Set up two-factor authentication and require it for everyone

Two-factor authentication adds a second step at sign-in: after your password, a 6-digit code from an authenticator app on your phone. Someone who learns a password still can't get in without the phone. Each person turns it on for their own account; an administrator can then make it compulsory for the whole organization.

Before you start

• Install an authenticator app on your phone, such as Google Authenticator or Authy.
• Turning it on for yourself needs no permission: anyone signed in can do it from My Profile.
• Requiring it for everyone needs the Edit permission on Organization Settings; in the default roles only the Administrator has it. You must have two-factor authentication on your own account first, so you can never lock yourself out of your own policy.
• Tell your colleagues before you switch the requirement on: until they set it up, they can sign in but can't work.

Steps

1. Open the account menu in the top bar (your email) and choose My Profile (My Profile). The Two-factor authentication card reads "Adds a second step at sign-in: a 6-digit code from an authenticator app such as Google Authenticator or Authy." with the badge Off.
2. Click Set up two-factor authentication. The card shows a QR code ("Scan with your authenticator app"), a key under "Or enter this key manually" with a copy button, and the box Enter the 6-digit code to confirm.
3. In the authenticator app, add an account and scan the QR code. If you can't scan it, type the key instead, using the settings shown under it. The app now shows an entry named "NirmaanOne" followed by your organization's name in brackets, with a 6-digit code that changes every 30 seconds.
4. Type the code the app shows into Enter the 6-digit code to confirm and click Enable (Cancel stops without turning it on). The window Save your backup codes opens with ten codes: "Each code signs you in once if you lose access to your authenticator app. They are shown only now."
5. Click Copy codes or Download .txt and keep the codes somewhere safe, away from your phone. Tick "I have saved these codes somewhere safe" and click Done. The card's badge reads Enabled, with "Enabled on" and the date, and "Backup codes remaining 10 of 10".
6. The next time you sign in (Sign in), enter your email and password and click Sign in. The page changes to Two-factor authentication: "Enter the 6-digit code from your authenticator app." Type the code into Authentication code and click Verify. Without your phone, click Use a backup code instead, type one into Backup code and click Verify.
7. Administrator: open the account menu, choose Settings, then the Organization tab (Organization). The Security policy card reads "N users, M without two-factor authentication." with the toggle Require two-factor authentication for all users ("Users without it can still sign in but only to set it up; every other page is blocked until they do.").
8. Switch the toggle on. The dialog "Require two-factor for everyone?" says "N user(s) has / have not set it up yet. They will be limited to their profile page until they do." or "Every active user already has two-factor authentication enabled."
9. Click Require two-factor. You see "Two-factor authentication is now required for everyone."

What happens next

• Users without it are limited to My Profile. On every other page they see the red banner "Your organization requires two-factor authentication. Until you set it up, most pages will refuse to load data." with a Set up two-factor authentication link to the card, and pages show "Your organization requires two-factor authentication. Set it up in My Profile to continue." Once they have done steps 1 to 5, everything works again.
• Check who is left. The Security policy line counts active users still without it, and the 2FA column on Users reads On or Off for each person. People invited but not yet joined count as "without" until they accept and set it up.
• New users set it up right after accepting their invitation (see Invite users and get them signed in).
• AI assistants can only connect as a user who has two-factor authentication while the requirement is on. See Turn on AI connectors and connect an assistant.
• To make it optional again, switch the toggle off. The dialog "Stop requiring two-factor?" asks whether to Keep it for users who have it ("Two-factor authentication is optional again.") or Turn it off for everyone ("Two-factor authentication is optional and turned off for everyone."); Cancel leaves the requirement on. See Organization.
• While it is required, nobody can turn their own two-factor off: Disable two-factor on My Profile is greyed out with "Your organization requires two-factor authentication, so it cannot be turned off."
• Someone lost their phone and their backup codes? Reset their two-factor from Users; see Reset a user's two-factor authentication.
• Backup codes: when two or fewer are left the count turns amber. Regenerate backup codes on My Profile (with your password) replaces them all.

If something goes wrong

• "Enable two-factor authentication on your own account before requiring it for everyone." with the link Set up yours in My Profile: do steps 1 to 5 first. See Pages refuse to load data: your organization requires two-factor authentication.
• "That code is not valid. Check your authenticator app and try again.": the code was mistyped or has already changed, or the phone's clock is wrong. Use the current code; set the phone's time to automatic. See Cannot sign in.
• "That code was already used. Wait for the next one and try again.": each code works once; wait for the next. See Cannot sign in.
• "The sign-in step expired. Enter your password again.": more than five minutes passed between the password and the code. Start again. See Cannot sign in.
• A colleague has lost both their phone and their backup codes: there is no button for an administrator to reset their two-factor authentication. See Cannot sign in.
• The Require two-factor authentication for all users toggle is greyed out: you lack the Edit permission on Organization Settings. See No access or no permission.

Related

• My Profile
• Sign in
• Two-factor sign-in
• Organization
• Users
• Connect an app
• Invite users and get them signed in
• User accounts: invitations, status and sign-in