Pular para o conteúdo principal

Enabling Two-Factor Authentication

Enhance your organization's security by requiring two-factor authentication (2FA) for all users.

What is 2FA?​

Two-factor authentication requires users to provide two forms of identification:

  1. Something they know: Password
  2. Something they have: Phone with authenticator app

Enabling 2FA for Your Organization​

For Individual Users​

Users can enable 2FA for themselves:

  1. Go to Profile → Security
  2. Click Enable Two-Factor Authentication
  3. Scan QR code with authenticator app:
    • Google Authenticator
    • Microsoft Authenticator
    • 1Password
    • Authy
  4. Enter 6-digit code to verify
  5. Save backup codes securely

For All Users (Organization-Wide)​

Require 2FA for everyone:

  1. Go to Settings → Security
  2. Enable Require 2FA for all users
  3. Set grace period (e.g., 7 days for users to set up)
  4. Click Save

What happens:

  • Existing users prompted to set up 2FA on next login
  • New users must set up 2FA during activation
  • Users without 2FA cannot log in after grace period

Phased Rollout​

Recommended approach to minimize disruption:

Week 1: Administrators

  1. Enable 2FA for admin accounts
  2. Verify no issues
  3. Document the process

Week 2: Managers

  1. Notify managers about upcoming 2FA requirement
  2. Provide setup instructions
  3. Enable 2FA requirement for manager group

Week 3-4: All Users

  1. Announce to all users
  2. Provide training and support
  3. Enable organization-wide 2FA
  4. Set 7-day grace period

Backup Codes​

Users receive 10 single-use backup codes when setting up 2FA.

Users should:

  • Save codes in password manager
  • Print and store securely
  • Use only if they lose access to authenticator app

Administrators can:

  • View if user has generated backup codes
  • Cannot see the actual codes (security)
  • Can reset 2FA if user loses access

Managing 2FA​

Viewing 2FA Status​

See which users have 2FA enabled:

  1. Go to Users
  2. Add 2FA Status column
  3. Filter by "2FA Enabled" or "2FA Disabled"

Resetting User's 2FA​

If a user loses access to their authenticator app:

  1. Verify user identity (call, video, etc.)
  2. Go to Users → Select user
  3. Click Reset 2FA
  4. User must set up 2FA again on next login
Security

Only reset 2FA after verifying identity through alternate channel.

Best Practices​

  1. Phased rollout: Start with admins, then all users
  2. Communication: Announce well in advance
  3. Support: Prepare help desk for questions
  4. Documentation: Provide clear setup instructions
  5. Testing: Test the process before organization-wide rollout

Troubleshooting​

Code doesn't work:

  • Ensure device time is synchronized
  • Use the latest code (expires every 30 seconds)
  • Try backup code

Lost authenticator app:

  • Contact administrator for 2FA reset
  • Use backup code if available
  • Set up new authenticator after reset

User locked out:

  • Administrator can reset 2FA
  • User sets up 2FA again
  • Generate new backup codes

Next Steps​