Your organization has its own sign-in page, at login. followed by your domain. This page decides what that sign-in page offers: which ways in, which accounts people can bring with them, and how hard it checks that people are who they say they are.
Open Settings, then Security, and choose Identity & Sign-In. You need the Manage Sign-In Methods permission. Administrators have it already.
Sign-In Methods
The page is laid out in cards on the left and a Live Preview of your sign-in page on the right. Nothing changes for anyone until you press Save Changes at the bottom. Until then the bar there reads "You have changes that aren't saved yet", and Discard Changes puts everything back.
You can never turn off every way in. When only one of Password, Passkeys, Email Codes or KamoMobile Approval is left on, its switch stays on and says "Keep at least one way to sign in turned on."
Passwords
- What it does: people type their email address, then their password.
- On: the sign-in page asks for a password after the email address.
- Off: no password box appears. People use a passkey, an emailed code or KamoMobile instead.
- Example: a team that has moved to passkeys turns passwords off, so there is no password left for anyone to steal or guess.
Passkeys
- What it does: lets people sign in with their fingerprint, face or device PIN instead of a password. The passkey lives on their own phone or computer.
- On: people can add a passkey and sign in with it.
- Off: the passkey button disappears from the sign-in page.
- Example: a loan officer on a new laptop signs in by touching the fingerprint reader.
Email Codes
- What it does: emails a six-digit, one-time code to the person's address. Typing it in signs them in.
- On: the sign-in page offers to email a code instead of asking for a password.
- Off: no code is offered.
- Example: a customer who signs in twice a year uses a code rather than trying to remember a password.
KamoMobile Approval
- What it does: people approve the sign-in on their phone in the KamoMobile app, by tapping the number the computer screen shows.
- On: anyone with KamoMobile on their phone can approve a sign-in there.
- Off: the option is hidden.
- Example: a manager at a shared front-desk computer signs in by approving it on their phone.
Sign In With Other Accounts
Let people sign in with an account they already have, such as Google, Microsoft, Apple, LinkedIn, Facebook or GitHub. You choose separately for three groups:
- Members: people who belong to your organization but are not staff.
- Team Members: your staff. This starts switched off, so staff keep signing in the way you control until you decide otherwise.
- Customers: people who sign in on your customer pages, such as a loan application or a patient portal.
Press an account to tick it for that group; press again to untick it. A ticked account shows as a "Continue with …" button on your sign-in page for that group.
An account that is greyed out, with the note "Your platform administrator hasn't turned this on yet", is not available on the platform yet. You can still leave it ticked: your choice is kept and starts working the moment it is turned on.
Connecting an outside account never skips the proof that the account is really yours: the first time someone uses Google to reach an existing account, they still prove it with their password and second step, or a code sent to their email.
Two-Step Verification
A second check after the first one, such as a code from an authenticator app. It stops someone who has learned a password from getting in.
- Off: each person decides for themselves.
- Administrators: required for anyone who can change settings.
- Everyone: required for every person who signs in.
- Example: choose Administrators so the people who can change your organization are always protected.
Trust The Other Account’s Two-Step Check
- What it does: when someone signs in with an outside account (for example your company's Microsoft account) that already made them pass a second step, Kamo accepts it and doesn't ask twice.
- On: no second Kamo check after a trusted account's own.
- Off: Kamo asks for its own second step anyway.
- Turn it on only when you trust how that outside account is protected.
Remember Trusted Devices
After someone passes the second step, Kamo can remember that device for a number of days so they aren't asked every time on their own computer.
- Ask Every Time: the second step is asked at every sign-in.
- 7, 14, 30, 60 or 90 Days: the device is remembered that long.
- Example: 30 days means a desk computer asks about once a month.
Continue As
- What it does: when someone is still signed in on your sign-in page and opens a new tab, they see one button, "Continue as" and their name, instead of signing in again.
- On: fewer repeated sign-ins.
- Off (the default): they sign in each time.
- The session still ends when your organization's sign-in time limit says so.
The Live Preview
The preview is a picture of your own sign-in page, in your colours and with your logo, over your organization's background. Use Members, Team and Customers above it to see the page as each group sees it, or press Preview on a group's card.
It changes as you flip the switches, before anything is saved, and the line under it says whether a second step follows. Accounts the platform hasn't turned on yet never appear in it, because they wouldn't appear on the real page either.