Enabling Two-Factor Authentication

Enhance your organization's security by requiring two-factor authentication (2FA) for all users.

What is 2FA?

Two-factor authentication requires users to provide two forms of identification:

1. Something they know: Password
2. Something they have: Phone with authenticator app

Enabling 2FA for Your Organization

For Individual Users

Users can enable 2FA for themselves:

1. Go to Profile → Security
2. Click Enable Two-Factor Authentication
3. Scan QR code with authenticator app:
   • Google Authenticator
   • Microsoft Authenticator
   • 1Password
   • Authy
4. Enter 6-digit code to verify
5. Save backup codes securely

For All Users (Organization-Wide)

Require 2FA for everyone:

1. Go to Settings → Security
2. Enable Require 2FA for all users
3. Set grace period (e.g., 7 days for users to set up)
4. Click Save

What happens:

• Existing users prompted to set up 2FA on next login
• New users must set up 2FA during activation
• Users without 2FA cannot log in after grace period

Phased Rollout

Recommended approach to minimize disruption:

Week 1: Administrators

1. Enable 2FA for admin accounts
2. Verify no issues
3. Document the process

Week 2: Managers

1. Notify managers about upcoming 2FA requirement
2. Provide setup instructions
3. Enable 2FA requirement for manager group

Week 3-4: All Users

1. Announce to all users
2. Provide training and support
3. Enable organization-wide 2FA
4. Set 7-day grace period

Backup Codes

Users receive 10 single-use backup codes when setting up 2FA.

Users should:

• Save codes in password manager
• Print and store securely
• Use only if they lose access to authenticator app

Administrators can:

• View if user has generated backup codes
• Cannot see the actual codes (security)
• Can reset 2FA if user loses access

Managing 2FA

Viewing 2FA Status

See which users have 2FA enabled:

1. Go to Users
2. Add 2FA Status column
3. Filter by "2FA Enabled" or "2FA Disabled"

Resetting User's 2FA

If a user loses access to their authenticator app:

1. Verify user identity (call, video, etc.)
2. Go to Users → Select user
3. Click Reset 2FA
4. User must set up 2FA again on next login

Security

Only reset 2FA after verifying identity through alternate channel.

Best Practices

1. Phased rollout: Start with admins, then all users
2. Communication: Announce well in advance
3. Support: Prepare help desk for questions
4. Documentation: Provide clear setup instructions
5. Testing: Test the process before organization-wide rollout

Troubleshooting

Code doesn't work:

• Ensure device time is synchronized
• Use the latest code (expires every 30 seconds)
• Try backup code

Lost authenticator app:

• Contact administrator for 2FA reset
• Use backup code if available
• Set up new authenticator after reset

User locked out:

• Administrator can reset 2FA
• User sets up 2FA again
• Generate new backup codes

Next Steps

• Security Concept - Overall security practices
• Authentication - Other auth methods