Enforce two-factor authentication

Two-factor authentication (2FA) protects accounts with a time-based code from an authenticator app on top of the password. Anyone can enable it for themselves, and Owners and Admins can make it mandatory for the whole organization.

Set up 2FA for yourself

1. Open Settings and go to the Security tab.

2. In the Two-Factor Authentication section, start the setup and scan the QR code with your authenticator app (Google Authenticator, Authy, 1Password, or any TOTP app).

3. Enter the six-digit code from the app to confirm.

4. Save your backup codes somewhere safe. They are shown once, and each is a single-use replacement for a code if you lose your authenticator.

From then on, sign-in asks for a code from your app after your password.

Enforce 2FA for the whole organization

1. Open Organization Settings and go to the Security & Compliance tab (Owner and Admin only).

2. On the Controls sub-tab, find Enforce 2FA for All Members and switch it on. If some members have not enabled 2FA yet, Onplana warns you and lists them before you confirm.

What happens to members without 2FA

Enforcement takes effect immediately. Members who have not enabled 2FA are blocked from the organization’s content: they can still sign in and reach their personal Settings → Security page to enroll, but every attempt to open organization data shows a clear message that 2FA is required. The Controls panel lists who is currently blocked, and the Access Review sub-tab shows per-member 2FA status at any time.

Note

Enabling enforcement does not set up 2FA for anyone. Each member must scan a QR code in their own Security settings. Announce the change before flipping the switch so nobody is surprised mid-workday.

Organizations using SSO

If your team signs in through single sign-on and your identity provider already performs MFA, those sessions satisfy the requirement by default. The Trust IdP MFA for SSO sessions option below the enforcement toggle controls this; switch it off if you want everyone to enroll an Onplana authenticator code regardless. See Configure single sign-on.

Onplana’s own reminder emails

Separate from anything you enforce, Onplana may email a member who has not enabled 2FA a gentle reminder: up to three sends, a month apart, and the final one says it is the last. This is product-level security hygiene, not your organization’s policy, so it carries no deadline and locks nobody out. Members stop these themselves with the Security suggestions toggle in Settings, Notifications. If you want 2FA to actually be required, that is the enforcement toggle above, and the reminders are no substitute for it.

Best practices

1. Announce enforcement 2 weeks ahead. Don’t surprise the team. A heads-up email + grace period prevents lockouts.
2. Onboarding includes 2FA setup. New hires set up 2FA on day 1. Avoids “I can’t sign in” calls later.
3. Backup codes go in a password manager. Each member’s backup codes belong in their personal password manager. Printed-and-lost is the common case.
4. Document the lost-authenticator path. Admin reset via Access Review + support-fallback for multi-org users. New admins shouldn’t have to discover this under pressure.
5. Trust IdP MFA for SSO orgs. If your IdP enforces MFA, “Trust IdP MFA” avoids double-MFA friction. Otherwise require Onplana TOTP regardless.

Troubleshooting / common pitfalls

• Member can’t sign in after enforcement. Three causes: (a) they haven’t enrolled; (b) authenticator lost; (c) backup codes exhausted. Admin resets via Access Review.
• 2FA code rejected with correct value. Two causes: (a) authenticator’s clock drifted (use NTP sync); (b) old code (codes expire in 30 seconds).
• Enforcement on, but a member still sees data without 2FA. Two causes, both by design: (a) they sign in through SSO and Trust IdP MFA is on (the default), so the IdP’s MFA satisfies the requirement; (b) the request is authenticated with a personal access token or a connected app, which the gate does not apply to. Otherwise the requirement is checked fresh on every request, not cached, so a pre-enforcement session is blocked on its very next request and no Logout All Devices step is needed.
• Trust IdP MFA on, but Onplana still asks for code. SSO claim missing or malformed. Verify IdP sends MFA claim.
• Access Review shows stale data. Refresh; updates on every sign-in cycle.

How this combines with other features

• 2FA + SSO. SSO can enforce MFA; Onplana trusts that or enforces its own. See Configure single sign-on.
• 2FA + Session management. Enforcement blocks a non-enrolled session on its next request, so no sign-out step is needed. See Manage sessions and devices.
• 2FA + Audit log. 2FA enable/disable
  • admin resets write to audit log.
• 2FA + API tokens. Tokens bypass 2FA; they have separate scopes/expiry. See Create API tokens.

Coming from another tool

Tool	Mapping
Google Workspace 2FA	Direct concept
Microsoft 365 MFA	Direct
Okta MFA	Direct
Duo Security	Direct
Authy / Google Authenticator	Standard TOTP

FAQs

A member lost their authenticator. Now what? Backup codes are the first resort. If those are gone too, an Owner or Admin can reset the member’s 2FA from the Access Review sub-tab so they can re-enroll. If the person belongs to several Onplana organizations, the reset must go through support instead.

Does enforcement block API tokens and agents? No. Requests authenticated with personal access tokens are not subject to the 2FA gate; tokens have their own scopes, expiry, and revocation. See Create API tokens.

Can I see who has 2FA before enforcing? Yes. The Access Review sub-tab lists every member with their 2FA status, so you can chase stragglers before turning enforcement on.

Can I enforce hardware keys (FIDO2/WebAuthn)? Not today, TOTP only. Hardware key support on roadmap.

Does 2FA enforcement extend to agents? No, agents authenticate via PATs, not user sessions. Agents not affected by 2FA.

Can I skip 2FA for specific users (executives, etc.)? Not natively, enforcement is org-wide. Don’t skip; defeats the purpose.

Related

• Manage sessions and devices, revoke a device you do not recognize
• Configure single sign-on, IdP MFA delegation
• Create API tokens, token-based auth bypass