Documentation › Applications common › Identity and sign-in

Identity and sign-in

How a person proves who they are, and what the application does with that proof.

Sign-in methods

Applications sign people in without a password by default. The person enters their work email address and receives a one-time code; entering it creates the session. Passwords still exist for administrators as a break-glass route, and are deliberately not advertised on the sign-in page.

Passkeys and Windows Hello

A passkey is bound to the exact web address that created it. That single fact explains the behaviour people ask about most:

A passkey created on the central accounts portal can only be used at the portal. An application that offers it must therefore hand the ceremony to the portal, which is why the browser moves there for a moment.
A passkey created on the application's own address is used in place, so only the Windows Hello or Touch ID prompt appears and the page never changes.

After signing in, an application offers to set up a passkey for itself. Accepting it once is what turns every later sign-in on that application into a single prompt.

Multi-factor authentication

An authenticator app can be enrolled from the profile panel, with recovery codes issued once at enrolment. Recovery codes are shown a single time and are the way back in if the phone is lost, so they belong somewhere other than the phone.

Sessions

Changing a password ends every other session for that person immediately. Sessions can also be ended individually from the account portal, which lists where each one was signed in from.