Knowledge Base

What MFA Is

When MFA is on, signing in takes two steps:

1. Your email address and password, as usual.
2. A six-digit code from an authenticator app on your phone. The code changes every 30 seconds.

This adds a second check to your sign-in, so someone who learns only your password can't sign in to the Octavia app without the code.

An authenticator app is a free app that makes these codes. Google Authenticator, Microsoft Authenticator and the built-in Passwords app on iPhone and Mac all work.

When You Will Be Asked to Use It

MFA is switched on for a school at a time, by the school's administrator (see Switching MFA on or off for your school). You'll see one of these:

• Nothing. If MFA isn't on for your school, you won't see any MFA screen and there's no MFA card on My Profile.
• A notice. If MFA is about to become required, a banner at the top of your dashboard says when, with a Set it up now button. Nothing is blocked while you wait. You can set it up straight away or choose Not now.
• A set-up screen. Once MFA is required for your school, you'll be asked to set it up the next time you open Octavia, before you can use anything else.

If you set MFA up early, you'll be asked for a code at every sign-in from then on, even before your school's date.

Switching MFA on or off for Your School

School administrators choose whether MFA is on for their school. A new school starts with it off.

1. Open Settings and choose the School settings tab.
2. Find the Two-step sign-in (MFA) card. Select Turn on two-step sign-in to give everyone 7 days' notice first, or Require it now to start straight away, then confirm.

When you turn it on:

• Teachers, administrators and parents at your school are asked to set up an authenticator app and enter a code each time they sign in. Students aren't affected by this switch; they have their own (see below).
• Unless you choose Require it now, they get 7 days' notice first. During that time they see the banner described above and can set up early. If you've turned it on with notice, you can still select Require it now on the card to bring the start forward.
• Passwords are shorter to create. While MFA is off, a new password (for a new account or a password change) must be at least 14 characters. Once MFA is on, it must be at least 8 characters. Either way it needs upper and lower case letters, a number and a symbol.
• Passwords people already have stay as they are until they next change them.

You can turn MFA off again from the same card. Anyone who has already set up an authenticator keeps it and is still asked for a code when they sign in. New passwords and password changes then need at least 14 characters again.

Two-step sign-in for students

The same card has a second section, For students, with its own buttons: Turn on for students, Require it now for students and Turn off for students. Students are not asked to use two-step sign-in unless you switch this on; until then, students at your school see nothing different.

• Students use an authenticator app too, so each student needs a phone, tablet or other device that can run one. Check this before you switch it on. An emailed code is not used, because it isn't a second check.
• Unless you choose Require it now for students, students get 7 days' notice: they see a notice in the Student Hub and can set up early.
• It doesn't change student passwords. Students keep their own password rule whatever you choose here.
• If a student loses their device, they use one of the recovery codes saved when they set it up, in the same way as a parent. You and your teachers can't reset a student's authenticator; if a student has lost their codes too, email info@octavia.studio.
• A student who is also a parent at a school with MFA on, or who attends two studios, has one authenticator for their login. If any of their studios requires it, they set it up once. A student at your school can therefore see a notice even though you haven't switched it on, if another studio they belong to has.
• You can turn it off again from the same section. A student who has already set up an authenticator keeps it and is still asked for a code when they sign in.

Setting Up MFA

1. Install an authenticator app on your phone if you don't have one.
2. On the Set up multi-factor authentication (MFA) screen, open the app and choose to add an account.
3. Scan the square code on the screen. If you can't scan it (for example, because you're setting up on the same phone you're signing in on), select Copy key and paste the setup key into the app instead.
4. Type the six-digit code the app shows for Octavia, then select Confirm and continue.
5. Octavia then shows you a set of recovery codes. Save them before you continue. They are what let you back in if you lose your phone. See Save Your Recovery Codes.

Signing In With MFA

After you enter your password, Octavia asks for your sign-in code. Open your authenticator app, find the code for Octavia, and type it in. If you've added more than one device, choose which device you're using from the Which device? list.

You don't need to enter a code again each time you move around Octavia. You'll be asked again the next time you sign in.

Managing Your Devices

Open My Profile and find the Multi-factor authentication (MFA) card. It lists your devices, each shown as "Authenticator app", with the date it was added.

• Add another device. Select Add another device and follow the same three steps as above. You can have up to three devices.
• Remove a device. Select Remove next to it and confirm. You'll no longer be able to use that device to sign in.
• Your only device. If your school requires MFA, you can't remove your only device. Add another one first.
• Recovery codes. The same card shows how many recovery codes you have left, and lets you create a new set. See Save Your Recovery Codes.

If You Lose Your Phone

You can get back in yourself, without contacting anyone, using one of your recovery codes. That's what they're for.

1. Sign in with your email and password.
2. On the code screen, select Use a recovery code and enter one of the codes you saved.
3. Octavia removes your old authenticator and signs you out.
4. Sign in again with your password and set up a new authenticator on your new phone. You'll be given a new set of recovery codes.

See Save Your Recovery Codes for the details, including how to make a new set while you can still sign in.

If you can't find your codes, we can still help. Email info@octavia.studio from the email address on your Octavia account (a school administrator can also do this for you). We'll check that it is you before resetting your MFA, so this takes longer than using a recovery code.

Multi-Teacher Studios

In a studio with more than one teacher, every teacher sets up and uses their own MFA with their own phone. A school administrator can't see whether a teacher has set it up, and can't set it up or reset it for them. A teacher who loses their phone uses their own recovery code, so the administrator doesn't need to be involved. Only if a teacher has lost their codes as well can the administrator email info@octavia.studio on their behalf, as described above.

MFA is separate from the Family Hub. Parents set up their own; see Multi-Factor Authentication for Families. Students' two-step sign-in is described in The Student Hub.

Related Articles

• Save Your Recovery Codes
• Step-by-step guide with screenshots
• Multi-Factor Authentication for Families
• Adding and Managing Teachers

---

Next: Save Your Recovery Codes