Use case: Your clients' briefs, files and invoices live in your portal, and a stolen password shouldn't be enough to get in. You want every team member to sign in with a code from their phone, and one client in finance asks that their whole company does the same.
Two-factor authentication (2FA) adds a six-digit code from an authenticator app to every sign-in. Each person sets it up on their own account (see How to set up 2FA for your ManyRequests account). This article shows how to make it required for your whole team, for every client, or for the members of one client organization.
Require 2FA for your team or for all your clients
Portal admins and admins can change these settings.
Go to Settings > Portal > Advanced.
Scroll to Two-factor authentication.
Turn on one or both switches:
Require two-factor authentication for team members covers portal admins, admins and team members.
Require two-factor authentication for clients covers every client in your portal.
Click Save.
Both switches are off until you turn them on.
Good to know: the team switch applies to you too. If you haven't set up 2FA yet, you're taken to your Security tab as soon as you save. Set it up first to save a step.
Require 2FA for one client organization
Use this when only some clients need it, for example a client whose security team asks for it.
Go to Users > Clients, open the Organizations tab and click the organization.
Open the Members tab.
In the details panel on the right, turn on Require two-factor authentication. On a smaller screen, click More details to find it.
The change is saved right away and applies to every member of that organization. Portal admins, admins and team members with the Access all clients permission can change it.
When Require two-factor authentication for clients is on in your portal settings, this switch shows as on and can't be changed, because every client is already covered.
What people see when 2FA is required
Anyone covered who hasn't set up 2FA is taken to the Security tab of their profile, with the notice Two-factor authentication is required. Every other page brings them back there until they turn 2FA on. After that, they use the portal as usual and enter a code each time they sign in.
It starts at their next click, even if they are already signed in. Nobody is signed out.
People who already use 2FA don't notice any change.
Clients who bought from your checkout and haven't created a password yet are only asked once they create one.
AI assistants connected by someone who hasn't set up 2FA stop answering until that person sets it up.
API tokens and your Zapier connection keep working.
When you impersonate someone, you aren't asked to set up 2FA for them.
Tip: nobody gets an email when you turn a requirement on. Let your team and clients know a few days before, so they have an authenticator app ready.
See who has set up 2FA
While a requirement is on, a Two-factor column shows On or Not set up for each person:
on Users > Team, when 2FA is required for your team
on Users > Clients, when it is required for all clients or for at least one organization
on an organization's Members tab, when it is required for that organization
Only your team sees this column. Clients don't.
Reset 2FA for someone who lost their phone
If a team member or client lost their phone and their recovery codes, the portal admin can reset their 2FA. They can then sign in with their password and set it up again on their new phone.
Go to Users > Team or Users > Clients and click the three dots on the person's row. You'll find the same option on an organization's Members tab and on a team member's profile.
Click Reset two-factor authentication.
Click Reset to confirm.
The person gets an email saying 2FA was turned off on their account. Until they set it up again, their password alone signs them in. If your portal requires 2FA for them, they're asked to set it up again the next time they use the portal.
Good to know: only the portal admin can reset 2FA, and only for other people. The option only shows for people who have 2FA turned on. If the portal admin loses their own phone and recovery codes, contact ManyRequests support.
Frequently asked questions
Can I give people a few days to set it up?
Not yet. The requirement applies as soon as you save. Tell your team and clients ahead of time and turn it on when they are ready.
Can a client require 2FA for their own organization?
No, only your team can change the organization setting. Any client can still turn 2FA on for their own account at any time.
What happens if I turn a requirement off?
Nobody is asked to set up 2FA anymore. People who already turned it on keep it until they turn it off themselves.