Two-Factor Authentication

Two-factor authentication lives on the Security page in your practice settings, and it is one switch: Enforce two-factor authentication. Turn it on and it applies at once. Every member of the practice confirms their sign-in with a six-digit code from an authenticator app, and anyone signed in without one is asked to sign in again. There is no per-user setting to forget, and nobody can opt out.

If you already use two-factor authentication yourself, you stay signed in after saving. If you don't, Sodium signs you out so you can set yours up first — the same way everyone else will.

Nobody needs a briefing. The moment you save, everyone signed in without two-factor authentication is told the practice now requires it and sent to sign in again, where Sodium walks them through it: install an authenticator app if they don't have one, scan the code, type in the six digits it shows. Microsoft Authenticator, Google Authenticator or any other authenticator app works.

They are also shown a recovery code, for when the phone is not to hand. Kept somewhere safe, it gets them back in without a call to you.

After that, signing in takes a few seconds longer: the usual details, then the code from the authenticator app.

Some people belong to more than one practice: a partner in two firms, an outsourced bookkeeper, an accountant who also runs their own. Two-factor authentication follows the person, not the practice. If any practice they belong to enforces it, they are asked for the code wherever they sign in — and switching it off in one practice makes no difference while another still requires it.