# Signing in

> How to sign in to Unifuse with your institution's single sign-on, what happens the first time, and what the sign-in messages mean.

Source: https://docs.unifuse.ai/getting-started/signing-in/

Unifuse signs you in through your institution's identity provider. There are no Unifuse
passwords to create, remember or reset: if you can sign in to your institution's systems, you
can sign in to Unifuse.

## Before you start

- You need a work email address at an institution that uses Unifuse.
- Your institution's administrator must have connected its identity provider to Unifuse (see
  [Single sign-on](/administration/single-sign-on/)).

## Sign in

1. Open your institution's Unifuse address in a browser.
2. In **Work Email**, enter your institutional email address.
3. Select **Continue with SSO**. Unifuse looks up your institution from the email domain and
   sends you to its identity provider.
4. Sign in there as you normally would. You are returned to Unifuse and land on your home page.

The email address you enter must match the account your identity provider signs you in with.
If they differ, sign-in fails and you are asked to try again with the matching address.

## The first time you sign in

Your Unifuse account is created automatically the first time your identity provider confirms
who you are. Your name and email come from the identity provider.

What you can see depends on your role. If your institution maps identity-provider attributes to
Unifuse roles, you get that role straight away. Otherwise you get the institution's default
role, which is **Student** unless an administrator has changed it. The Student role has no access
to the staff workspace, so you will see a page saying your administrator has not given you
access yet. Ask your administrator to assign you a role; you do not need to sign in again
afterwards.

## Sign-in messages

| Message | What it means |
|---|---|
| No single sign-on is configured for this email address. | Either the email domain is not registered with Unifuse, or the institution has not connected an identity provider yet. The same message is shown in both cases. |
| This account has been deactivated. | Your institution has deactivated your Unifuse account. Signing in at the identity provider does not reactivate it; ask your administrator. |
| You were signed out, either after a period of inactivity or by your administrator. | Your session ended. Sign in again. See [Session policy](/administration/session-policy/) for how long sessions last. |
| Sign-in failed. Please try again. | A general failure. If it repeats, your administrator can find the reason in the audit log. |

Every failed sign-in is recorded in your institution's audit log.

## Two-factor authentication

You can add an authenticator app to your account under **Settings → Security → Turn on
two-factor**. Unifuse shows a secret to enter in your app, asks for a six-digit code to confirm,
and then shows a set of backup codes once. Keep them somewhere safe. Turning two-factor off
again requires a current code or a backup code.

:::note
Two-factor authentication at the identity provider is what protects sign-in. The authenticator
you add in Unifuse is recorded on your account but is not currently asked for as a separate
step when you sign in.
:::

## Related

- [Your account](/getting-started/your-account/)
- [Roles and what they can see](/getting-started/roles/)