Two-factor authentication (2FA) in CrashPlan asks a user who signs in with a CrashPlan account password for a verification code as well as the password. It applies to sign-in to both the CrashPlan app and the CrashPlan console.
CrashPlan 2FA is an organization setting that an administrator turns on, and each user in the organization then sets up their own verification method.
Verification methods
Each CrashPlan user chooses a 2FA method the first time CrashPlan asks them to set up 2FA:
- Authenticator app (recommended): A time-based one-time password (TOTP) app on a phone or in a web browser generates the code. The code depends on the clocks of the device running the authenticator app and the device signing in to CrashPlan being in sync with an internet time source.
- Email verification: CrashPlan sends the code to the email address associated with the user's account. The code is single-use and valid for 5 minutes, after which the user must request a new one from the sign-in page.
A CrashPlan user who wants a different 2FA method, or who has lost the device their authenticator app runs on, must reset their 2FA and choose a method again.
Which users 2FA applies to
CrashPlan 2FA applies to users who sign in with a CrashPlan account password, in an organization that has 2FA turned on:
- Users who sign in with a CrashPlan account password: CrashPlan asks for a code at each sign-in.
- Users who sign in with single sign-on (SSO): CrashPlan sends them to their identity provider, and the CrashPlan 2FA setting does not apply to them. Any multi-factor requirement for these users is configured in the identity provider.
- Local users in an organization that uses SSO: Accounts listed as local users on an SSO authentication provider sign in with a CrashPlan password, so CrashPlan 2FA applies to them when their organization has it turned on. Local users are described in the Identity management reference.
Effect on CrashPlan API scripts
CrashPlan 2FA also applies to scripts and integrations that authenticate to the CrashPlan API with a user's email address and password. Once that user has 2FA, basic authentication stops working for the script, so administrators must move such scripts to a token authentication method before turning 2FA on. The methods are described in CrashPlan API authentication methods.
Turning on, setting up, and resetting 2FA
CrashPlan 2FA has three stages, each with its own procedure:
- Turning 2FA on or off: An administrator changes the setting for an organization, as described in Manage two-factor authentication for an organization. That article also covers what changes for users when the setting changes.
- Setting up 2FA: Each user sets up 2FA at their next sign-in after it is turned on, as described in Set up two-factor authentication.
- Resetting 2FA: A user resets their own 2FA from the sign-in page with their email address and password, as described in Reset or change your two-factor authentication. An administrator can also reset a user's 2FA from the CrashPlan console.