The Settings button, in the header, opens a menu whose last section is Personal settings. What appears there depends on your permissions:
| Entry | Who sees it |
|---|---|
| Account | Everybody |
| Theme | Whoever may update the organisation's theme |
| Security | Whoever may view the audit trails |
| Sessions | Whoever may view their own sessions — every role template for people carries it |
| Delegations, Groups I manage | Everybody. They belong to the chapter People, roles and groups |
A Case Worker sees Account and Sessions, and does not see Theme or Security. That is not a fault: the theme is the organisation's, not yours, and Security is an audit view.
Your account menu, on your photo or initials in the header, has shortcuts to the same place: Account, Language, Appearance — Light or Dark, for you alone — and Sign out.
Account
Settings → Account — profile and preferences. The page is called Profile Settings and has two tabs.
Personal Info
- Profile Photo. Up to 2 MB, images only. Once you choose one, the page says "Image ready. Click Save Changes to upload." — until you press Save changes, the new photo exists only in your browser.
- Account Status, and whether the email is Email Verified.
- First Name and Last Name.
- Email Address. Read-only: "The account's email cannot be changed on this page."
- Phone Number.
- Preferred language. It overrides the organisation's language on every device you sign in on: the screens and the notifications you receive come in it. Not set goes back to the organisation's language. Choosing a language in the account menu saves the same preference.
- Time zone. Every date you see is shown in this zone, on every device. Left unset, the organisation's zone applies, and the field says which; if the organisation has none either, the zone of the browser you are using applies.
Security
- Change Password — current password, new one, confirm, and Update Password.
- Two-step verification. A code from an authenticator app on your phone, asked for after your password. Set up two-step verification takes you through three steps: scan the QR code, enter the code the app shows, and save the recovery codes, which are shown only once. Only then does Turn on two-step verification appear.
The password and two-step verification live here, on the Security tab of Account, and not on the Security entry of the menu, which is something else (see below). If somebody on your team cannot find where to change their password, this is where to send them.
Keep the recovery codes somewhere other than your phone. If you lose it without them, only an administrator can turn verification off for your account.
Theme
Settings → Theme — brand and colors. It only appears to whoever holds the permission Update Tenant Theme, because the theme is the organisation's: the colours, the type and the logos everybody sees it with. Saving changes everybody's screen.
Four tabs, in this order:
| Tab | Sets |
|---|---|
| Colors | Light mode palette and Dark mode palette, separately |
| Brand | The logo for light mode, the logo for dark mode and the browser tab icon |
| Typography | Fonts |
| Layout | Layout options |
Two practical notes:
- Images are at most 2 MB and must be images. The screen rejects anything else before uploading.
- An uploaded image is a preview until you save. It says "Image ready. Click Save Changes to upload." — leaving the page without Save changes keeps the old logo, and the preview you were looking at existed only in your browser.
Set both palettes, not just the one you use. A logo chosen against a white background and never checked against dark mode is the most common way a branded workspace ends up with an invisible logo for the half of the team who work in dark.
There is also Reset to defaults, which discards the customisation entirely and asks for confirmation, because it cannot be undone.
Security
Settings → Security — your account's security events. It only appears to whoever holds the permission View Audit Trails. It is a view of the audit trail: the security events — sign-ins, failed access, sensitive changes — filtered by date range and by user, with four figures at the top. The chapter Audit, notifications and support describes it alongside the Audit center.
It is not where you change your password or turn on two-step verification. See Account, above.
Sessions
Settings → Sessions — active devices. The page is called Active sessions. This is the short screen that is actually a security control, and almost nobody opens it.
Each row is a session: the Device, what it Signed in with — Password or Microsoft —, the IP address, the Last activity, when it Signed in, when it Ends whatever happens, and its Status — Active or Expired. The one you are using is marked This device.
The figures at the top count the Active sessions and break them down by Desktop, Mobile and Tablet.
Two actions:
- Sign out this device, on a row. That device is left without a session.
- Sign out other devices — ends every session except the one you are on.
Below the devices, Agent connections lists the AI agents — Claude, ChatGPT — you allowed to act for you, each with End connection, and the address for agents you give one to connect it. They have their own chapter: Agents — Claude, ChatGPT and others.
When to actually use it
- After losing a device. This is the fastest thing you can do, and faster than asking an administrator.
- After using a shared or borrowed computer, if you are not certain you signed out.
- When a row is a device or a place you do not recognise. End it, then change your password on the Account screen — in that order, because ending it first cuts off the session the other person is using.
"Sign out other devices" costs you nothing. Your current session survives; every other one ends. When in doubt, use it — the worst outcome is signing in again on your phone.
What you should have now
- A photo and a verified email, so colleagues can tell who is who on a case.
- Your language and time zone chosen, or left on the organisation's on purpose.
- Two-step verification on, and the recovery codes kept somewhere other than your phone.
- If you may change the theme: both palettes set, and the logo checked in dark mode.
- Your sessions list opened once, and every device on it recognised.
- Your team told two things: the password is on Account, and Sessions is what you open first if a laptop goes missing.