The protection status of your account and your team, with what is left to do.
What it is for
Seeing at a glance what is weak. A team is only as protected as its least protected member: one administrator without a second factor cancels everyone else's effort.
How to use it
- Each check is a sentence, not a score. "Three members out of five have a second factor" can be fixed; a score out of 100 does not tell you what to do.
- Privileged accounts first. An administrator without two-factor authentication is the most rewarding way in for anyone trying.
- Failed sign-ins are counted. A sudden rise on one account deserves a changed password, not monitoring.
- The history answers "who did this". It is next door, and every check links to it.
Step by step: raising the team's level
- Deal with privileged accounts first. Require two-factor authentication from administrators before anyone else.
- Do not be alarmed by invited accounts. They show in the list, but they do NOT count towards coverage: nobody is blamed for lacking a second factor before they have opened their invitation. If one is lingering and will not be used, revoke it from Settings › Team › Members, where invitations live.
- Check locked accounts. A lockout after several failures may be a colleague who forgot their password, or not.
- Check backup codes. A member with two-factor authentication but no backup code will call you one day, and there will be no quick fix.
- Do this round every quarter. Accounts get added; protections do not add themselves.