Home / Help centre / Workspace settings
Workspace settings
How do I make two-factor authentication mandatory for my workspace?
Open Settings, choose Two-factor auth, tick Require MFA for all users and click Save MFA settings. Everyone then needs a TOTP authenticator app. Anyone without an authenticator app must set one up at their next login. By default, MFA stays optional.
Steps
The method is TOTP, a code from an authenticator app on a phone or computer.
STEPSWhat happens next
Once you save, each person needs an authenticator app. Cyberlop asks anyone without MFA to enroll at their next login. They finish the setup, then carry on as before.
Good to know
Pick a calm moment. Tell people a day ahead so nobody is surprised by the prompt, and make sure each person knows which authenticator app they plan to use. Keep an admin signed in during the first hour in case someone needs help with their phone.
Anyone who signs in through single sign-on is a special case. Your identity provider handles MFA for them, so set the rule there as well. Read how to set up single sign-on for that side.
Local passwords already need 12 or more characters with mixed classes, and failed logins face an escalating lockout. MFA adds a second step on top of both. See the security page for the wider picture.
The My Account page mentions recovery codes in its subtitle. Ask on the contact page if you want to plan around them.
Details on what people experience are in what happens when MFA is enforced.
You can switch the rule off again by clearing the box and saving. Do it only on purpose. A workspace that holds source code and proof of real weaknesses deserves a second factor, so most teams leave the rule on once everyone has settled in. Review it after any change of staff, and again whenever you add a new sign-in route such as single sign-on, because each route can handle the second factor in its own way.
Related questions
- What happens to people without MFA when I make it mandatory?
- How do I set up single sign-on with my identity provider?
- Which identity providers work with Cyberlop single sign-on?
- What does "Require an admin-bound SSO subject" do?
- How do I let new people get accounts automatically through SSO?
Two-factor authentication: require MFA for everyone who signs in
Step-by-step, with annotated screenshots.
Updated · Back to the help centre
Still stuck?
Tell us what you see on screen and an engineer will help you sort it out.