# Turn on two-step authentication for your Office Niaga Mail login

> Add a second step to your Office Niaga Mail login so a stolen password alone cannot open your mailbox, and reset it when a phone is lost.
>
> Source: https://docs.officeniaga.com/two-step-authentication/

Turn on two-step authentication in **Settings** > **Account** so that a stolen password alone is no longer enough to open your mailbox. Passwords are often stolen through [phishing emails](/phishing-emails/), and two-step stops the attacker at the second step.

## Turn it on for your login

1. [Log in to webmail](/log-in/) and click the **Settings** (gear) icon in the top bar.
2. Click **Account** in the left menu.
3. Scroll down to the **Two-Step Authentication** card, which says **Protect your account with two-step authentication!**

   *(Screenshot: Two-Step Authentication, Enable)*

4. Click **Enable** and follow the on-screen steps to finish setting up two-step.

## For domain admins

Your domain allows two-step when **Domain Settings** > **General** > **User Options** shows **Two-Step Authentication** set to **Enabled**.

   *(Screenshot: Domain Settings, General, Two-Step Authentication)*

If a staff member can no longer pass the second step, for example after losing their phone:

1. Click **Domain Settings** in the top bar, then **Accounts**.
2. Open the user's account.
3. Click the **...** button and choose **Reset Two-Step**.
   
4. Ask the user to sign in with their password and set up two-step again.

If a user still cannot sign in, see [Locked out after too many wrong passwords](/locked-out/) or [Change or reset a password](/change-password/). To make them choose a fresh password at their next login, use [Expire Password](/expire-password/).

## Still stuck

WhatsApp our support team at [+60 16-916 3324](https://wa.me/60169163324).

## Common issues

### Why should I turn on two-step authentication?

With two-step turned on, someone who steals your password through a fake login page still cannot sign in without passing the second step.

### I lost the phone I use for two-step. How do I sign in now?

Ask your domain admin to use Reset Two-Step on your account. Then sign in with your password and set up two-step again.

### I do not see the Two-Step Authentication card. Why?

Your domain admin controls whether two-step is allowed for your domain. Ask them to check Domain Settings > General > User Options, or WhatsApp our support team.