Operations · Step-by-step guide
Protect your administrator sign-in
Set up independent authenticators, complete protected access and handle a lost factor without bypassing verification.
No se ha publicado un vídeo revisado en Español para esta versión. Sigue los pasos escritos a continuación.
Before you start
- Your own active staff account and the verified affnet address supplied by operations.
- Two separately controlled devices or authenticators with independently generated secrets; syncing the same secret is not independent backup.
- For practice: isolated training accounts, an independent facilitator and approved lost-factor/uncertain-outcome fixtures. Never remove a real customer's factor.
Follow the steps
Choose the access language and sign in
At Sign in, choose your language and select Change language before entering credentials. Use your own staff account. The authenticator screens inherit the saved access language; the rest of the workspace may use another language. This guide uses English control names with translated equivalents.
What you should see: The server chooses the required enrollment, verification, backup, replacement or protected-access screen. Reading this public guide does not grant administrator permissions.
Start your first authenticator only when requested
On Set up an authenticator, select Start authenticator setup once. Scan the QR code with your trusted authenticator app, or enter the Manual setup key privately. Never include the QR code, secret, one-time code or recovery link in a ticket or recording.
What you should see: Setup material appears only after the explicit action. Opening the page alone does not enroll a factor.
Confirm the first factor
Enter the current six-digit code and select Verify and continue. Supported Arabic, Persian, Hindi and full-width digits are converted to ordinary 0–9 digits in the field. Use the current code and wait for the result before trying again.
What you should see: A successful code advances through the required server checks. It does not by itself complete backup setup or grant unrestricted administrator access.
Create an independent backup
When Add a backup authenticator appears, select Start backup authenticator setup, scan its new QR code on the separate device and select Verify backup authenticator with that device's current code. Keep the original authenticator enrolled. If Add an independent backup authenticator appears instead, select Begin backup transition, prove the original authenticator when requested, set up the new backup and complete each requested backup confirmation.
What you should see: The backup uses a different secret on a separately controlled device. A second registration or copied seed alone does not prove independent control. Administrator work stays restricted until the required transition and fresh sign-in complete.
Complete protected access and sign in again
If Initialize protected administrator access appears, select Initialize and sign in again. If the page offers Retry secure sign-out, use that control; if safe sign-out cannot be confirmed, close the browser window and contact the authorized operator. Sign in again with your own credentials and authenticator when directed.
What you should see: The current role, factors and session checks determine the destination. Initialization does not release a hold, replace a factor or prove device independence.
Use the correct authenticator during normal access
On Verify your authenticator, choose the intended registered authenticator when more than one is shown. Enter its current code and select Verify and continue once. To leave this screen, use Back to sign in and wait for secure sign-out confirmation.
What you should see: Your registered labels remain unchanged by translation. Code fields stay left to right in Arabic. A password reset never bypasses MFA or account restrictions.
Handle hidden or uncertain setup safely
Cancel local setup or Cancel and hide setup hides local material; read the displayed notice before doing anything else. If a backup transition asks to resume, choose Prepare retained authenticator proof and use the original device's current code. Do not start a second enrollment to resolve an uncertain result.
What you should see: Hiding a setup does not prove its factor was removed. Resuming preserves the original operation and cannot recover a lost secret. A provider uncertainty may leave the operation held with no factor action available.
Prepare a lost-factor replacement in training
With your facilitator and a working retained authenticator, open the authorized Replace a lost authenticator screen. Select the specific lost factor and choose Begin replacement. Prove the retained authenticator when requested, then use Continue replacement and Enroll replacement authenticator only as offered. Save the new secret privately and complete each requested new-authenticator proof.
What you should see: The current server state controls every step. Refresh retained authenticator proof renews an expired proof when offered. The retained authenticator must stay available throughout the replacement.
Remove only the authorized lost factor
Select Remove the named lost authenticator only when the protected screen offers it after the replacement is verified. Keep the retained authenticator. If the page instead offers Remove the incomplete replacement or Restart lost enrollment setup, follow that exact incomplete-registration branch with your facilitator; do not remove other factors. Sign in again when directed after completion.
What you should see: Only the named factor admitted by the current state can be removed. An uncertain removal is not automatically retried. If all verified authenticators are lost, contact an authorized operator; this flow does not bypass proof.
Pause, resume and record the observed result
Use Pause and hide this flow when offered. Resume the same case by signing in with the retained authenticator. For a held or unavailable state, preserve a redacted time, environment, case reference and observed message for the authorized operator. After the training exercise, record the actual release/configuration and submit independent review evidence.
What you should see: Hidden secrets and codes are not training evidence. Study progress is separate from a passed exercise; provider, browser and independent-device checks must be observed before live duties are approved.
If something goes wrong
A code is rejected
Check that you selected the correct registered authenticator and use its current six-digit code. Check the device clock with your facilitator. Do not create another factor just to retry a code.
Setup was hidden before the key was saved
Do not assume the factor was deleted or that reloading can recover its secret. Follow the displayed restricted recovery path or contact an authorized operator.
The account changes in another tab
Stop and return to the correct account. Do not continue a setup or proof from another user's session. Record only redacted observations.
A transition or replacement remains held
Do not manually remove factors or create another operation. Preserve the same case and contact the authorized operator; a missing response is not proof of failure.
Every verified authenticator is unavailable
Contact the authorized operations team through its verified channel. Password recovery and another person's account are not substitutes for MFA recovery.
Try it in training
Complete OPS-20 with your own isolated staff test account and independent reviewer: initial enrollment, independent backup, protected-access setup, fresh sign-in, ordinary challenge and one controlled lost-factor replacement. Demonstrate pause/resume, expired proofs, account change and uncertain provider state without duplicate enrollment or unauthorized removal. Record the actual provider behavior and device independence; repeat language, keyboard and mobile checks as assigned.
Check your understanding
Does copying one authenticator secret to a second device create an independent backup?
No. Use independently generated secrets on separately controlled devices. Two registered factors or a completed checklist does not prove independent control.