Secure your account and see who signed in
One screen holds your password, two-factor authentication, your recovery codes and a log of the last twenty things that happened to your sign-in. Everything here is about your own account, so every role can use it on every plan. Controlling what other people in the workspace can reach is a different job — that is Invite people and set their role.
Before you start
Tip
The Security Score card at the top of the Security screen counts three things: a password, two-factor authentication, and recovery codes saved. It reads 100 when all three are done.
Change your password
Open Account & Team in the sidebar.
Choose Security.
Type your existing password into Current password.
Type the new one into New password.
A strength meter and five checks appear as you type: at least 8 characters, an uppercase letter, a lowercase letter, a number and a special character.
Repeat it in Confirm new password.
Click Update password.
You stay signed in. The 90-day clock restarts from now.
Note
Only two of those rules are enforced: the password must be at least 8 characters, and it must differ from the one you are replacing. The other four checks are advice, and a password that fails them is still accepted. Meet all five anyway.
Password expiry
Every password lasts 90 days. MarqIQ emails a reminder 14 days, 7 days and 1 day before it lapses. A banner sits at the top of every dashboard page for those last 14 days.
Once it has lapsed, your session ends and sign-in is refused. Sign in once more and MarqIQ emails you a link to set a new one, or use Forgot password? on the sign-in page.
Turn on two-factor authentication
Click Enable 2FA on the Two-Factor Authentication card.
Scan the QR code with your authenticator app.
The screen names Google Authenticator, Authy and Microsoft Authenticator. Any app that supports a time-based one-time password works.
- No camera on this machine: copy the setup key shown under Or enter the setup key manually and type it into the app instead.
Type the six-digit code from the app.
Click Verify & Enable.
The card heading changes to Two-Factor Authentication — Enabled and the recovery codes panel appears beneath it.
Note
A code is accepted one time step either side of the current one, so a clock a few seconds out still works. A clock minutes out does not — check your phone is set to update the time automatically.
Save your recovery codes
Recovery codes are what get you in when your phone is lost. The panel appears inside the Two-Factor Authentication card once two-factor is on.
Click Generate codes.
MarqIQ makes ten codes in the form XXXX-XXXX.
Save the ten codes somewhere you can reach without your phone.
Download saves them as marqiq-recovery-codes.txt.
- Click Download to save them as a text file.
- Click Copy all to paste them into your password manager.
Keep them off the phone holding your authenticator.
Take care
The codes are shown once and never again. Each one works a single time. Clicking Regenerate destroys every existing code, used or not, and issues ten fresh ones — anything you wrote down before stops working.
The panel is headed Recovery Codes and shows how many are left, as "N/10 remaining". Generate a new set when you are running low.
Signing in with two-factor on
After your password, MarqIQ asks for the six-digit code.
- Tick Trust this device for 30 days to stop being asked on this browser. The trust lives in a cookie on that browser only, so clearing site data ends it.
- Lost the phone: click Use a recovery code instead, type one of your saved codes and click Verify recovery code.
- Five failed codes in 15 minutes lock the account for the rest of that window. Failed passwords and failed recovery codes are counted separately, each on the same rule.
Take care
Two things about that tick box are not what it says. The trust actually lasts 49 days, not the 30 on the label. And MarqIQ stores one trusted device per person, so ticking it on a second browser ends the trust on the first.
Turn two-factor off
Click Disable 2FA.
Type a current six-digit code from your app.
Click Disable.
Your recovery codes are deleted at the same time. Turning two-factor back on later means generating a fresh set.
Check nobody else has been in here
The Login Activity card lists the last twenty events on your account, newest first, with the browser, the operating system, the IP address and when it happened.
| What you see | What it means |
|---|---|
| Successful login | A password, and a code if two-factor is on, were accepted. |
| Failed login attempt | A wrong password was tried against your address. |
| 2FA verification step | The password was right and MarqIQ asked for the code. |
| Password changed | Your password was replaced. |
| 2FA enabled | Two-factor was turned on. |
| 2FA disabled | Two-factor was turned off. |
| Recovery codes generated | A fresh set of ten codes was issued. |
Note
Three events have no plain-words label yet and appear exactly as MarqIQ stores them. 2fa_failed is a wrong authenticator code. recovery_code_failed is a wrong recovery code. recovery_code_used is a recovery code accepted.
A few failed attempts from a browser and IP address you recognise are usually you. Treat a successful login you cannot place as a break-in: change your password, then raise a case from Support.
Take care
MarqIQ cannot sign you out of another browser. A session is signed for seven days, and changing your password does not end the ones already open elsewhere. If you believe somebody has your password, change it, and raise a case from Support so we can end the sessions for you.
Note
MarqIQ signs you out of the browser you are using after five minutes with no activity. A dialogue headed Still there? warns you a minute before, with Stay signed in and Sign out now.
When MarqIQ staff look at your workspace
Support staff can sign in as one of your people to reproduce a problem. Two things happen when they do. A row is written to your workspace Activity Log, naming the staff member who did it and the person they signed in as. The live chat bubble is hidden for the whole visit, so a message you send always reaches a person rather than a staff session.
Note
That row has no label of its own yet, so the Activity Log renders it as Role updated. Read the Performed by column: a name that is not one of your members is a staff visit.
One MarqIQ staff account can never sign in as another.
If it did not work
Your authenticator code is refused every time
Why: A time-based code is checked against the clock. MarqIQ allows one step either side, which covers a few seconds of drift and nothing more.
Fix: Set your phone to get the date and time from the network, wait for the next code, and try that one.
"Too many failed attempts. Please wait 15 minutes and try again."
Why: Five failures of that kind inside 15 minutes lock the account for the rest of the window.
Fix: Wait the window out. There is no way to clear it early, and a correct code during the window is still refused.
You have lost the phone and have no recovery codes
Why: Recovery codes are the only self-serve route back in, and MarqIQ stores only a hash of each one — nobody here can read them back to you.
Fix: Raise a case from Support from the email address on the account. Include your workspace name.
You were signed out in the middle of reading a report
Why: Five minutes without a mouse move, key press, scroll or click ends the session.
Fix: Sign in again. Click Stay signed in on the Still there? dialogue next time — it appears a minute before the sign-out.
Sign-in says “Confirm your email first”
Why: You signed up but have not clicked the link in the confirmation email. The link works once and expires in 24 hours.
Fix: Open the email and click Confirm my email. If you cannot find it, click Send the link again under the message on the sign-in page.
Sign-in says your password has expired
Why: Passwords last 90 days. The reminder emails at 14, 7 and 1 day were either missed or filtered.
Fix: Sign in once more and MarqIQ emails you a link to set a new password, or use Forgot password? on the sign-in page.
The Generate codes button says two-factor must be enabled first
Why: Recovery codes exist to get past the two-factor step, so there is nothing for them to recover until it is on.
Fix: Turn two-factor on first, then generate the codes from the panel that appears.
Login Activity is empty
Why: Events are recorded from the point the log started, not backdated.
Fix: Sign out and in again. Your next sign-in appears at the top of the list.
Next steps
Related articles
Was this article helpful?