Signing In and MFA

Overview

PreStartGo has two sign-in worlds, and knowing which one you belong to answers most sign-in questions before they start. The admin console — the office surface — signs in with an email address and password, with multi-factor authentication (MFA) layered on top. The mobile app — the field surface — signs in with a phone number and an SMS code; the code is the authentication, so there is no separate password and no separate MFA step.

One person who works in both worlds has two identities — an email one and a phone one — signed in separately. That's by design; see Inviting Your Team.

Who must use MFA

• Account Owners and Administrators — always. The two roles that can change people, money and configuration carry mandatory MFA, regardless of any organisation setting.
• Everyone else — when your organisation says so. The Account Owner can turn on org-wide MFA enforcement, which extends the requirement to Contributors and Read-only users as well.
• Single sign-on is coming. It isn't switched on yet, so today these rules apply to every console user. See SSO.

Enforcement is real, not advisory: a console account that should have MFA and doesn't is blocked at sign-in — and blocked again on every request — until enrolment is complete. You cannot quietly skip it.

Enrolling in MFA

At your first sign-in after MFA applies to you, the console walks you through enrolment. You choose a second factor:

• Authenticator app (TOTP) — recommended. Scan the QR code with any standard authenticator app (Google Authenticator, Microsoft Authenticator, 1Password, Authy…), then confirm with the six-digit code it shows. Codes work with no phone signal.
• SMS to your phone — a code texted at each sign-in. Simpler, but dependent on coverage and on keeping that number.

1. 1
   Sign in with your email and password as normal.
2. 2
   When prompted, choose Authenticator app or SMS.
3. 3

   For an authenticator app: scan the QR code, then enter the current six-digit code to prove the pairing. For SMS: confirm your mobile number, then enter the code that arrives.

4. 4
   That's it — future sign-ins ask for your password plus a current code.

Signing in day to day

• Console: your email, your password, then your second factor when prompted. Sessions last about a week by default, and your organisation can set anywhere from one to thirty days — you won't be asked for MFA on every click, but you will on a fresh sign-in.
• Mobile app: your phone number, then the SMS code. If your organisation uses PreStartGo across multiple companies (a contractor licensed by two builders, say), the one phone identity carries all of them — there's nothing extra to juggle.

Edge cases

• New phone, same authenticator app — if you migrated your authenticator app's accounts to the new phone, nothing changes. If you didn't, you'll need an MFA reset (below).
• Changed mobile number — update it before the old number goes dead: SMS-factor console users need it for sign-in, and mobile-app operators are their phone number — see Inviting Your Team.

Troubleshooting