Set up MFA for your entire team in clariBI

A BI account holds revenue, customer lists and financial plans. If someone's password leaks, from phishing or from reuse on a site that was breached, two-factor authentication (MFA) is what stops a stranger from signing in with it. Signing in then needs the password plus a six-digit code from an app on the person's phone.

In clariBI, MFA is available on every plan and uses time-based codes (TOTP) from an authenticator app. SMS codes are not available. This guide covers setting it up yourself, rolling it out to the team, checking who has done it and handling the problems that come up.

Before you start: what to know

• Any TOTP authenticator app works: Google Authenticator, Microsoft Authenticator, Authy, 1Password, Bitwarden and others.
• Each person sets it up on their own account. Owners cannot turn it on for someone else, because the authenticator lives on that person's phone.
• Owners and administrators can require it. In Settings > Security > Two-factor sign-in for your organization you give members a number of days to set it up. After that date, anyone who has not done it can sign in but only reach the security settings until they add an authenticator.
• It covers password, Google and Facebook sign-in. People who sign in through your organization's single sign-on on Enterprise are not affected; your identity provider's rules apply to them.

Step 1: set it up on your own account

Do this first so you know the flow before you explain it to others.

1. Open the account menu (your initials, top right) and click Settings.
2. Open the Security tab and find Multi-Factor Authentication.
3. Start Setup Authenticator App. clariBI shows a QR code.
4. In your authenticator app, add an account and scan the code. The app starts showing a six-digit code that changes every 30 seconds.
5. Optionally name the device, for example "Work phone".
6. Type the current code under Verify Your Setup and confirm.

When the code is accepted, clariBI confirms that authenticator app sign-in is on.

Step 2: save backup codes

Backup codes let you sign in without your phone. clariBI generates 10 codes of 8 characters, and each works once.

• Open Backup Codes in the same section and generate them.
• Store them in a password manager, or print them and keep the paper somewhere safe.
• Do not keep them on the same phone as the authenticator app.
• When you have used a few, generate a new set. The new set replaces the old one.

Step 3: test the sign-in

Sign out and sign in again. After your email and password, the Two-Factor Authentication screen asks for a code. Choose your device if you have more than one, enter the code and click Verify Code. Then try Use backup code instead once, so you know it works before you need it (and generate a fresh set afterwards).

Step 4: switch on the requirement

In Settings > Security, find Two-factor sign-in for your organization:

1. Tick Require two-factor sign-in for every member.
2. Set Days to set it up. One to two weeks is usually enough. The period starts now for existing members and on the day they join for new ones.
3. Click Save.

From now on, members who have not set it up see a reminder with their date.

Step 5: tell the team

A short message works better than a long policy. Cover:

• What: "We are turning on two-factor sign-in for clariBI."
• Why: "It holds our revenue and customer data. A leaked password alone should not be enough to get in."
• What to do: "Install an authenticator app, then go to Settings > Security > Multi-Factor Authentication and follow the steps. Save your backup codes in the password manager."
• By when: the date the requirement takes effect, and what happens after it (only the security settings open until they set it up).
• Help: who to ask, and a link to the two-factor authentication article.

Setup takes a few minutes per person. Offer a short slot where people can do it together; it clears most questions at once.

Step 6: check who has turned it on

The Two-factor sign-in for your organization section shows how many members use two-factor and lists everyone who has not set it up yet, with their date. It is on every plan.

On Professional and Enterprise, the organization audit trail (Settings > Organization > Audit Trail) also records an MFA Enabled event when a person completes setup, and you can filter by that event type. By default only the Owner can read the audit trail; the audit trail documentation explains how to give that permission to others with a custom role.

Follow up with anyone still on the list a few days before their date, so nobody is surprised when only the security settings open.

Step 7: make it part of onboarding

Add "install an authenticator app and turn on clariBI MFA" to your new-hire checklist, next to the password manager. When you invite someone, include the instructions in the invitation message.

Common problems and fixes

"Invalid code"

The codes depend on the phone's clock. Set the phone's date and time to automatic, wait for a fresh code and try again.

Changing phones

1. While the old phone still works, add the new phone as a second device under Active Devices.
2. Check that a code from the new phone works.
3. Disable the old device. clariBI asks for your password to confirm.

If the old phone is already gone, sign in with a backup code, add the new phone and disable the old device.

Lost phone and no backup codes

The person should email support@claribi.com from their account's email address and explain what happened; expect to be asked to confirm the account is theirs. The login problems article covers this and other sign-in issues. This is the case backup codes exist to prevent, so make saving them part of setup, not an optional extra.

Related settings worth turning on

While you are in Settings > Security, point the team at two more settings that are available on every plan:

• Login Notifications: an email whenever someone signs in to your account, noting new devices.
• Active Sessions: the list of devices where you are signed in, where you can sign out one device or all others.

The session settings article explains both.

MFA answers "is this really the person?" Roles answer "what should this person be able to see and change?" Review both during the rollout: check that each member has the right organization role, and that the number of Owners and Administrators is as small as it can be. On Professional and Enterprise, our guide to custom roles shows how to give people exactly the permissions they need. The security overview summarizes the sign-in, session and audit features together.

Start with yourself today

Turn on MFA on your own account, save your backup codes, sign out and back in. Then switch on the requirement, send the team message with the date, and check the list once a week until everyone is done.