Nova Require two-factor authentication for your team
Decide who in your organization must set up two-factor authentication and which verification methods they may use; the change saves as soon as you make it.
In the sidebar, open Administration, then choose Security Policies under Team & Access. The page address is /settings/org/security.
Before you start
- Your admin has to give your role permission to write organization settings; the page is only for people who can change these policies.
- Each choice under Authentication requirements saves the moment you make it. There is no save button for this section.
- Tell your team before you turn this on. Anyone covered is asked to set up a second step the next time they sign in.
Steps
- Under Authentication requirements, open the list under Who must turn on two-factor authentication?.
- Choose No one to leave it optional, Everyone to require it for the whole organization, or Specific roles to require it for some roles only.
- If you chose Specific roles, tick the roles under Required roles. At least one role has to be ticked.
- Once two-factor is required (Everyone or Specific roles), Allowed verification methods appears. Tick the methods people may use: Passkey, Authenticator app, Text message, Phone call, Email and Backup code. While two-factor is required, at least one has to stay on.
What you see
- A line under the list restates the rule: only the selected roles must enrol, every user must enrol, or two-factor stays optional unless people turn it on themselves.
- Related controls links to Roles & permissions, User overrides, Access checker and the Audit log, which usually change alongside a security policy.
- The same page holds the Share-link policy for customer links; see Set how long customer links stay open.
If something looks different
- Specific roles cannot be chosen: your role cannot read organization roles, the roles could not load, or there are no active roles. Ask your admin, or refresh.
- A switch will not stay off: it is the last allowed method or the last required role. Turn another one on first.
- Saving fails with a message about the two-factor policy: the change was not stored. Try again, and if it keeps failing, ask your admin.