What's covered in this guide?

Two-factor authentication (2FA)

Two-factor authentication (2FA) adds a second check when someone logs in. After their password, they enter a one-time code from an authenticator app. Someone who learns their password still can’t get into their account.

You can require 2FA for every user in your organisation with manager-level permissions or higher. That includes team managers and other custom manager roles.

What’s already required

2FA is already mandatory for these roles, whether or not you turn on this setting:

Admins
General Managers
Payroll Officers
Partners

Turning on this setting extends the same rule to everyone else who can see other staff members’ data.

Not affected:

Users who only have the Employee role
Users who log in with Single Sign-On (SSO)

Before you turn it on

Let affected staff know the change is coming. Ask them to install an authenticator app on their phone, such as Google Authenticator, Microsoft Authenticator or Authy. Staff without a smartphone can use a browser-based authenticator, such as the Authenticator extension for Chrome.

Enforce Two-Factor Authentication Across Your Organisation

Admins can require 2FA for managers and admin-level users.

To enable mandatory 2FA:

Go to Settings > General.
Click Show Advanced Settings...
Tick Enforce Two Factor Authentication.
Click Update Settings to save.

Once enabled, all applicable users must configure 2FA before accessing Workforce.

What your staff will see

The next time an affected user logs in without 2FA set up, they’ll see a “Two-factor authentication required” message. It explains that your organisation’s settings require 2FA.

They can click Enable two-factor authentication to set it up straight away. If they choose Not now, they’ll keep being taken to their profile until it’s done.

Users who already have 2FA set up won’t notice any change.

Enable two factor authentication for your personal Workforce account

Log in to your Workforce account.
Navigate to My Profile.
Select Enable Two-Factor Authentication.
Download an authenticator app if you do not already have one installed.
Recommended apps include:
- Google Authenticator
- Microsoft Authenticator
Scan the QR code displayed on screen using your authenticator app.
Enter the 6-digit verification code generated by the app.
Select Enable to complete setup.
You will see a message confirming that you have enabled two-factor authentication, along with the option to disable it in the future if necessary.

Authenticate via an Authenticator App

Each code is only valid for 30 seconds, so make sure the code entered in Workforce.com is the same as the code showing in your app when you click Log in.

You might get an error message saying you entered an invalid code if:

You took longer than 30 seconds to enter the code
Your device’s time setting isn’t synchronized with the time setting on your computer
It may be because the time isn’t correctly synced on your Google Authenticator app.

To set the correct time:

On your Android device, go to the main menu of the Google Authenticator app.
Tap More (three dots) > Settings > Time correction for codes > Sync now.

On the next screen, the app confirms the time has been synced. You should be able to sign in. The sync will only affect the internal time of your Google Authenticator app, and will not change your device’s Date & Time settings.

Authenticate via Email

For authenticating with email, you might get an error message saying you entered an invalid code if:

You took longer than 3 minutes to enter the provided code
Your device’s time setting isn’t synchronized with the time setting on your computer

Each code is only valid for 3 minutes, so make sure the code entered in Workforce.com is the same as the code showing on the received email when you click Log in.

To retrieve a new code, either refresh the page and try again or select "Use an alternative authentication method" and choose email.

FAQs and Troubleshooting

How do I turn off enforced two-factor authentication (2FA) for my organisation?

Go to Settings > General > Show Advanced Settings..., untick Enforce Two Factor Authentication, then click Update Settings. Admins, General Managers, Payroll Officers and Partners will still need 2FA, because it’s mandatory for those roles.

What should a staff member do if they lost their phone and can’t log in with two-factor authentication (2FA)?

They need to contact Workforce.com support to reset their 2FA. For security, organisation admins can’t reset 2FA for other users. After the reset, they’ll be asked to set up 2FA again with a new QR code the next time they log in.

Do employees have to use two-factor authentication (2FA) when my organisation enforces it?

No. Enforcing 2FA only applies to users with manager-level permissions or higher. Users who only have the Employee role can still turn it on for themselves from My Profile.

Do staff who log in with Single Sign-On (SSO) need two-factor authentication (2FA)?

No. Users who log in with SSO don’t need to set up 2FA in Workforce.com, because their login is protected by your company’s SSO provider.

Which roles must use two-factor authentication (2FA) in Workforce.com?

2FA is mandatory for Admins, General Managers, Payroll Officers and Partners, even if your organisation hasn’t turned on Enforce Two Factor Authentication. Turning that setting on also requires 2FA for everyone else with manager-level permissions or higher.

What happens when I turn on Enforce Two Factor Authentication?

The next time an affected user without 2FA logs in, they’ll see a “Two-factor authentication required” message. They’ll keep being taken to their profile until they set up 2FA with an authenticator app. Users who already have 2FA set up won’t notice any change.

Two-Factor Authentication (2FA): Required for GMs, Admins and Payroll Officers

Enforce Two-Factor Authentication (2FA) for your organisation