> This page is for Workforce.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.merge.dev/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.merge.dev/_mcp/server.

# Multi-factor authentication

> How MFA works for Workforce dashboard sign-in, why SSO organizations enforce the second factor at the identity provider instead, and what to do when someone loses their authenticator.

MFA adds a TOTP code from an authenticator app to dashboard sign-in. It applies to password sign-in only, so which path you use decides where MFA belongs.

**If you use SSO, enforce MFA at your identity provider.** Your IdP already requires the second factor before SSO completes, and with [Require SSO](/merge-workforce/provisioning/sso#requiring-sso) on, password sign-in is blocked outright. That leaves the IdP as the only factor path, which is where most teams want it: one policy, one enrollment, one place to revoke.

**If your admins still sign in with a password**, MFA is worth requiring. The Workforce console has no MFA panel of its own: enrollment and prompting both happen at sign-in.

## Enrolling

Requiring MFA is an organization-level setting, and it is the same organization behind both consoles. The switch is the **Multi-factor authentication** toggle under **Settings → Organization** in the Agent Handler console, which needs the **Manage users** permission. Once it is on, the next sign-in to either console walks anyone without a second factor through enrollment:

1. Sign in with email and password as usual.
2. A QR code appears. Scan it with an authenticator app: 1Password, Google Authenticator, Authy, Microsoft Authenticator, anything that supports TOTP. If the code will not scan, copy the secret shown below it and enter it by hand.
3. Enter the 6-digit code the app shows to complete setup.

From then on that account is prompted for a code on every sign-in. Members who already had MFA are unaffected.

## Common issues

* **Codes are always rejected.** Check the device clock. TOTP is time-based, and a clock more than about 30 seconds off produces codes that look right and fail
* **The QR code will not scan.** Use the copyable secret under it, which enrolls the same factor
* **Lost authenticator.** Contact support. They verify you own the account before clearing the factor, after which the next sign-in re-enrolls you

MFA activity is recorded in the [Audit trail](/merge-workforce/logs/audit-trail) under its own event types, `MFA_ADMIN_RESET` and `MFA_DEVICE_CHANGED` among them, so there is a record of who cleared whose factor and when. Turning the organization requirement on and off is recorded too, as `MFA_REQUIRED_ENABLED` and `MFA_REQUIRED_DISABLED`.

## Next

Create and rotate the keys your automation uses with [API keys](/merge-workforce/settings/api-keys).