Multi-Factor Authentication
This screen makes an authenticator-app code a required second step when people sign in, for everyone in your organisation, and shows who has set it up.
Video coming soon: Multi-factor authentication in 2 minutesWhere to find it
Configuration › Security › Multi-Factor AuthApplies across every business unit of your organisation.
Quick set-up
- Open Configuration › Security › Multi-Factor Auth.
- Turn on Require MFA for all users.
- In the confirmation, click Enable.
Done. A message confirms the change and the line under the switch reads 'MFA is currently required for all users'.
Full guide
Require MFA for all users
Fields in this section
| Field | Default | What it changes |
|---|---|---|
| Require MFA for all users | Off | On: every user must set up MFA on their next sign-in. Off: MFA is no longer required, and people who already enrolled keep their enrolment. The switch asks you to confirm ("Enable MFA?" or "Disable MFA?"). |
User MFA Status
A table of Name, Email, MFA Status (Enrolled or Not Enrolled) and Actions. Reset MFA appears on enrolled rows. After you confirm "Reset User MFA?", the person must set MFA up again on their next sign-in. Use it when they lose their phone.
What changes for your team
Each person scans a QR code with an authenticator app and gets backup codes the first time they sign in after you turn it on. After that they enter a code at sign-in. A backup code works if the phone is lost.
When changes take effect
At each person's next sign-in. People already signed in are not interrupted.
What is not on this screen
No search, export or import, and no per-user or per-role switch: it is all users or none. You cannot enrol someone on their behalf.
On mobile
No MFA screen on the phone. Switch it on in the admin portal in a web browser; the phone sign-in then asks for the code too. The Android app is on Google Play. The iPhone app is coming soon to the App Store. Same on iPhone and Android.
Problems and fixes
"Failed to load MFA settings"
Reload the page. If you are not a tenant administrator, the server refuses the request.
"Failed to reset MFA"
Try again; only tenant administrators may reset.