---
title: "Manage your console account"
description: "Update your profile, phone number, and notification preferences, change your password or email address, and manage two-factor authentication."
url: "https://support.outpostplatform.com/depot/account-security/"
product: "depot"
type: "how-to"
status: "draft"
ai_summary: "Manage your own Account settings: display name, personal time zone, verified mobile number, notification feed and email preferences, password, two-factor authentication, recovery codes, verified email change, and Recent activity. Security notices cannot be disabled. Owners can also choose Show unavailable features."
availability:
  plans: ["home-lab", "essentials", "enterprise", "msp"]
  preview: false
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/depot/account-security.md"
license: "CC BY 4.0"
---

# Manage your console account

Every console user can update their own profile, phone number, and notification
preferences, and protect their account with a password and two-factor
authentication. This page shows how to manage those settings and review
recent account activity.

Open the profile menu in the header and select **Account**. The console address
`/security` still opens this page.

## Before you begin

- You need an authenticator app that supports time-based one-time passwords
  (TOTP), such as the one built into your password manager.
- Have somewhere safe to keep your recovery codes, such as a password manager.
  They are shown once only.

## Update your profile

1. On the **Profile** card, enter your **Display name**.
2. Choose your **Personal time zone** from the searchable list.
3. Select **Save profile**.

The console uses your personal time zone to display dates and times throughout
the console.

## Add or change your phone number

1. On the **Phone number** card, enter your **Mobile number**, including `+`
   and the country code.
2. Select **Send SMS code**.
3. If SMS verification is enabled on the system, enter the code sent by SMS
   in **Verification code**, then select **Verify phone**.

The card shows **Verified** after successful verification. If SMS verification
is not enabled, the number is saved as **Unverified**. An unverified number is
never used for sign-in codes or security alerts.

To remove the saved number, select **Remove phone**. Changing or removing the
number sends a security notice to the email address on file.

## Choose your notifications

1. On the **Notifications** card, select **Edit notification preferences**.
2. In the table, choose a **Delivery** for each notification: **Feed and
   email**, **Feed only**, **Email only**, or **Off**. The feed is the bell in
   the header. See [Notifications](/depot/notifications/).
3. Under **Other email notices**, clear the checkboxes for the email notice
   kinds you do not want.
4. Select **Save preferences**.

The table covers the notifications in your feed, such as **Ticket assigned to
me** and **Client replied on my ticket**. **Other email notices** covers
email-only notices, such as project, quote, invoice, incident, alert, and
scheduled-report emails. Account security notices are always on and cannot be
disabled.

## Change your password

The **Password** card says when your password was last changed, and lists what
a new password has to be under **A new password has to be:**. Every password
must be at least 12 characters. Your organization's compliance frameworks can
add rules, such as a capital letter, a number, a symbol, or not reusing a
recent password.

1. On the **Password** card, select **Change password**.
2. In **Current password**, enter your current password.
3. In **New password**, enter the new password.
4. In **Confirm new password**, enter it again.
5. Select **Change password**.

Password fields have an eye button labeled **Show password** or **Hide password**.

Outpost refuses a password that is on its built-in list of common breached
passwords, that contains part of your email address, that uses too few
different characters, or that breaks one of your organization's rules. The
message under the field says which.

When the change succeeds, every other browser signed in as you is signed out.
The browser you used stays signed in unless the console asks you to sign in
again. A password change also sends a security notice to the email address on file.

If your account has no password yet, the card says **No password is set on this
account yet.** and the button is **Set password**. There is no
**Current password** field in that case.

:::tip
Forgot your password? On the sign-in page, select **Forgot your password?** to
get a sign-in code by email. Once you are signed in, set a new password here.
:::

## Turn on two-factor authentication

When two-factor authentication is off, the **Two-factor authentication** card
says **Your password is the only thing protecting this account.**

1. On the **Two-factor authentication** card, select **Set up two-factor**.
2. Scan the QR code with your authenticator app. If you cannot scan it, enter
   the key shown under **Cannot scan? Enter this key by hand:**, or select
   **Open in an authenticator app**.
3. In **Code from your app**, enter the six digit code the app shows.
4. Select **Turn on two-factor**.
5. On **Save your recovery codes**, copy the 10 codes somewhere safe.
6. Select **I have saved these**.

Two-factor authentication is not on until you enter a code in step 3. If you
select **Cancel** before that, nothing changes.

:::danger
The recovery codes are shown once and never again, because Outpost stores only
their hashes. Each code signs you in once if you lose your authenticator. No
one, including an owner, can show them to you again.
:::

After that, the console asks for a code from your app each time you sign in.
To use a recovery code instead, select **Use a recovery code instead** on the
**Two-factor** step of the sign-in page.

### Check how many recovery codes you have left

When two-factor authentication is on, the card shows **On** and how many
recovery codes remain.

### Turn off two-factor authentication

1. On the **Two-factor authentication** card, in **Enter a current code to turn
   it off**, enter the code your authenticator app shows.
2. Select **Turn off two-factor**.

You receive a security notice when two-factor authentication is turned off.
See [Security notices and SMS](/depot/security-notices/).

## Change your email address

Your email address is your sign-in name, and it is where sign-in codes and
security notices are sent. Outpost confirms you can read mail at the new
address before it switches.

1. On the **Email address** card, select **Change**.
2. In **New email address**, enter the new address.
3. Select **Send verification code**.
4. In **Verification code**, enter the code sent to the new address.
5. Select **Confirm new address**.

The card shows **Your email address has been changed.** A notice of the change
is also sent to the address you stopped using.

## Confirm it is you {#confirm-it-is-you}

Some actions ask you to prove it is you again, even though you are signed in,
in a dialog titled **Confirm it is you**. It shows the best method you have
first: a passkey if you have one, otherwise an authenticator code, otherwise
your password. The other methods the action accepts appear as links: **Use a
passkey**, **Use an authenticator code**, **Use a recovery code**, and **Use
your password**.

| Action | Passkey | Authenticator code | Recovery code | Password |
| --- | --- | --- | --- | --- |
| Resume a remote session paused for inactivity where a sign-in is required | Yes | Yes | Yes | Yes |
| Reveal or use a stored credential, and other sensitive actions such as backup encryption keys, MDM overrides, and AI approvals | Yes | Yes | Yes | No |

- **Passkey.** Select **Use a passkey**, and confirm with your device's PIN,
  fingerprint, or face. Passkeys are offered where your organization accepts
  passkey sign-in. See [Authentication](/depot/authentication/).
- **Authenticator code** or **Recovery code.** Enter the code, and select
  **Confirm**. A recovery code is used up.
- **Password.** Enter your password, and select **Confirm**.

Sensitive actions do not accept your password because it is usually what
opened the session, and your browser may fill it in. On a computer someone
left signed in, typing it proves little.

Each wrong password or code counts toward the same lockout as signing in, and
a locked account cannot confirm. An account that signs in only with a code
sent by email has nothing to confirm with, and the dialog says so. Add an
authenticator app or a passkey to use these actions. For a paused remote
session, start a new session instead.

## Review recent activity

The **Recent activity** card lists the latest security events on your account,
with the address and browser each came from. Read it for anything you do not
recognize.

| Entry | Meaning |
| --- | --- |
| **Signed in** | Someone signed in to your account. |
| **Sign-in attempt failed** | Someone tried to sign in and failed. |
| **Account locked after repeated failures** | Too many failed attempts locked the account for a while. |
| **Password changed** | The password was changed. |
| **Two-factor turned on**, **Two-factor turned off** | Two-factor authentication changed. |
| **Recovery code used** | A recovery code was used to sign in. |
| **Email address changed** | The account's email address changed. |
| **Role granted**, **Role revoked** | An owner changed your roles. |

If you see something you do not recognize, change your password and turn on
two-factor authentication.

## Preferences

Owners also see a **Preferences** card with **Show unavailable features**. When
it is selected, features your plan does not include stay in the navigation with
a lock. Clear it to remove them. See
[Plan-locked features](/depot/plan-locked-features/).

## Verify

The **Two-factor authentication** card shows **On** and **You will be asked for
a code when you sign in.** The **Recent activity** card lists **Two-factor
turned on** with your own address and browser.

## Next steps

- [Security notices and SMS](/depot/security-notices/)
- [Restrict console sign-in with access rules](/depot/access-rules/)
- [Console preferences](/depot/console-preferences/)