Sign-out is Bearer-session only: the /api proxy strips Set-Cookie, so Doc/Notes never hold the Office cookie session. Google and GitHub sign-in are parked: no Notes callback exists yet, and the Office callback redirects to Office home only, so a provider button here would strand you on Office. FVAVerify is parked: no FVAVerify endpoint was found in the Office router.
Server notes
Settings
Sign in first to use Settings. Profile, password, sessions and 2FA are org-scoped in Office, so they need a session and an organisation.
Organisation
Profile
Password
Sessions
Sessions shown are Bearer sessions only, because the proxy strips the Office cookie session.
Passcode (local app lock, not a server password)
A 4-digit PIN stored only on this device, hashed with a salt, per signed-in user. It locks Notes on open and after returning to the app. Forgot PIN means sign out and sign in again, then set a new PIN.
Authenticator (2FA)
Office sign-in today does NOT gate on 2FA (the Office twofa helper is reporting-only), so enrolling here does not make sign-in gated. This uses only the audited org twofa endpoints.
Steps: Check status, then Enroll, add the key to your authenticator app, then enter its code and Confirm code. The old verify step is parked: it needs a real challenge token, and sign-in never issues one.
Enter your PIN to continue
Notes are locked with a local passcode. This is not your account password.