# Two-Factor Authentication

Source: https://docs.astalty.com.au/guide/two-factor-authentication

> How two-factor authentication works in Astalty, and where to go to set it up or enforce it.

## Overview

Two-Factor Authentication (2FA) adds a second step to signing in to Astalty. As well as your password,
you enter a 6-digit code from an authenticator app. This helps protect your account if someone learns your password.

Astalty's 2FA works like this:

- **Authenticator app.** Astalty uses time-based codes from an authenticator app such as Google
  Authenticator or Microsoft Authenticator. There is no SMS option.
- **Recovery codes.** When you enable 2FA you're shown a set of single-use recovery codes. Store them
  somewhere safe. They let you sign in if you lose your device.
- **Account-wide enforcement.** The Account Owner can require 2FA across the organisation, targeted at
  selected user roles. Admins must be included when enforcement is enabled. Users in those roles are blocked from the rest of Astalty until
  they've set it up.
- **Self-management can be locked down.** Account Owners can stop Users from switching 2FA off on their
  own accounts.

> **Lost your recovery codes?**
>
> If a User can no longer access their account and no longer has their recovery codes, the Account Owner
> can reset 2FA on their behalf. See
> [Enforcing 2FA on your Astalty account](https://docs.astalty.com.au/guide/settings/security/enforcing-2fa-on-your-astalty-account).

## Where to go next

- [Enable 2FA on your own account](https://docs.astalty.com.au/guide/users/two-factor-authentication): turn 2FA on from your own
  profile, scan the QR code and save your recovery codes.
- [Set up 2FA on the mobile app](https://docs.astalty.com.au/guide/settings/security/setting-up-2fa-on-mobile-app): complete 2FA
  setup when you're prompted while signing in to the Astalty app.
- [Enforce 2FA across your account](https://docs.astalty.com.au/guide/settings/security/enforcing-2fa-on-your-astalty-account):
  require 2FA for selected roles, and reset a User's 2FA when they're locked out.
- [Prevent Users disabling their own 2FA](https://docs.astalty.com.au/guide/settings/security/disabling-the-ability-to-disable-2fa):
  stop Users turning 2FA off once it's set up.
- [Troubleshooting 2FA](https://docs.astalty.com.au/guide/troubleshooting-2fa): what to check when codes are being rejected, a
  device has been lost, or the authenticator app shows an unexpected email address.

> **Enable 2FA on your own account first**
>
> You can't enforce 2FA across your organisation until you have 2FA enabled on your own account.