Multi-factor authentication (MFA)

MFA adds a second step when you sign in to webmail, so that a stolen or guessed
password alone is not enough to reach your email. **It is required for MyPandos
webmail** and you set it up once, on your first sign-in.

Setting it up (first sign-in)

1. Sign in to your webmail as usual. After your password, you'll be prompted to
set up an authenticator.
2. Choose a method:
- Authenticator app (recommended) — Google Authenticator, Microsoft
Authenticator, 1Password, Authy, etc. Scan the QR code and enter the
6-digit code it shows.
- Security key / passkey (WebAuthn) — a hardware key or your device's
built-in biometric.
3. Save your recovery codes somewhere safe (a password manager). These let
you back in if you lose your phone or key. Treat them like passwords.

After setup, each webmail sign-in asks for your second factor (or less often, if
you stay signed in on a trusted device).

Does MFA apply to Outlook / Apple Mail / my phone's mail app?

No. MFA protects webmail sign-in. Desktop and phone mail apps use an **app
password** instead (see
Setting up email on your device) — that app
password is itself a strong, revocable, per-device credential.

Lost your phone or authenticator?

Use a recovery code to sign in, then set up a new authenticator. If you have
no recovery codes, contact your administrator — they can reset your MFA
enrolment so you can set it up again.