Sign-in

A Nexus Telemetry Fleet user signs in with a username or an email address, and a password. With two-factor authentication on, the sign-in also requires a code from an authenticator app. An organisation can turn on Microsoft sign-in for users with a Microsoft work account.

The account page under Sign-in, with the email address, password and two-factor rows

A user changes their own password, email address and two-factor authentication on the Sign-in page under Account in Settings. An Owner or Admin sets the organisation’s sign-in policy under Authentication in Settings.

Signing in

The sign-in form asks for Username or email and Password. An email address is matched without regard to case. A username is matched exactly as it was created. When accounts share the username or the address, the password decides between them. A username that already exists in the organisation in any letter case is refused when an account is created.

At an organisation’s own address, <slug>.<base domain>, the form shows no organisation field and signs in to that organisation alone. At a bare host, the form searches every organisation for the account. See Organisations.

Failed sign-ins are limited to 20 a minute from one client address, and to 200 a minute across the fleet server. A sign-in that succeeds counts against neither. Past a limit the page reads Too many attempts. Wait a minute and try again.

First sign-in

An administrator generates a user’s first password. The user sets their own password at their first sign-in. A password is at least 12 characters. The dashboard then asks for an email address if the account has none. The address is optional. A user whose role requires two-factor authentication sets it up next. No other page opens until they do.

Email address

An email address is optional on an account. A verified address lets the user reset a forgotten password. See Forgotten password. An Owner or Admin also resets a password. See Users and roles.

  1. On the Sign-in page, press Add, Verify or Change on the Email address row.
  2. Type the address and press Send code.
  3. Type the 6-digit code from the email and press Verify.

The code expires after 10 minutes or 5 wrong attempts. The fleet server sends the email. A fleet server with no email key sends no code. The code is refused and the address stays unverified. See Private deployment.

Forgotten password

A user with a verified email address sets a new password from Trouble signing in? under the sign-in form. The demo has no such link.

  1. Press Trouble signing in?.
  2. Press Continue with Microsoft when the organisation has Microsoft sign-in on. Otherwise type the email address and press Send a code.
  3. Type the 6-digit code from the email, a New password and Confirm new password, and press Set password.

The page answers If that address belongs to an account here, a code is on its way. Valid for ten minutes. whether or not the address belongs to an account. A code goes only to a verified address on an enabled account with a password, in an active organisation. An account limited to Microsoft sign-in only receives no code.

Rule Detail
A code Expires after 10 minutes or 5 wrong entries
Codes for one account At most 1 a minute and 10 a day
An address on accounts in more than one organisation One code per account, up to 5. The code entered decides the account
After the reset Every session of the account ends, and nobody is signed in. The account’s address receives Your password was changed. A second factor is still asked for at the next sign-in
A fleet server with no email key No code is sent. The page reads This server cannot send email. Ask an Owner to reset your password.

Requests are limited by client address. The reset is recorded in the Audit trail.

Two-factor authentication

With two-factor authentication on, a sign-in requires the password and a 6-digit code from an authenticator app. The code changes every 30 seconds. An account with a password can use two-factor authentication. Microsoft provides the second factor for a Microsoft sign-in.

Set-up

  1. On the Sign-in page, press Set up on the Two-factor sign-in row.
  2. Scan the QR code with an authenticator app, or press Copy key and enter the key in the app by hand.
  3. Type the code the app shows and press Confirm.

Set-up gives the user 10 recovery codes. Each is 5 characters, a hyphen and 5 characters, from the letters and the digits 2 to 9. The dashboard shows them once. Copy codes copies them and Download saves them as a file. A recovery code replaces the app’s code for 1 sign-in. Each code works once. New recovery codes on the Sign-in page issues 10 new codes and refuses the old ones. Issuing new codes requires a code from the app.

Turning two-factor authentication on ends the user’s other sessions.

Sign-in with two-factor authentication

After the password, the Second-factor authentication page asks for the code from the app. Having trouble signing in? opens a field for a recovery code instead. Cancel and sign out ends the attempt. After 5 wrong codes within 15 minutes the attempt ends. The user starts again with the password. The 5 are counted against the account as well, so starting again does not allow 5 more.

Turning two-factor authentication off

Turn off on the Sign-in page removes the second factor. Turning it off requires a code from the app. A user cannot turn the second factor off while the organisation requires two-factor authentication for their role.

An Owner removes any user’s second factor from the Users page. An Admin removes the second factor of a user who is not an Owner. When no administrator can sign in, the command line removes the second factor. See Users and roles.

Sign-in policy

An Owner or Admin sets the policy for the organisation under Authentication in Settings.

The Authentication section of Settings, with the sign-in methods and the two-factor policy

Setting Values
Two-factor authentication Not required (the default), Required for owners and administrators, or Required for all accounts
Password All accounts (the default), or Owners only. Under Owners only, only an owner signs in with a password. Every other account signs in with Microsoft. Owners only can be chosen once Microsoft sign-in is on

When the policy requires two-factor authentication for a user’s role, the user sets it up before any other page opens. A user already signed in is taken to the set-up at their next request. An owner keeps password sign-in under Owners only. Turning Microsoft sign-in off sets Password back to All accounts.

Microsoft sign-in

Microsoft sign-in is OpenID Connect against Microsoft Entra ID. Whoever runs the fleet server creates 1 app registration in Entra for it, and sets the registration’s client id, private key and certificate in the fleet server’s environment. See Private deployment. An organisation then turns Microsoft sign-in on for its own users.

  1. Under Authentication in Settings, press Set up on the Microsoft row.
  2. Copy the redirect address and add it to the app registration in Entra.
  3. Type the Directory (tenant) ID from the registration’s overview page.
  4. Press Save and test. The test signs the user in through Microsoft. When it passes, Microsoft sign-in is on for the organisation.

Changing the tenant id turns Microsoft sign-in off. A new test turns it back on.

On the managed service Nexus Telemetry holds the app registration, so the Microsoft row asks for the Directory (tenant) ID only. There is nothing to register in the tenant. Microsoft asks for consent at the first sign-in. An administrator can grant it once for everyone. Turn off on the Microsoft row turns it off.

Signing in with Microsoft

With Microsoft sign-in on, the sign-in page shows Continue with Microsoft. Microsoft sign-in opens the account already connected to that Microsoft account. Otherwise it opens the account in that organisation with the Microsoft account’s email address, when Microsoft confirms that the tenant owns the address’s domain. The address need not be verified. The first Microsoft sign-in connects the Microsoft account to the user and verifies the address.

Outcome Message
No account has that email address No account has the Microsoft account’s email address. An administrator adds it.
The address is on accounts in more than one organisation The Microsoft account matches accounts in more than one organisation. Use the organisation’s sign-in link.
The account is connected to a different Microsoft account The account is connected to a different Microsoft account. An administrator disconnects it.
Any other failure Microsoft sign-in did not complete. The fleet server’s log records the reason

Connected accounts on the Sign-in page names the Microsoft account connected to the user. Disconnect removes it. A user who signs in with Microsoft keeps their password. An Owner or Admin can tick Microsoft sign-in only for a user on the Users page. Microsoft sign-in only requires a verified email address. The fleet server refuses it for the last owner.

← Users and roles Alerts →