Two-step verification (MFA)
Two-step verification asks for a 6-digit code on devices the account has not seen before, so a stolen password alone cannot open CubbyPro. CubbyPro sets the policy for your agency and your provider homes: whether it is required, which methods are allowed (authenticator app, text message, email code), and how many grace sign-ins staff get before it is enforced. Ask support to change it.
- Open Settings › MFA & Devices.
- Press Enable beside Authenticator app, Text message (SMS), or Email code, and confirm your password.
- Finish that method: scan the QR code with your authenticator app (or paste the setup key if you are on the same phone) and enter its code; or enter your mobile number, Send code, and Verify; or press Enable MFA and save the 8 recovery codes.
- Review Trusted devices. Revoke any you do not recognise.
Providers Provider homes follow the same policy as your agency. Providers set it up under My Profile › MFA & Devices, or at sign-in when it is required. Send them the step-by-step article: cubbypro.com/guide/agency/provider/setting-up-two-step-verification-mfa.
“Email must be verified” Text message and authenticator enrolment need a verified email address. The person presses Send verification email in the prompt and clicks the link. If it never arrives, ask CubbyPro support to mark the address verified.
Someone lost their phone Email-code users sign in with a recovery code. For text message or authenticator, ask support to reset the second step on that account; the person then enrols again at next sign-in. Revoke the lost device under MFA & Devices if they can still sign in elsewhere.