# Signing in (https://docs.idra.zone/docs/end-users/sign-in)

Activate your account, sign in, recover a password and approve devices.

## Activate your account

Your administrator creates your account, and IdRa emails you an activation link. Open it, choose a password on **Activate your account**, and you're taken to sign in. If your organization requires security methods, you set them up right after your first sign-in.

## Sign in

Sign in at your organization's IdRa address (for example `https://acme.idra.example/login`).

1. Enter your **Username** (your email address) and select **Next**. **Keep me signed in** is on by default.
2. If your email domain belongs to another identity provider (for example Microsoft Entra ID or Google), IdRa sends you there to sign in instead.
3. Otherwise, enter your **Password** and select **Verify**.
4. If a second factor is required, choose one of your security methods: authenticator app, passkey or security key, email code, backup code, or one of the other methods described in [Security methods](https://docs.idra.zone/docs/end-users/mfa).

If passkeys are enabled, **Sign in with a passkey** on the first screen signs you in without a password.

Some pages and apps ask you to verify again even when you're signed in ("This resource requires additional verification."). Apps can also require a **phishing-resistant** method; only passkeys qualify.

If your password has expired, IdRa asks you to set a new one before continuing.

## Required security methods

When your organization's enrollment policy requires a method you don't have yet, IdRa walks you through each one after sign-in ("Your organization requires … (1 of N)"). Authenticator app, passkey, SMS, voice and security question are set up in place. IdRa Verify, YubiKey, Duo and RSA SecurID are set up from **Settings**.

## Forgot your password

1. On the sign-in page, select **Forgot password?**, enter your **Username** and select **Next**.
2. Choose how to verify: an **Email** link, a code by **Phone (SMS)** or **Phone (voice call)**, or an **IdRa Verify** push. Your administrator decides which methods are offered, and may add a security question.
3. Set a new password.

For privacy, IdRa never says whether an account exists. If you don't receive anything, check the address with your administrator. If the page says self-service reset isn't available, ask your administrator to reset your password.

Locked out after too many attempts? Recovering your password also unlocks your account. Suspended or deactivated accounts can't be recovered by yourself.

## Approve a device or app

Command-line tools and devices without a browser (for example the [`idra` CLI](https://docs.idra.zone/docs/cli)) show a URL and a code. Open `/device`, enter the **Activation code**, check the email shown, then choose **Approve** or **Deny**. You may be asked to verify again first.

When an app asks for permission ("*App* would like to:"), review what it asks for (sign you in, view your profile, email address, group memberships, stay signed in) and choose **Allow access** or **Don't allow**.

## "I don't recognize this"

Security emails (new sign-in, password changed, security method added or reset) include an "I don't recognize this" link. It opens **Report suspicious activity**; select **Report this activity** to alert your administrators. Your account's risk is raised so your organization's policies can respond, and you should then review **Settings → Sessions & devices** and change your password.