---
key: require-two-factor-authentication
title: Require two-factor authentication for your team
audience: staff
section: administration/team-access
routes: ["/settings/org/security"]
permissions: ["org.settings.write"]
features: ["settings.org.security"]
since: 0.0.1
updated: 0.0.1
status: published
summary: Decide who in your organization must set up two-factor authentication and which verification methods they may use; the change saves as soon as you make it.
keywords: [two-step verification, two factor, 2-step, authenticator app, passkey, text code, sign-in security, require verification, security policy]
related: [set-share-link-expiry-defaults, create-a-role, sign-in-to-nova]
---

In the sidebar, open **Administration**, then choose **Security Policies** under **Team & Access**. The page address is `/settings/org/security`.

## Before you start

- Your admin has to give your role permission to write organization settings; the page is only for people who can change these policies.
- Each choice under **Authentication requirements** saves the moment you make it. There is no save button for this section.
- Tell your team before you turn this on. Anyone covered is asked to set up a second step the next time they sign in.

## Steps

1. Under **Authentication requirements**, open the list under **Who must turn on two-factor authentication?**.
2. Choose **No one** to leave it optional, **Everyone** to require it for the whole organization, or **Specific roles** to require it for some roles only.
3. If you chose **Specific roles**, tick the roles under **Required roles**. At least one role has to be ticked.
4. Once two-factor is required (**Everyone** or **Specific roles**), **Allowed verification methods** appears. Tick the methods people may use: **Passkey**, **Authenticator app**, **Text message**, **Phone call**, **Email** and **Backup code**. While two-factor is required, at least one has to stay on.

## What you see

- A line under the list restates the rule: only the selected roles must enrol, every user must enrol, or two-factor stays optional unless people turn it on themselves.
- **Related controls** links to **Roles & permissions**, **User overrides**, **Access checker** and the **Audit log**, which usually change alongside a security policy.
- The same page holds the **Share-link policy** for customer links; see [[set-share-link-expiry-defaults]].

## If something looks different

- **Specific roles** cannot be chosen: your role cannot read organization roles, the roles could not load, or there are no active roles. Ask your admin, or refresh.
- A switch will not stay off: it is the last allowed method or the last required role. Turn another one on first.
- Saving fails with a message about the two-factor policy: the change was not stored. Try again, and if it keeps failing, ask your admin.

[[route:/settings/org/security|Open Security Policies]]