Authentication: require two-factor authentication

To require two-factor authentication for every member of a Qualflare workspace, the workspace Owner turns on Require two-factor authentication on the Authentication page; it works on every plan, and you need a second factor on your own account first.

Before you begin

Owner · workspace (requires the Owner role in the workspace)

• Authentication is in the workspace sidebar, under Administration. Only the workspace Owner sees it, on every plan.
• You need a second factor on your own account: Set up an authenticator app or Add a passkey.
• Changing the setting asks Confirm it’s you when you last signed in or confirmed more than 5 minutes ago.

What the requirement does

The Require two-factor authentication switch makes every member of the workspace use a second factor to sign in. An authenticator app or a passkey counts. SMS codes aren't supported. The setting is off for new workspaces.

• Members without a second factor: They must set up an authenticator app the next time they sign in, whether they use a password, Google, GitHub, or SSO. They can add a passkey from their Passkeys page afterwards.
• People you invite: They set up a second factor before they can accept. Until then the invitation says This workspace requires two-factor authentication. Set it up on your account, then come back here and accept.
• The SCIM token: The requirement doesn't apply to the token your identity provider uses for SCIM Provisioning.
• Audit log: Each change is recorded in the workspace Audit Logs.

Turn on the requirement

Turn off the requirement

Turn off Require two-factor authentication and click Stop requiring two-factor authentication in the dialog. Turning it off is always allowed, and nobody is signed out.

Members without a second factor can sign in without one again, unless another workspace they belong to requires it. Members who have set one up are still asked for it. Access tokens revoked when you turned the requirement on don't come back.

Verify

You should see Members without two-factor authentication will be asked to set it up at their next sign-in. The switch stays on when you reload the page.

After you turn it off, you should see Two-factor authentication is no longer required for this workspace.

Troubleshoot

• The switch is disabled and the page says Set up two-factor authentication on your own account first.: click Set it up, add an authenticator app or a passkey, then come back.
• CI pipelines fail after you turned it on: the access tokens that members without a second factor created were revoked. Create new ones once those members have a second factor. See Access tokens.
• Couldn't load the current setting. Reload to try again.: the page couldn't read the workspace's setting. Reload the page.

Next steps

• Two-factor authentication for your account
• Require SSO for the members at your verified domains
• Invite and manage users
• Workspace admin guide