Skip to navigation
AdministerSettings

Multi-factor authentication

A second factor on password sign-in to the dashboard

MFA adds a TOTP code to password sign-in. It does not apply to SSO sign-in: if you use SSO, enforce MFA at your identity provider and turn on Require SSO.

Require MFA

Turn on Multi-factor authentication under Settings → Organization in the Agent Handler console. The setting is shared by both consoles and needs the Manage users permission.

Enroll

On the next sign-in, anyone without a second factor:

  1. Signs in with email and password.
  2. Scans the QR code with a TOTP app, or enters the secret shown below it.
  3. Enters the 6-digit code.

Common issues

SymptomFix
Codes always rejectedFix the device clock. More than about 30 seconds off fails
Lost authenticatorContact support. They verify ownership, clear the factor, and you re-enroll on next sign-in

The Audit trail records MFA_ADMIN_RESET, MFA_DEVICE_CHANGED, MFA_REQUIRED_ENABLED, and MFA_REQUIRED_DISABLED.