What's covered in this guide?
Who already needs 2FA
Two-factor authentication (2FA), also called multi-factor authentication (MFA), means users enter a 6-digit code from an authenticator app after their password.
2FA is already mandatory for these roles, whether or not you turn on this setting:
Admins
General Managers
Payroll Officers
Partners
This includes custom roles created with the Organisation Admin role type, and copies of these roles. It doesn't apply to these roles if your organisation has single sign-on (SSO) set up.
Who the setting covers
Turning on Enforce Two Factor Authentication extends 2FA to everyone who has at least one role that isn't an Employee role, such as Team Managers.
For custom roles, what counts is the Role Type the role was created with, not its name. Custom roles created with the Employee type are treated as Employee and aren't covered. The type can't be changed after the role is created.
Not affected:
Staff whose roles are all Employee-type (the Employee role, or custom roles created with the Employee type). You can't make employees use 2FA. They can turn it on for themselves from My Profile with Set up authenticator app.
Staff who already have 2FA set up. They won't notice any change.
Note: The setting applies to managers even if your organisation uses single sign-on (SSO).
Turn on Enforce Two Factor Authentication
By default, only Admins can change this setting.
Before you turn it on, let your managers know. Ask them to install an authenticator app, such as Google Authenticator, Microsoft Authenticator or Authy.
To require 2FA for all managers:
Navigate to Settings > General
Click Show Advanced Settings...
Tick Enforce Two Factor Authentication
Click Update Settings
Important: The setting applies to you too. If you don't have 2FA set up yourself, you'll be taken to My Profile to set it up as soon as you save.
To turn it off again, untick Enforce Two Factor Authentication and click Update Settings. Admins, General Managers, Payroll Officers and Partners still need 2FA, because it's mandatory for those roles (unless your organisation has SSO set up).
What your managers will see
The next time an affected manager without 2FA uses Workforce.com on the website, they'll see Two-factor authentication required with the message For security, two-factor authentication is required by your organisation's settings.
Enable two-factor authentication takes them straight to setup.
Not now only closes the message. They'll keep being taken back to My Profile until 2FA is set up.
The mobile app doesn't show this message, so managers who only use the app won't be asked until they next use the website.
For setup steps, logging in with a code and lost phones, see Two-Factor Authentication (2FA).
FAQs
How do I make 2FA mandatory for all my managers?
How do I make 2FA mandatory for all my managers?
Go to Settings > General, click Show Advanced Settings..., tick Enforce Two Factor Authentication and click Update Settings. Every user with a role other than Employee, such as Team Managers, then has to set up an authenticator app before they can use Workforce.com on the website. By default, only Admins can change this setting.
How do I turn off enforced 2FA for my organisation?
How do I turn off enforced 2FA for my organisation?
Go to Settings > General, click Show Advanced Settings..., untick Enforce Two Factor Authentication and click Update Settings. Admins, General Managers, Payroll Officers and Partners still need two-factor authentication (2FA), because it's mandatory for those roles, unless your organisation has single sign-on (SSO) set up.
Can I make my employees use two-factor authentication (2FA or MFA)?
Can I make my employees use two-factor authentication (2FA or MFA)?
No. Enforce Two Factor Authentication only applies to staff with a role other than Employee. You can't make employees use 2FA. Employees can turn it on for themselves from My Profile with Set up authenticator app.
Do Team Managers have to use 2FA?
Do Team Managers have to use 2FA?
Only if an Admin turns on Enforce Two Factor Authentication in Settings > General > Show Advanced Settings.... Without that setting, Team Managers may still be asked to set it up after logging in if they can see sensitive employee data, but they can click Not now and carry on. Admins, General Managers, Payroll Officers and Partners always have to use 2FA, unless your organisation has single sign-on (SSO) set up.
Can I turn off or reset 2FA for one of my managers?
Can I turn off or reset 2FA for one of my managers?
No. Admins can't turn off or reset another person's two-factor authentication (2FA). The person can turn it off themselves in My Profile with Disable two factor authentication, which needs a current code from their authenticator app. If 2FA is required for them, they'll be asked to set it up again.
One of my managers lost their phone. What should they do?
One of my managers lost their phone. What should they do?
They need to contact Workforce.com support to reset their two-factor authentication (2FA). For security, Admins can't reset 2FA for other users. After the reset, they log in again and set up 2FA in My Profile with a new QR code. They'll need an authenticator app, because there's no option to use email instead.
Why is a manager being asked to set up 2FA when I haven't turned the setting on?
Why is a manager being asked to set up 2FA when I haven't turned the setting on?
Either they have a mandatory role (Admin, General Manager, Payroll Officer or Partner, including custom roles with the Organisation Admin role type or copied from those roles), or they can see sensitive employee data. Staff who can see sensitive data are asked after they log in, but they can click Not now and carry on.
Do staff who log in with single sign-on (SSO) need 2FA?
Do staff who log in with single sign-on (SSO) need 2FA?
Admins, General Managers, Payroll Officers and Partners don't, if your organisation has SSO set up. If you turn on Enforce Two Factor Authentication, every manager without 2FA is asked to set it up, including those who log in with SSO.