Two tabs in your profile, and both are worth doing on your first day.
Security
Your password
Changed here, and it asks for your current one first.
Standard advice applies and is worth restating once: a long unique passphrase beats a short complicated one, and a password manager beats remembering. This account reaches your organisation's customers, finances and people records, which puts it well above the average work login in what it is worth to somebody else.
Multi-factor authentication
Turn this on. It is the single highest-value thing on this screen.
A password alone can be phished, reused or leaked from somewhere unrelated. A second factor means none of those is enough on its own, and setting it up takes about ninety seconds with an authenticator app on your phone.
Your organisation may require it, in which case you will be prompted rather than asked. If it does not require it, turn it on anyway.
Keep your recovery codes somewhere that is not your phone. The failure people actually hit is not an attacker, it is a lost or replaced handset, and recovery codes stored only on the device you lost are not recovery codes.
Connections
This is where you link your own Google or Microsoft account.
Why it is worth doing
It is what makes the calendar real. Once connected, your existing meetings appear on the NearSync grid alongside everything else, and events created here reach your usual calendar. Without it, the calendar is only showing you the half of your life that already lives in this product.
Cloud file pickers for attachments also come from here.
Why it sits second in the tab list
Deliberately. Most people do not have access to the administrative integrations screen, so this is their only route to connecting an account. Putting it directly after Profile means nobody has to be told where it is.
It is per person
Connecting your account connects yours. It does not connect the organisation's, and it does not give anybody else access to your mail or calendar.
Your organisation may separately connect shared mailboxes and channels. That is a different surface with different permissions, and the two do not overlap.
Disconnecting
Available at any time, from the same place. Disconnecting stops the sync; it does not delete anything that already arrived.
Signing in from somewhere new
Two ordinary situations that look alarming and are not.
A new device asks for your second factor. That is the system working. Approve it from your authenticator.
A session ends sooner than expected. Sessions expire, and an expiry is not a sign of anything wrong.
The genuinely unusual case is a prompt you did not trigger. If your phone asks you to approve a sign-in you were not attempting, decline it, change your password, and tell an administrator. Somebody has your password and the second factor is doing exactly the job it was turned on for.
Email signatures
Its own tab, next door. Worth setting once if you send mail from the platform, because the default is nothing and unsigned mail from a business address reads as a mistake.
What a second factor actually protects
Worth being concrete, because "turn on MFA" is advice everybody has heard and few people act on.
The realistic attack is not somebody targeting you. It is a password you reused turning up in an unrelated breach, or a convincing sign-in page in an email. Both hand over a working password without you noticing anything unusual.
A second factor makes both of those insufficient on their own. That is the whole argument, and it is why ninety seconds now is worth more than any other security step available to you here.
What nobody will ever ask you for
Two rules that cover essentially every account-takeover attempt.
Nobody will ask for your password. Not an administrator, not support, not NearSync.
Nobody will ask for a code from your authenticator. A code is single-use and time-limited, and the only reason to want one is to use it in the next thirty seconds on a sign-in you did not start.
If either is asked for, however plausibly, it is an attack. Report it rather than replying.
A first-day checklist
Turn on multi-factor authentication. Ninety seconds.
Store the recovery codes somewhere separate from your phone.
Connect your calendar. One click, and it is what makes half the product useful.
Set your signature if you will be sending email.
Everything else in your profile can wait. These four cannot, and three of them are done in under five minutes.
Recovery, before you need it
The moment to think about recovery is while everything is working.
Store your recovery codes outside your phone. A password manager, or printed somewhere sensible. Codes saved only on the device that provides your second factor are useless the day that device is lost.
Know who your administrator is. Account recovery goes through your own organisation rather than through NearSync, so the useful thing to know in advance is which colleague can help.
Neither takes more than a minute now, and both are the difference between a five-minute problem and a lost morning.
Sharing and access
Two things worth saying plainly, because both come up.
Your login is yours. Sharing it with a colleague, however convenient, means every action they take is recorded as yours, and any audit trail that matters becomes worthless. If somebody needs access, they need an account.
Leaving is an administrator's job. When somebody leaves an organisation, disabling their account is what actually removes access; changing a password does not, and neither does removing them from a team.
If something goes wrong
Locked out with no second factor? An administrator can help. Nobody outside your organisation can, and nobody will ever ask you for a code.
Connection stopped syncing? Disconnect and reconnect before assuming anything is broken. Access tokens expire and a reconnect is the ordinary fix.
Unexpected sign-in? Change your password, turn on multi-factor authentication if it is somehow off, and tell an administrator. In that order.
Did this answer your question?
No, ask a person