Requiring Two-Factor Authentication

Two-factor authentication (2FA) adds a time-based code from an authenticator app to sign-in. As an admin, you can require it for everyone in your organization. This guide covers the switch, what members see, how to check who has enrolled, and how to reset a member who lost their device.

The switch is never plan-gated. Any admin on any plan can use it, whether or not you have configured single sign-on (SSO). For how a member sets up 2FA on their own account, see Two-Factor Authentication.

Turn the requirement on

1. Go to Settings and open the SSO tab, under Integrations & Security.
2. Find the Require two-factor authentication card.
3. Turn on the switch. Its label changes from Optional to Required for all members.

The change is saved when you flip the switch, and it is recorded in the audit log. To turn it off, flip the switch again. Turning it off is never blocked.

What members see

A member who has not enrolled is sent to a Set up two-factor authentication page. It says that your organization requires two-factor authentication and asks them to enroll an authenticator app to continue. They cannot use the app until they finish. The card says members are guided through setup on their next sign-in.

The setup steps are:

1. Click Set up two-factor authentication.
2. Scan the QR code with an authenticator app such as Google Authenticator, Authy, or 1Password. If scanning does not work, open Can't scan? Enter manually.
3. Enter the 6-digit code and click Verify and enable.
4. Save the recovery codes. Copy codes and Download as .txt are both available. Each code works once.
5. Select I have saved my recovery codes and click Done.

After that, sign-in asks for the 6-digit Authentication code. A member can choose Use a recovery code instead, and Use authenticator app to switch back.

Enforcement applies to page visits in the app. It does not block background API requests.

Members who sign in with SSO

Members who sign in through your identity provider are not asked to enroll or to enter a code by MentorStack. Your identity provider is the trust point for SSO sign-ins. If your policy needs a second factor for these members, set it up in your identity provider. See Single Sign-On.

Check who has enrolled

Below the switch, Two-factor authentication by member lists each active member with their name and email. It shows a count such as 4 of 6 active members have enrolled. Each row shows Enrolled or Not enrolled.

Use this list to find people who still need to enroll, before you turn the requirement on or after.

Reset a member who lost their device

A member cannot turn off their own 2FA while your organization requires it. They see a message to contact an admin. If they also lost their recovery codes, you reset them.

1. In Two-factor authentication by member, click Reset on their row. The button only shows for enrolled members.
2. Under Confirm with your own password, enter your password.
3. Click Reset MFA.

A reset clears the member's authenticator and recovery codes and signs them out everywhere. It is recorded in the audit log. With the requirement on, they enroll again at their next sign-in.