Use this page when you administer two-factor authentication (2FA) for other people: requiring it for one user, resetting it when someone loses their phone, and reading what each user's status means. The platform-wide mode is set in Sign-in security, and users manage their own setup on Two-factor authentication.
Read a user's 2FA status
Open Admin > Profile Management > Users. The 2FA column shows each user's state:
Status
What it means
On
The user has set up 2FA and signs in with a code from their authenticator app.
Pending setup
2FA is required for this user, but they have not set it up yet. They are asked to set it up the next time they sign in.
Off
The user has not set up 2FA, and none is required for them.
The column appears only while Global 2FA is on. With 2FA off platform-wide there is no status to show.
Sorting the column orders rows On first, then Pending setup, then Off.
Actions for each user sit in the row menu (right-click a row) and on the user's page, where they are revealed when you hover over the Two-factor authentication row. The 2FA column also carries a Reset 2FA button for users who have 2FA set up.
Require 2FA for one user
Right-click the user's row and choose Require 2FA. On the user's page, hover over Two-factor authentication and choose Require 2FA.
The product confirms with "Two-factor authentication is now required for this user".
Require 2FA appears only while Global 2FA is Optional. While the mode is Required, everyone is covered already.
Requiring 2FA signs the user out. They set 2FA up at their next sign-in before they can continue.
The list scrolls back to the user's row and briefly highlights it, so you can see the new status.
To undo the requirement, choose Remove 2FA requirement (or Remove requirement on the user's page). The product confirms with "Two-factor requirement removed".
You cannot require 2FA on your own account. The action is refused with "You cannot require 2FA on your own account"; ask another administrator, or turn on 2FA for yourself from your profile.
You can clear a requirement set on your own account: with Require 2FA for Self, choose Remove 2FA requirement on your own row. You still cannot require 2FA on yourself.
While Global 2FA is Required, a personal requirement cannot be removed: "2FA requirement cannot be removed while 2FA is required platform-wide."
Reset a user's 2FA
Reset 2FA when a user has lost their authenticator and cannot sign in with a code or a recovery code. The reset clears their setup, and they set it up again the next time they sign in.
Open the user and choose Reset 2FA: hover over the Two-factor authentication row, pick it from the row menu, or click the Reset 2FA button in the 2FA column.
In the Reset 2FA dialog, enter a Reason. It is required and can be up to 500 characters.
Click Reset 2FA. The product confirms with "Two-factor authentication has been reset. The user must enroll again."
The dialog explains what the reset does before you confirm, and the confirm button stays off until the reason has text; an empty reason shows "Reason is required".
After a reset:
The user's 2FA setup and recovery codes are cleared.
Every session the user has open ends.
The user must set up 2FA again at their next sign-in while Global 2FA is on.
If an Email channel is active, the user is emailed that an administrator reset their 2FA. If none is active, no email is sent.
You cannot reset your own 2FA from here: the action is offered only for other users. Manage your own 2FA from your profile, as described in Two-factor authentication.
Note
A reset does not show you new recovery codes. The user receives a fresh set of 10 when they set 2FA up again.
Regenerate recovery codes
Recovery codes let a user sign in when their authenticator app is unavailable. Each user gets 10 codes when they set 2FA up, and each code works once. The codes are shown once, to the user, at setup and at each regeneration; nobody can read them later.
On your own account, a Regenerate action sits next to the Two-factor authentication row title. Hover over it to see how many codes you have left, then:
Click Regenerate. The Regenerate recovery codes dialog opens.
Enter the 6-digit code from your authenticator app. The dialog submits when the sixth digit is typed.
Save the new codes when they appear. The product confirms with "New recovery codes generated. Your previous codes no longer work." The previous set stops working at once.
When a user's remaining codes drop to 3, 1 or 0, the platform emails them a warning, if an Email channel is active.
After a user signs in with their last recovery code, the sign-in screen shows them a Recovery codes exhausted dialog that walks through regenerating. If they cannot use their authenticator app either, reset their 2FA instead.
Permissions
What you want to do
What you need
Require or remove 2FA for another user
Require 2FA for Others
Reset another user's 2FA
Reset 2FA for Others
Turn your own 2FA on or off
Require 2FA for Self, in the 2FA User and 2FA Manager bundles
Actions you cannot perform are left out of the menus, and the platform checks the permission again when you act. See Roles and permissions for how roles work and the permission reference for the full list.
Limits and edge cases
Require 2FA and Remove 2FA requirement appear only while Global 2FA is Optional.
Reset 2FA is offered only for users who have 2FA set up.
You cannot require or reset 2FA on your own account.
A reset ends every session for the user, so tell them before you do it.
With no active Email channel, no reset email is sent.
Turning Global 2FA off deletes every user's 2FA data and every recovery code. See Sign-in security before you change the mode.
Questions, answered
Why can't I see Require 2FA?
Require 2FA appears only while Global 2FA is Optional, and only if your role holds Require 2FA for Others. While the mode is Required, there is nothing to switch on. Check the mode in Sign-in security.
What does Pending setup mean?
2FA is required for the user, but they have not set it up yet. They are signed out and set it up the next time they sign in.
Can I require 2FA for my own account?
No. The action is refused with "You cannot require 2FA on your own account". Ask another administrator, or turn on 2FA for yourself from your profile, as described in Two-factor authentication.
Why is Reset 2FA missing for a user?
It appears only for other users who already have 2FA set up, and only if your role holds Reset 2FA for Others. It is never offered for your own account.
Does resetting 2FA sign the user out?
Yes. Every session the user has open ends, and they set 2FA up again at their next sign-in.
Do the user's recovery codes still work after a reset?
No. The reset clears the setup and the recovery codes together. The user receives a fresh set of 10 codes when they set 2FA up again.
The user ran out of recovery codes. What can they do?
They can regenerate new codes from the Recovery codes exhausted dialog with a code from their authenticator app, as described in Two-factor authentication. If they cannot use the app, reset their 2FA instead.
Why can't I remove a 2FA requirement?
While Global 2FA is Required, personal requirements cannot be removed: "2FA requirement cannot be removed while 2FA is required platform-wide." Set the mode back to Optional first, in Sign-in security.
Does the user get an email when I reset their 2FA?
Yes, if an Email channel is active. The email says an administrator reset their 2FA; they set it up again at their next sign-in. With no active Email channel, no email is sent.
Why is the 2FA column missing from the Users list?
It appears only while Global 2FA is on. With 2FA off platform-wide there is no status to show; the mode is set in Sign-in security.