Manage your console account

Every console user can update their own profile, phone number, and notification preferences, and protect their account with a password and two-factor authentication. This page shows how to manage those settings and review recent account activity.

Open the profile menu in the header and select Account. The console address /security still opens this page.

Before you begin

• You need an authenticator app that supports time-based one-time passwords (TOTP), such as the one built into your password manager.
• Have somewhere safe to keep your recovery codes, such as a password manager. They are shown once only.

Update your profile

1. On the Profile card, enter your Display name.
2. Choose your Personal time zone from the searchable list.
3. Select Save profile.

The console uses your personal time zone to display dates and times throughout the console.

Add or change your phone number

1. On the Phone number card, enter your Mobile number, including + and the country code.
2. Select Send SMS code.
3. If SMS verification is enabled on the system, enter the code sent by SMS in Verification code, then select Verify phone.

The card shows Verified after successful verification. If SMS verification is not enabled, the number is saved as Unverified. An unverified number is never used for sign-in codes or security alerts.

To remove the saved number, select Remove phone. Changing or removing the number sends a security notice to the email address on file.

Choose your notifications

1. On the Notifications card, select Edit notification preferences.
2. In the table, choose a Delivery for each notification: Feed and email, Feed only, Email only, or Off. The feed is the bell in the header. See Notifications.
3. Under Other email notices, clear the checkboxes for the email notice kinds you do not want.
4. Select Save preferences.

The table covers the notifications in your feed, such as Ticket assigned to me and Client replied on my ticket. Other email notices covers email-only notices, such as project, quote, invoice, incident, alert, and scheduled-report emails. Account security notices are always on and cannot be disabled.

Change your password

The Password card says when your password was last changed, and lists what a new password has to be under A new password has to be:. Every password must be at least 12 characters. Your organization’s compliance frameworks can add rules, such as a capital letter, a number, a symbol, or not reusing a recent password.

1. On the Password card, select Change password.
2. In Current password, enter your current password.
3. In New password, enter the new password.
4. In Confirm new password, enter it again.
5. Select Change password.

Password fields have an eye button labeled Show password or Hide password.

Outpost refuses a password that is on its built-in list of common breached passwords, that contains part of your email address, that uses too few different characters, or that breaks one of your organization’s rules. The message under the field says which.

When the change succeeds, every other browser signed in as you is signed out. The browser you used stays signed in unless the console asks you to sign in again. A password change also sends a security notice to the email address on file.

If your account has no password yet, the card says No password is set on this account yet. and the button is Set password. There is no Current password field in that case.

Tip

Forgot your password? On the sign-in page, select Forgot your password? to get a sign-in code by email. Once you are signed in, set a new password here.

Turn on two-factor authentication

When two-factor authentication is off, the Two-factor authentication card says Your password is the only thing protecting this account.

1. On the Two-factor authentication card, select Set up two-factor.
2. Scan the QR code with your authenticator app. If you cannot scan it, enter the key shown under Cannot scan? Enter this key by hand:, or select Open in an authenticator app.
3. In Code from your app, enter the six digit code the app shows.
4. Select Turn on two-factor.
5. On Save your recovery codes, copy the 10 codes somewhere safe.
6. Select I have saved these.

Two-factor authentication is not on until you enter a code in step 3. If you select Cancel before that, nothing changes.

Danger

The recovery codes are shown once and never again, because Outpost stores only their hashes. Each code signs you in once if you lose your authenticator. No one, including an owner, can show them to you again.

After that, the console asks for a code from your app each time you sign in. To use a recovery code instead, select Use a recovery code instead on the Two-factor step of the sign-in page.

Check how many recovery codes you have left

When two-factor authentication is on, the card shows On and how many recovery codes remain.

Turn off two-factor authentication

1. On the Two-factor authentication card, in Enter a current code to turn it off, enter the code your authenticator app shows.
2. Select Turn off two-factor.

You receive a security notice when two-factor authentication is turned off. See Security notices and SMS.

Change your email address

Your email address is your sign-in name, and it is where sign-in codes and security notices are sent. Outpost confirms you can read mail at the new address before it switches.

1. On the Email address card, select Change.
2. In New email address, enter the new address.
3. Select Send verification code.
4. In Verification code, enter the code sent to the new address.
5. Select Confirm new address.

The card shows Your email address has been changed. A notice of the change is also sent to the address you stopped using.

Confirm it is you

Some actions ask you to prove it is you again, even though you are signed in, in a dialog titled Confirm it is you. It shows the best method you have first: a passkey if you have one, otherwise an authenticator code, otherwise your password. The other methods the action accepts appear as links: Use a passkey, Use an authenticator code, Use a recovery code, and Use your password.

Action	Passkey	Authenticator code	Recovery code	Password
Resume a remote session paused for inactivity where a sign-in is required	Yes	Yes	Yes	Yes
Reveal or use a stored credential, and other sensitive actions such as backup encryption keys, MDM overrides, and AI approvals	Yes	Yes	Yes	No

• Passkey. Select Use a passkey, and confirm with your device’s PIN, fingerprint, or face. Passkeys are offered where your organization accepts passkey sign-in. See Authentication.
• Authenticator code or Recovery code. Enter the code, and select Confirm. A recovery code is used up.
• Password. Enter your password, and select Confirm.

Sensitive actions do not accept your password because it is usually what opened the session, and your browser may fill it in. On a computer someone left signed in, typing it proves little.

Each wrong password or code counts toward the same lockout as signing in, and a locked account cannot confirm. An account that signs in only with a code sent by email has nothing to confirm with, and the dialog says so. Add an authenticator app or a passkey to use these actions. For a paused remote session, start a new session instead.

Review recent activity

The Recent activity card lists the latest security events on your account, with the address and browser each came from. Read it for anything you do not recognize.

Entry	Meaning
Signed in	Someone signed in to your account.
Sign-in attempt failed	Someone tried to sign in and failed.
Account locked after repeated failures	Too many failed attempts locked the account for a while.
Password changed	The password was changed.
Two-factor turned on, Two-factor turned off	Two-factor authentication changed.
Recovery code used	A recovery code was used to sign in.
Email address changed	The account’s email address changed.
Role granted, Role revoked	An owner changed your roles.

If you see something you do not recognize, change your password and turn on two-factor authentication.

Preferences

Owners also see a Preferences card with Show unavailable features. When it is selected, features your plan does not include stay in the navigation with a lock. Clear it to remove them. See Plan-locked features.

Verify

The Two-factor authentication card shows On and You will be asked for a code when you sign in. The Recent activity card lists Two-factor turned on with your own address and browser.

Next steps

• Security notices and SMS
• Restrict console sign-in with access rules
• Console preferences