Phones and security

In this tutorial, we turn on phone approval, set the sign-in rules, and prepare support for when someone loses their phone. Under Manage, Security, confirm with your passkey to view and change. Turn on Allow phone approval: people can then approve sign-ins and sensitive changes on an Android phone. Also decide whether the password always needs a second factor, and whether people can sign in with the phone alone.

Phone approval is multi-factor, but it isn't phishing-resistant: for critical applications, keep the passkey in the policies. The approver app needs Android 14 or later, with hardware key storage and a screen lock. The keys stay in the phone's secure hardware, and biometrics never leave it. To link the phone, each person opens Protect, My phones, Add phone.

They scan the QR code with the app, check the address is the organisation's, confirm with biometrics, and type in the browser the six digits the phone shows. Ask everyone to also generate their recovery codes: eight single-use codes, kept away from the computer. They're the emergency exit if every factor is lost. If someone loses their phone and can't sign in, the administrator removes it: under Manage, People, Phones, choose Remove.

The sessions that phone approved end immediately. If the person has lost every factor, first confirm their identity over a secure channel, and use Reset. Choose the reason, the authenticators to revoke, and the validity. The console shows an enrolment code only once: hand it over through a verified channel. And that's it: the phone as a second factor, clear rules, and a safe path to recover access.

In the next tutorial, we'll manage licences, as a distributor.