First sign-in, password and security

What these screens are for

This article covers the screens you meet before you are inside the portal: Sign in to the portal, Reset password, Set a new password (after a reset or invitation link, and on first sign-in) and Your account is on hold. You can read it without signing in, and it opens even while your account is locked.

Once you are signed in, you manage your name, password, two-factor authentication and open sessions on the Profile Settings and Security screens, both opened from the user menu in the top-right corner.

First sign-in

When your account is created, your sign-in details reach you in one of two ways:

1. An invitation link arrives by email. The link opens the Set a new password screen: fill in New password and Confirm password, then press Update password. You are then taken back to the sign-in screen. If sign-in with Microsoft or Google is available, you can also continue on the same screen with one of those accounts instead of setting a password; see "Continuing with Microsoft or Google from an invitation link" below.
2. A temporary password is passed on to you by the person who created your account. When you first sign in with it, the Set a new password screen opens; type your new password twice and press Save. You cannot reach your panel until this step is done; the panel screens bring you back to this screen.

There is no user name: type your account's email address in Email, your password in Password, and press Sign in. If a link sent you to the sign-in screen, you return to that page after signing in. If the invitation email never arrives, contact the person who created your account.

If sign-in with Microsoft or Google is available, the sign-in screen also shows Sign in with Microsoft and Sign in with Google below the Sign in button, after an or divider. These links do not replace password sign-in, which always stays available. Your Microsoft or Google account is not linked to your heyAtlas account automatically: the first time you come in this way, a banner on the sign-in screen asks you to sign in once with your email and password (if two-factor authentication is on for your account, you also enter your verification code). Once the link is created, any sessions you have open on other devices or browsers are signed out.

Continuing with Microsoft or Google from an invitation link

If sign-in with Microsoft or Google is available, the Set a new password screen opened by an invitation link also shows Continue with Microsoft and Continue with Google below the Update password button, after an or divider. The buttons appear only on an invitation link that has not expired or been used, and only for company user and sales partner user accounts; they do not appear on a password reset link or on a platform staff invitation.

1. Press one of the buttons; the Microsoft or Google sign-in screen opens.
2. Choose the account for the email address the invitation was sent to, or sign in with that account. With Microsoft only a work or school account can be used; a personal Microsoft account and a guest account in the organization are not accepted. With Google any Google account can be used.
3. If the account matches, the invitation is accepted, your Microsoft or Google account is linked to your heyAtlas account and you go straight to your panel.

• Your account is then set up without a password; the note under the buttons says so too. From then on, you sign in with Sign in with Microsoft or Sign in with Google on the sign-in screen.
• To set a password, follow Forgot your password? on the sign-in screen (see "If you forgot your password" below). Setting a password removes your Microsoft or Google sign-in link; to sign in that way as well, you link the account again. Use the same route to set a password and sign in with it if these links are missing from the sign-in screen or your Microsoft or Google sign-in is refused.
• If the email address of the account you chose differs from the invitation's, or the Microsoft account you chose is a guest account in the organization, you are taken to the sign-in screen with "The invitation couldn't be accepted with this Microsoft/Google account. …". If the Microsoft or Google account you chose is already linked to another heyAtlas account, you are also taken to the sign-in screen, this time with "This Microsoft/Google account couldn't be linked: …". In both cases your invitation link is not used up: open the link in the email again and choose the right account, or set your password.
• If your company's sign-in policy does not allow this provider or the account you chose, you see "Your company's sign-in policy doesn't allow this Microsoft/Google account. …"; carry on by setting your password with the form on the invitation link.

Microsoft or Google link on first sign-in with a temporary password

If you start with Sign in with Microsoft or Sign in with Google on the sign-in screen and then, following the banner shown when you return, sign in with your temporary password, your Microsoft or Google account is not linked, because someone else may also know the temporary password. In that case the Set a new password screen shows a warning above the password boxes: "Your Microsoft/Google account was not linked because this session was opened with a temporary password. …" Save your new password first. You can create the link afterwards: next time you sign in, start again with Sign in with Microsoft or Sign in with Google and this time sign in with your new password, or, once signed in, use Link on the Sign-in methods card of the Security screen, opened from the user menu in the top-right corner.

If you forgot your password

1. On the sign-in screen, click Forgot your password? under the Password box.
2. On the Reset password screen, type your account's email address and press Request reset.
3. The link in the email opens the Set a new password screen; type your new password twice and press Update password.

• The link works once and only for a limited time. If you try to save a password with an expired or already used link, you see "The link is invalid or has expired."; request a new one with Forgot your password? on the sign-in screen. The same route works for an invitation link that has expired.
• For security, the screen never says whether the address you typed is registered: no email is sent for an unknown address or an inactive account, yet the message on screen is the same. After many requests in a short time, no new email is sent for a while either.
• Resetting your password signs you out on every device, removes any sign-in lock and removes any Microsoft or Google sign-in links on your account; to sign in that way again, link the account again from the Sign-in methods card of the Security screen once you are signed in. If two-factor authentication is on, the verification code is still asked when you sign in with the new password.
• If the Reset password screen shows "Your Microsoft/Google sign-in links couldn't be removed. …" above the email box, your sign-in links could not be removed during Sign out everywhere. To secure your account, reset your password from this screen; resetting also removes all sign-in links.

Two-factor verification at sign-in

If two-factor authentication (2FA) is on for your account, a Verification code box appears after your password:

• Type the 6-digit code from your authenticator app, or one of your recovery codes, and press Verify. A recovery code works only once.
• If your account has a passkey, the same step also offers Sign in with passkey.
• The code step stays open for 5 minutes; during that time, reopening the sign-in screen in the same browser brings you back to the code step. When the time is up you see "Session expired, please sign in again."
• A Back to sign in link always sits at the bottom of the code step: pressing it cancels the pending code step and takes you back to the email and password step. Use it to sign in with a different account, when your code is not to hand, or after the time is up.
• A browser where you have passed verification is recognised for a while, so signing in there may not ask for the code again. Changing or resetting your password, Sign out everywhere, turning 2FA off or changing it, and creating or removing a Microsoft or Google sign-in link end that recognition on every device.
• If you have lost both your verification device and your recovery codes, you cannot get past this step, and resetting your password does not remove two-factor authentication. Ask the person who manages your account to reset your MFA: company users turn to their company's administrator, sales partner users to the manager on their team, and platform staff to a super admin. The reset does not change your password; any Microsoft or Google sign-in links on your account are removed too (on an account without a password that was set up with Microsoft or Google from an invitation link, that link is kept), and an information email is sent to you. You then sign in without a verification code. If you did not ask for the reset, use the link in the email to reset your password straight away and let your administrator know.

If your account type makes two-factor authentication mandatory (today: platform staff accounts — the Super Admin and Platform Staff roles), the Security screen opens first after you sign in, and you cannot carry on until setup is finished. To turn 2FA on yourself, renew your recovery codes or turn it off, sign in and open Security from the user menu in the top-right corner.

Too many failed attempts

• After more than 5 failed password or verification-code attempts in a row, your account is locked for a short time; the lock gets longer while failed attempts continue (up to 24 hours). The sign-in screen shows the remaining time.
• While locked, you can try again once the time is up, reset your password with Forgot your password? (a reset also removes the lock), or ask your company admin to unlock your account.
• On a browser where you have signed in successfully before, other people's failed attempts usually won't lock you out.
• If your account is locked for 30 minutes or longer, you receive an email notice.

Your account is on hold

If you see the Your account is on hold screen after signing in, your account is linked to a sales partner company but has no portal role assigned yet. This is a setup gap, and there is nothing you can do on that screen. Contact the team that created your account, and sign in again once your role has been assigned.

Warnings you may see when signing in