Two-factor authentication
TOTP is mandatory for password accounts and enforced at login. Enrol, reset it, and recover a lost device without contacting support.
Two-factor authentication is mandatory for accounts that sign in with a password. There is no workspace setting to switch it off.
Enrolling
An account without an active factor is sent through full-screen enrolment at its next login and challenged for a code every time after that. Scan the QR code with any authenticator app and enter the first code to finish.
The entry your authenticator stores is white-labelled to your workspace's brand, so a phone holding several accounts shows the name your team knows rather than ours.
The secret is encrypted at rest, and each code carries a one-time replay guard — a code that has been used cannot be replayed, even inside its own time window.
Resetting it
Settings → Security shows your status and a Reset that is gated on your password. Resetting starts enrolment again from scratch.
There is deliberately no self-service disable. The only ways out of the mandate are resetting to a new device or, for a Google account, not having a password at all — see below.
Lost your device
On the login screen's code step, choose Lost your device?. A single-use link is emailed to you; opening it re-enrols the account, revokes every session, and is written to the audit log.
Google-only accounts
An account that signs in with Google and has never set a password is exempt: Google is its authenticator. Enrolment is still available in settings if you want it.
Setting a password re-activates the mandate. If you add one, you are enrolled at your next login like any other password account. See Sign-in options and devices.
Where to go next
Last updated