Choose one of the sign-in methods offered for your account. Your organization may require its company sign-in service and may also require a passkey or an FTE Tree authenticator code. This guide walks through signing in, setting up those extra checks, and recovering access.

Multi-factor authentication (MFA) checks more than one kind of proof that it is you. A passkey can combine your saved key with your device PIN, fingerprint, or face recognition. An authenticator app provides a separate code. FTE Tree may ask for its own code even after you complete the extra checks required by Microsoft, Google, or your company. Each organization sets its standard access requirement, while protected account and administrative changes can still require a recent FTE Tree MFA check.

Sign in

  1. Open the FTE Tree sign-in page. If your organization requires company sign-in, open the organization-specific Company sign-in URL provided by your organization administrator instead.
  2. Enter your account email and choose Send sign-in code, or choose Continue with Microsoft, Continue with Google, or Use a passkey. No FTE Tree password is needed.
  3. Complete MFA if prompted.
  4. Choose an organization when your account belongs to more than one.

Use the method required by the organization. A matching email domain alone does not satisfy a company sign-in requirement.

Continue with Microsoft works with personal and work or school Microsoft accounts. It is available without company sign-in setup, including when creating a new account. Microsoft and Google registration still ask you to review your account details and agree to the required policies. An invitation must be accepted separately before it grants organization access.

Company sign-in uses the connection approved for a specific organization, such as Microsoft Entra or Okta. Enter the organization code supplied by your administrator or open their company sign-in link. The connection becomes available after setup is enabled for your organization and your administrator configures it. Generic Microsoft sign-in remains available, but does not replace a required company connection.

Microsoft, Google, and company sign-in first authenticate you through that provider. Provider MFA remains separate from FTE Tree MFA. FTE Tree may still ask for a passkey or an authenticator code for organization entry or account confirmation. Protected organization administration requires an FTE Tree passkey.

Organization MFA choices

People with the Manage sign-in security permission can choose one of these policies for each organization:

  • MFA optional for standard access adds no FTE Tree MFA check for ordinary entry. Microsoft, Google, or a company sign-in service may still require its own MFA. Protected administrative and account changes still use their separate FTE Tree checks.
  • Require MFA for standard access requires a verified passkey, a current authenticator code, or an unused recovery code before organization entry.

Company sign-in is a separate organization requirement. If company sign-in and FTE Tree MFA are both required, you must complete both. An authenticator app does not replace required company sign-in, and provider MFA does not replace FTE Tree MFA.

Switching organizations can introduce a different company sign-in or FTE Tree MFA requirement, even in the same browser session.

Add and use a passkey

A passkey lets you sign in using your device’s fingerprint, face recognition, or PIN. A compatible security key with PIN or biometric verification also works. Your fingerprint, face scan, or device PIN is checked by your device and is not sent to FTE Tree.

  1. Sign in and open Profile > Two-factor.
  2. Choose Add a passkey and confirm it is you when asked.
  3. Give the passkey a name you recognize, such as Work laptop.
  4. Choose Add a passkey and follow your device’s instructions.
  5. Save any recovery codes shown. Add a backup passkey on another device or security key.

If your account needs a fresh sign-in before first-time setup, follow the sign-out confirmation and sign in again, then return to setup.

At your next sign-in, choose Use a passkey. Passkeys require JavaScript and a supported browser. Canceling your device’s prompt leaves the sign-in unfinished; try again or use another permitted method.

Adding or removing a passkey requires recent verification with an existing passkey when you already have one. Keep a working backup before removing a key. If all your passkeys are lost, follow account recovery rather than removing your remaining protection through another sign-in method.

A passkey does not bypass required company sign-in. Use the company sign-in link whenever your organization requires it.

Sign in with an email code

  1. Enter the email for your account.
  2. Choose Send sign-in code.
  3. Open the email and find the code.
  4. Enter it within 3 minutes.

Email codes are the standard way to sign in without a provider or passkey. They do not replace required company sign-in, MFA, or a passkey check for protected administration. If a code expires or you exhaust its three attempts, request a new one. Never send the code to another person or to Support.

If your normal sign-in method is unavailable

Use Recover account access when an email code does not arrive, you have lost a passkey or authenticator, or you cannot use an external sign-in provider.

Recover a Microsoft, Google, or company password through that provider or your company’s IT administrator. There is no FTE Tree password to reset.

Set up MFA

You can set up one authenticator for your FTE Tree account. Use an authenticator app that generates a short code that changes regularly. Save the recovery codes provided during setup so you have a backup if your authenticator or device is unavailable.

Passkeys with device verification and compatible security keys are supported alongside authenticator apps. Text-message codes and email sign-in codes do not satisfy FTE Tree MFA. Microsoft, Google, or a company sign-in provider may apply its own MFA separately.

Protected FTE Tree administration requires recent verification with a passkey. If you have not added one, FTE Tree asks you to do so before continuing. A password, provider MFA, an email code, an authenticator code, or a recovery code does not replace that passkey check. Ordinary account changes follow the verification requested on their own pages.

  1. Open Profile > Two-factor.
  2. Choose the authenticator setup option.
  3. Follow the setup instructions.
  4. Complete the verification.
  5. Save the recovery codes in a secure location separate from the device.
  6. Select I have saved my recovery codes, then choose Finish setup.

After required setup, FTE Tree returns you to the page you were trying to open or to your usual starting page. Setup started from your profile returns to Two-factor. A confirmation tells you that two-factor authentication is enabled.

FTE Tree displays a generated set of recovery codes only once, and each code can be used once. Save the full set before leaving the page. Generating a new set replaces the existing set, so every code from the earlier set stops working.

Actions that require recent MFA

FTE Tree asks for recent passkey verification when you submit these organization administration changes or open a secure billing handoff:

Action Required MFA timing
Create, update, resend, or cancel an invitation Within the previous 24 hours in the current sign-in
Update or deactivate a membership; change roles, role assignments, saved department coverage, or authority to assign access Within the previous 10 minutes
Change allowed invitation and email recipient domains Within the previous 24 hours in the current session
Create or resume a paid subscription; change its plan, purchased positions, or payment settings; remove a scheduled change; cancel a trial; or open Stripe to manage or cancel a paid subscription Within the previous 24 hours in the current session
Change the organization’s FTE Tree MFA requirement Within the previous 15 minutes
Configure, test, or change company sign-in, including its required sign-in policy Within the previous five minutes

Imports, reports, and ordinary workforce or setup changes use the normal sign-in and permission checks. They do not add one of these administrative MFA prompts. Personal account changes use the separate confirmation checks described in Manage your account.

How long a check lasts

Membership and role changes require verification within the previous 10 minutes. Invitation, email-domain, and billing actions accept a successful MFA check from the previous 24 hours while you remain signed in. Changing the organization’s MFA requirement needs verification within the previous 15 minutes. Company-sign-in setup and policy changes require verification within the previous five minutes.

Your session can still end after one hour of inactivity, when the browser closes, when you sign out, or when FTE Tree ends it for security reasons. The MFA window does not keep you signed in.

Keep working when your session ends

When Session ending soon appears, choose Stay signed in to keep working. You can also save your work before the session ends. Leaving a page open does not keep you signed in.

If Unable to check session appears, keep this page open to preserve unsaved work and choose Try again when the connection is available. Checking… means the check is in progress. A connection problem does not mean your session has ended.

If Session ended appears, keep the original page open. Choose Sign in again to open another tab, sign in with the same account, then return to your original page and choose Continue after signing in. FTE Tree checks your account and access before letting you save. Complete any required account or organization verification in the sign-in tab first.

Your unsaved fields stay in the original page. Closing or refreshing that page can lose them. Recovery does not submit your form: review your work and choose Save when you are ready. If your access has changed, contact your administrator before continuing.

FTE Tree does not offer a trusted-browser option to skip MFA. Existing browser trust does not replace any required check.

Continue a protected action

When a form requires MFA:

  1. Submit the reviewed form.
  2. Complete MFA when prompted.
  3. Return to the form, review your changes, and reattach any files.
  4. Submit the form again, then confirm the expected result.

Completing MFA does not submit your change. FTE Tree checks your current access when you submit the form again. You may need to enter your changes again after verification.

If you are prompted again for every form during the same active session, note the page, action, and approximate time, then contact us without sharing any secret codes.

Recovery codes and lost devices

Use a saved recovery code when your normal authenticator is unavailable. After signing in, replace the lost method and generate a new set of recovery codes.

To replace an authenticator, open Profile > Two-factor and choose Turn off authenticator. Have your replacement app ready. Removing the last authenticator or passkey also removes its recovery codes. Confirm it is you when asked, remove the old authenticator, then set up the replacement and save the new codes. If no working method meets the required verification, finish replacement setup before continuing.

When you generate replacement recovery codes for an existing authenticator, save the new set, select the checkbox, and choose Done to return to Two-factor.

If you lost both the authenticator and recovery codes, follow Recover account access and contact FTE Tree through the public support form. An organization administrator cannot request another person’s password or MFA reset from an organization page. MFA owned by Microsoft, Google, or another company provider must be recovered through that provider.

Security habits

  • Add a passkey and a backup before you urgently need them.
  • Keep recovery codes offline and private.
  • Review account sessions and sign out every other session if you do not recognize one.
  • Keep the account email current and verified.
  • Never share passwords, sign-in codes, authenticator codes, or recovery codes.

Why did my protected form expire?

The return link after verification lasts five minutes. If it expires, open the form again, review your changes, and submit it.

Optional practice: sign in and try a protected action

For exercises that change records, use a separate practice organization and complete the preparation below.

Practice steps and checks
  1. Sign in to Evergreen with your own account.
  2. Follow any required authenticator setup and store your recovery codes privately.
  3. Open a settings action you are allowed to use.
  4. Complete the extra verification if FTE Tree asks.
  5. Return to the form, read it again, and save only the intended change.

The extra check confirms it is still you before a sensitive action. Company-provider verification and FTE Tree verification may both be required.

If the return link expires, reopen the form and review it again. Never share an authenticator or recovery code as proof that you completed the exercise. Sign-in troubleshooting explains recovery options.