Sign-in, MFA and roles
Signing in is protected by a second factor that is required, not offered. This page describes each way in and who can do what afterwards.
The second factor is required
Multi-factor authentication is mandatory for every user, administrators included, with no grace period. The first time you sign in, you are taken straight to setup: scan a QR code with any authenticator app, then type the six-digit code it shows. The QR code is drawn in your own browser, so the secret is never sent to a third-party image service.
Only authenticator apps are supported. Text messages are deliberately not offered, so an account cannot be taken over by moving a phone number, and RemediateDesk never asks for a phone number.
Passkeys
A passkey lets you sign in with a fingerprint, face or device PIN, with no password and no code, and it counts as two factors on its own. Add one under Settings in the Sign-in methods card. For your security, adding one needs a six-digit code emailed to you first. You can hold several and remove any of them.
A passkey lives on the device where it was made. Once you have one, you can choose per browser whether to sign in with it or with a password and code, and the code step also offers "Use a passkey instead".
Microsoft sign-in
If your organisation uses Sign in with Microsoft, Microsoft proves who you are, and the authenticator check still applies afterwards. It does not bypass the second factor. People must already be invited, and the button cannot start a new organisation.
Roles
Staff and Administrator are the two roles. The user-management page lists exactly what only an Administrator may do. Customers and RemediateDesk's own operators sign in through completely separate systems, and a token from one is refused by the other.