Settings

Multi-factor authentication

A second factor on password sign-in to the dashboard

MFA adds a TOTP code from an authenticator app to dashboard sign-in. It applies to password sign-in only, so which path you use decides where MFA belongs.

If you use SSO, enforce MFA at your identity provider. Your IdP already requires the second factor before SSO completes, and with Require SSO on, password sign-in is blocked outright. That leaves the IdP as the only factor path, which is where most teams want it: one policy, one enrollment, one place to revoke.

If your admins still sign in with a password, MFA is worth requiring. The Workforce console has no MFA panel of its own: enrollment and prompting both happen at sign-in.

Enrolling

Requiring MFA is an organization-level setting, and it is the same organization behind both consoles. The switch is the Multi-factor authentication toggle under Settings → Organization in the Agent Handler console, which needs the Manage users permission. Once it is on, the next sign-in to either console walks anyone without a second factor through enrollment:

  1. Sign in with email and password as usual.
  2. A QR code appears. Scan it with an authenticator app: 1Password, Google Authenticator, Authy, Microsoft Authenticator, anything that supports TOTP. If the code will not scan, copy the secret shown below it and enter it by hand.
  3. Enter the 6-digit code the app shows to complete setup.

From then on that account is prompted for a code on every sign-in. Members who already had MFA are unaffected.

Common issues

  • Codes are always rejected. Check the device clock. TOTP is time-based, and a clock more than about 30 seconds off produces codes that look right and fail
  • The QR code will not scan. Use the copyable secret under it, which enrolls the same factor
  • Lost authenticator. Contact support. They verify you own the account before clearing the factor, after which the next sign-in re-enrolls you

MFA activity is recorded in the Audit trail under its own event types, MFA_ADMIN_RESET and MFA_DEVICE_CHANGED among them, so there is a record of who cleared whose factor and when. Turning the organization requirement on and off is recorded too, as MFA_REQUIRED_ENABLED and MFA_REQUIRED_DISABLED.

Next

Create and rotate the keys your automation uses with API keys.