Two-factor authentication settings
Use this page to review the two-factor authentication status for your own Actualog account.
Open Two-factor authentication settings.
What this page shows
The settings page shows whether an authenticator app is already connected to your account and explains the sign-in methods used by Actualog:
- authenticator app codes;
- one-time recovery codes;
- whether this browser is remembered after a successful MFA sign-in.
If MFA is not set up yet, the page links you to the setup screen.
Trusted browsers
The page shows whether the browser profile you are using now is trusted for MFA.
A trusted browser can skip the authenticator-code prompt after you successfully enter your password. It is still tied to this browser profile, works across Actualog language domains for the same account, and expires after 30 days.
Actualog uses the standard ASP.NET Core Identity remembered-browser cookie. There is no separate list of server-side device records. Use a normal private-device browser profile that retains cookies. Private/InPrivate windows, another profile, or a browser setting that clears cookies/site data on exit cannot retain the proof and will require MFA again.
For Microsoft Edge, open edge://settings/privacy/clearBrowsingData/clearOnClose. Under Choose what to clear every time you close the browser, a green/on Cookies and other site data switch means Edge deletes trusted-browser proof whenever it fully closes, including during a Windows restart. Turn the switch off to retain cookies for all sites, or use the adjacent Don't clear list to retain the Actualog parent domain while continuing to clear other sites.
If the browser stayed open, open this page after MFA and confirm that it reports This browser is trusted. If trust disappears only after Edge closes, the browser's retention setting is the cause; switching Actualog language or restarting the application is not.
You can trust the current browser only after completing a recent authenticator-app MFA challenge. Actualog does not create a trusted browser after local development bypass or recovery-code sign-in.
Use Revoke to stop trusting the current browser. Other browser profiles keep or lose their own cookie independently. A future emergency MFA reset will invalidate remembered browsers through the account security stamp.
Who can manage it
Only you can connect an authenticator app to your account because the QR code and manual setup key are account secrets. Application administrators and company administrators cannot scan the QR code, copy the setup key, view recovery codes, or enable MFA on your behalf.
Administrators can require MFA before granting protected application or company roles. They can also ask you to complete setup before a protected role assignment is retried.
When to disable the development bypass
In local development environments, Actualog can be configured to bypass the MFA challenge after the password succeeds so automated smoke tests can sign in. Disable that development-only setting whenever you need to test the real QR-code setup, authenticator challenge, recovery-code, or trusted-browser flow.