-in

Turn on two-factor authentication with an authenticator app, sign in with a 6-digit code or a backup code, manage your backup codes, and what happens when your organization requires it.

Two-factor authentication adds a second step when you sign in: after your password, you type a 6-digit code from an authenticator app on your phone, such as Google Authenticator or Authy. Someone who learns your password still can't get in without your phone.

Where to find it

To turn it on or off: account menu > My Profile > the Two-factor authentication card. Anyone signed in can do this for their own account; no permission is needed.
To require it for everyone: Settings > Organization > Security policy. You need the Edit permission on Organization Settings.

Before you start

Install an authenticator app on your phone.

What you see

The Two-factor authentication card on My Profile shows a badge: Enabled, or Off (red when your organization requires it). Once it is on, the card shows "Enabled on" with the date and "Backup codes remaining N of 10", in amber when two or fewer are left.

What you can do

Turn it on

On My Profile, click Set up two-factor authentication.
Scan the QR code with your authenticator app ("Scan with your authenticator app"). If you can't scan, type the key shown under "Or enter this key manually" (there is a copy button next to it), using the settings on the line below: your email as the account, 6 digits, every 30 seconds, SHA1. In the app the entry is named "NirmaanOne" followed by your organization's name in brackets.
Type the 6-digit code the app shows into Enter the 6-digit code to confirm and click Enable. Cancel stops without turning it on. Typing anything other than six digits shows "Enter the 6-digit code from your authenticator app".
The Save your backup codes window opens with ten codes like ABCD-EFGH. "Each code signs you in once if you lose access to your authenticator app. They are shown only now." Use Copy codes or Download .txt and keep them somewhere safe.
Tick "I have saved these codes somewhere safe" and click Done. The window can't be closed any other way.

A wrong code shows "That code is not valid. Check your authenticator app and try again."

On the sign-in page, enter your email and password and click Sign in.
The page changes to Two-factor authentication: "Enter the 6-digit code from your authenticator app."
Type the code into Authentication code and click Verify.

If you don't have your phone, click Use a backup code instead (shown only while you still have unused backup codes). The page says "Enter one of your backup codes. Each code works once."; type one into Backup code and click Verify. After signing in you see how many are left, for example "Signed in with a backup code. 7 backup codes left." Use the authenticator app instead switches back, and Back to sign in returns to the password step. A code shorter than six characters shows "Enter the 6-digit code or a backup code"; longer than twelve, "That code is too long".

You have five minutes between the password and the code. After that you are returned to the password step with "The sign-in step expired. Enter your password again."

Get new backup codes

Click Regenerate backup codes. The window "Regenerate backup codes" says "Your current backup codes will stop working. Enter your password to continue."; enter your Password and click Regenerate (grey until you type the password). The new codes open in the same Save your backup codes window as before. A wrong password shows "The password is incorrect."

Turn it off

Click Disable two-factor. The window "Disable two-factor authentication" says "Enter your password and a current code (or a backup code) to turn two-factor off."; fill in Password and Authentication or backup code and click Disable (grey until both are filled). You see "Two-factor authentication disabled." A wrong password shows "The password is incorrect."; a wrong code, "That code is not valid. Check your authenticator app and try again."

While your organization requires two-factor, Disable two-factor is greyed out with the hover reason "Your organization requires two-factor authentication, so it cannot be turned off."

Lost your phone and your backup codes

The card says "Lost your authenticator and your backup codes? Ask an administrator to reset your two-factor authentication from Settings > Users." An administrator uses Reset two-factor on your row in Users; see Reset a user's two-factor authentication. You are signed out everywhere and can then sign in with your password alone. If your organization requires two-factor, you must set it up again before you can use anything but My Profile.

If you are the administrator who is locked out and no other administrator can reset it for you, contact NirmaanOne support; the support team can reset it once they have confirmed who you are.

Require it for everyone (administrators)

In Settings > Organization, the Security policy card shows how many users there are and how many are "without two-factor authentication". Switch on Require two-factor authentication for all users ("Users without it can still sign in but only to set it up; every other page is blocked until they do."). The window "Require two-factor for everyone?" tells you how many users "have not set it up yet. They will be limited to their profile page until they do." (or "Every active user already has two-factor authentication enabled."); click Require two-factor. You see "Two-factor authentication is now required for everyone."

Switching it off opens "Stop requiring two-factor?": "New users will no longer have to set up two-factor authentication." followed by how many users have it turned on ("You can leave it on for them (they can turn it off themselves) or turn it off for everyone now.") or "Nobody has it turned on at the moment." Choose:

Keep it for users who have it: the requirement goes, and people who already use two-factor keep it. You see "Two-factor authentication is optional again."
Turn it off for everyone: the requirement goes and two-factor is removed from every account in the organization, including backup codes. You see "Two-factor authentication is optional and turned off for everyone."
Cancel: nothing changes.
Who: anyone with the Edit permission on Organization Settings. Without it the switch is greyed out, with no hover reason.
You must have two-factor turned on for your own account first; otherwise you see "Enable two-factor authentication on your own account before requiring it for everyone." with the link Set up yours in My Profile.

Things to know

When your organization requires it, you can still sign in without it, but only to set it up. A red banner says "Your organization requires two-factor authentication. Until you set it up, most pages will refuse to load data." and pages show "Your organization requires two-factor authentication. Set it up in My Profile to continue." Use Set up two-factor authentication in the banner to go straight to the card.
Each code works once. Using the same code twice in its 30-second window shows "That code was already used. Wait for the next one and try again."
Check your phone's clock. Codes depend on the time. The app accepts the code just before and just after the current one, but a phone clock that is minutes out will fail.
You can't turn it off while your organization requires it. Only an administrator can reset it for you.
Keep your backup codes. If you lose both your phone and your backup codes, an administrator has to reset your two-factor authentication before you can sign in again.
Connecting an AI assistant also needs two-factor when your organization requires it. See Connect an app.

My ProfileScreen
Your own account: see your email, organization and roles, change your name and phone, change your password, turn two-factor authentication on or off, and sign out everywhere.
Sign inScreen
Sign in to NirmaanOne with your email and password, and with a 6-digit code or a backup code when your account has two-factor authentication.
OrganizationScreen
Your organization's profile and policies: name and invitation expiry, the two-factor requirement, the AI connectors switch, the help-assistant recording switch, the project defaults every project inherits (RERA gate, estimate validity, the two chargeable areas, carpet area offered, revenue method and trigger) and the effective-dated rules: the RERA escrow share that splits every sweep of a project's collection account, TDS on sales and booking cancellation.
Sidebar, top bar and notifications bellScreen
The frame around every page once you are signed in: the sidebar with its groups, the top bar with the notifications bell, the light and dark switch and your account menu, and the banners that ask you to act.
Connect an app (<app> wants to connect to NirmaanOne)Screen
The consent page an AI assistant sends you to when it asks to work in NirmaanOne on your behalf: see what it will be able to do, then allow or deny it.
Pages refuse to load data: your organization requires two-factor authenticationTroubleshooting
A red banner says most pages will refuse to load data, dashboard sections fail and every list shows the same message: the organization now requires two-factor authentication and your account has not set it up yet.
Cannot sign in: wrong password, pending invitation, deactivated account or a rejected codeTroubleshooting
The sign-in form, the two-factor step or a password form refuses you: what each message means, the rule behind it and how to get back in.
Set up two-factor authentication and require it for everyoneHow-to
Turn on two-factor authentication for your own account with an authenticator app on My Profile, save your backup codes, sign in with a code, and then, as an administrator, require it for every user of the organization.
Reset a user's two-factor authenticationHow-to
When a user has lost both their authenticator app and their backup codes, an administrator resets their two-factor authentication from Settings > Users so they can sign in again with their password.
UsersScreen
The people in your organization: invite new users, change their role, deactivate or reactivate them, reset a lost two-factor authentication, and resend or revoke pending invitations.
User accounts: invitations, status and sign-inConcept
How a person gets an account (by invitation), the four user statuses and how they are derived, how long an invitation link lives, what happens at sign-in with and without two-factor authentication, how long a session lasts, and what deactivation does.