# Enforcing 2FA on your Astalty account

Source: https://docs.astalty.com.au/guide/settings/security/enforcing-2fa-on-your-astalty-account

> Require two-factor authentication for selected roles, on the web and in the Astalty app, from Security Settings.

## Overview

The Account Owner can require two-factor authentication (2FA) for selected user roles from [Security Settings](https://app.astalty.com.au/settings/security).

![The Security settings page with the Two-Factor Authentication card, where 2FA Self-Management reads Users can disable their own Two-Factor Authentication and 2FA Enforcement reads 2FA is not enforced across your organisation.](https://docs.astalty.com.au/assets/security-settings-1760478200.png)

## Enforcing 2FA

Astalty allows the Account Owner to enforce the use of 2FA on users with specific user roles.

> **You must enable 2FA on your account first before you can enforce it on an organisation level.**
>
> See [Two-Factor Authentication](https://docs.astalty.com.au/guide/users/two-factor-authentication) for individual setup steps.

Open **Actions** and select **Edit 2FA Enforcement**.

![The Security settings page with an arrow pointing to the Edit 2FA Enforcement button on the Two-Factor Authentication card, beside the Edit 2FA Self Management button.](https://docs.astalty.com.au/assets/edit-2fa-enforcement.png)

Turn on **Enforce MFA**. Astalty selects all four available roles when you turn enforcement on.

![The Enforce Two-Factor Authentication drawer with Enforce MFA ticked and highlighted, Target User Roles set to Admin, Manager, Team Member and Support Worker, and a warning that enforcement takes effect immediately.](https://docs.astalty.com.au/assets/2fa-enable-1.png)

Under **Target User Roles**, remove any roles that you do not want to target. **Admin** is always selected and cannot be removed. Then select **Update**.

![The Enforce Two-Factor Authentication drawer with Enforce MFA ticked and an arrow to the highlighted MFA Enforcement Targets, where Target User Roles lists Admin, Manager, Team Member and Support Worker, with the Update button below.](https://docs.astalty.com.au/assets/2fa-enable-2.png)

The requirement applies as soon as the update is saved.

Enforcement is set by role, not for individual users:

- **Admin** is always included and can't be removed from **Target User Roles**.
- Switching **Enforce MFA** on selects all four roles: Admin, Manager, Team Member and Support Worker. Remove the ones you don't want to target.
- Auditors can't be targeted, so enforcement never applies to Auditor accounts.
- To ask one user to set up 2FA without enforcing it, see [Sending 2FA Setup Instructions](#sending-2fa-setup-instructions).

### User View After Enforcement

Targeted users who have not set up 2FA must complete setup before they can use any other part of Astalty. This applies immediately for users who are signed in and the next time other users sign in.

![The Two-Factor Authentication card for a targeted user, with a warning that reads You have not enabled Two-Factor Authentication yet and an Enable Two-Factor Authentication button.](https://docs.astalty.com.au/assets/2fa-enable-3.png)

Enforcement applies to the Astalty app as well as the web. A user in a targeted role without 2FA is signed out when the app next contacts Astalty, with the message *Please enable two-factor authentication by logging in again.* When they sign in again, the app takes them through setup. See [Setting up 2FA on the Mobile App](https://docs.astalty.com.au/guide/settings/security/setting-up-2fa-on-mobile-app#setting-up-2fa).

> **Enabling 2FA Enforcement will require immediate attention**
>
> Tell affected staff before you enable enforcement because they may lose unsaved work. If Support Workers are targeted, the app can sign them out mid-shift and they cannot clock in or out until setup is complete. Enable enforcement outside rostered hours.

## Resetting Two-Factor Authentication (2FA) for a User

If a User is unable to access their account because 2FA is enabled and they no longer have access to their recovery codes, the **Account Owner** can disable 2FA for that User and send setup instructions.

To do this, follow the steps below:

1. Navigate to the **Users** page from the main menu and open the relevant User's profile.
2. Select **Security** from the User's profile menu.
3. Click **Disable Two-Factor Authentication**.\
   A confirmation dialog appears. Tick the confirmation box and select **Disable 2FA** to proceed.

![The Disable Two-Factor Authentication dialog with the I understand that disabling Two-Factor Authentication may reduce the security of this account checkbox highlighted and an arrow pointing to the Disable 2FA button.](https://docs.astalty.com.au/assets/reset-2fa-1.png)

4. Once 2FA has been disabled, click **Send 2FA Setup Instructions**.

![The Security tab of a user's profile, where the Two-Factor Authentication card says the user has not set up Two-Factor Authentication yet, with an arrow pointing to the highlighted Send 2FA Setup Instructions button.](https://docs.astalty.com.au/assets/reset-2fa-2.png)

5. A confirmation message will appear advising that the setup instructions have been sent to the User.

![An Alert dialog confirming that instructions to set up Two-Factor Authentication have been sent to the user at their email address, with a Close button.](https://docs.astalty.com.au/assets/reset-2fa-3.png)

The User can then follow the emailed instructions to set up Two-Factor Authentication again and regain access to their account.

## Sending 2FA Setup Instructions

While a user has not set up 2FA, their **Security** tab shows **Send 2FA Setup Instructions** to the Account Owner. It emails the user a link to [Two Factor Authentication](https://docs.astalty.com.au/guide/users/two-factor-authentication), with the subject **You've been asked to set up Two-Factor Authentication**.

Sending the email does not enforce 2FA. To require setup, [enforce 2FA](#enforcing-2fa) for the user's role.

## Disabling the Ability to Disable 2FA

See [Disabling the Ability to Disable 2FA](https://docs.astalty.com.au/guide/settings/security/disabling-the-ability-to-disable-2fa) to stop other users from turning off 2FA themselves.