Use this page when you administer two-factor authentication (2FA) for other people: requiring it for one user, resetting it when someone loses their phone, and reading what each user's status means. The platform-wide mode is set in Sign-in security, and users manage their own setup on Two-factor authentication.
Open Admin > Profile Management > Users. The 2FA column shows each user's state:
| Status | What it means |
|---|---|
| On | The user has set up 2FA and signs in with a code from their authenticator app. |
| Pending setup | 2FA is required for this user, but they have not set it up yet. They are asked to set it up the next time they sign in. |
| Off | The user has not set up 2FA, and none is required for them. |
Reset 2FA when a user has lost their authenticator and cannot sign in with a code or a recovery code. The reset clears their setup, and they set it up again the next time they sign in.
The dialog explains what the reset does before you confirm, and the confirm button stays off until the reason has text; an empty reason shows "Reason is required".
After a reset:
You cannot reset your own 2FA from here: the action is offered only for other users. Manage your own 2FA from your profile, as described in Two-factor authentication.
A reset does not show you new recovery codes. The user receives a fresh set of 10 when they set 2FA up again.
Recovery codes let a user sign in when their authenticator app is unavailable. Each user gets 10 codes when they set 2FA up, and each code works once. The codes are shown once, to the user, at setup and at each regeneration; nobody can read them later.
On your own account, a Regenerate action sits next to the Two-factor authentication row title. Hover over it to see how many codes you have left, then:
The same action is in your profile: see Two-factor authentication.
| What you want to do | What you need |
|---|---|
| Require or remove 2FA for another user | Require 2FA For Others |
| Reset another user's 2FA | Reset 2FA For Others |
| Turn your own 2FA on or off | Require 2FA For Self, in the 2FA User and 2FA Manager bundles |
| Change the platform-wide mode | Manage Global 2FA, in Sign-in security |
Actions you cannot perform are left out of the menus, and the platform checks the permission again when you act. See Roles and permissions for how roles work and the permission reference for the full list.
Require 2FA appears only while Global 2FA is Optional, and only if your role holds Require 2FA For Others. While the mode is Required, there is nothing to switch on. Check the mode in Sign-in security.
2FA is required for the user, but they have not set it up yet. They are signed out and set it up the next time they sign in.
No. The action is refused with "You cannot require 2FA on your own account". Ask another administrator, or turn on 2FA for yourself from your profile, as described in Two-factor authentication.
It appears only for other users who already have 2FA set up, and only if your role holds Reset 2FA For Others. It is never offered for your own account.
Yes. Every session the user has open ends, and they set 2FA up again at their next sign-in.
No. The reset clears the setup and the recovery codes together. The user receives a fresh set of 10 codes when they set 2FA up again.
They can regenerate new codes from the Recovery codes exhausted dialog with a code from their authenticator app, as described in Two-factor authentication. If they cannot use the app, reset their 2FA instead.
While Global 2FA is Required, personal requirements cannot be removed: "2FA requirement cannot be removed while 2FA is required platform-wide." Set the mode back to Optional first, in Sign-in security.
Yes, if an Email channel is active. The email says an administrator reset their 2FA; they set it up again at their next sign-in. With no active Email channel, no email is sent.
It appears only while Global 2FA is on. With 2FA off platform-wide there is no status to show; the mode is set in Sign-in security.