Require two-step verification for your team

As an organization admin you can require two-step verification for everyone in your organization, see who has set it up, and reset it for someone who has lost their phone.

Require it

1. Open Organization Settings.
2. Under Two-step verification, turn on Require two-step verification for everyone in this organization.
3. Pick a date under Members must be set up by. Two weeks ahead is the default; give people enough notice.
4. Choose Save. You may be asked to confirm it’s you first.

Until that date, everyone who hasn’t set it up sees a reminder with the date after they sign in. After it, they are asked to set it up before they can carry on.

Scripts and old tokens

The moment you save, any older sign-in token a member uses for a script or tool stops working. Your integrations keep running. Tell anyone who runs their own scripts before you switch this on.

To stop requiring it, turn the switch off and save. Anyone who already set it up keeps using it.

If your organization works with protected health information, two-step verification is always required, and the switch shows as on and locked.

See who has set it up

Open Organization → Users. The Two-step column shows a green tick for everyone who has set it up, and Off for everyone who hasn’t.

Reset it for someone

Use this when a member has lost their phone and their backup codes.

Check who is asking first

“I’ve lost my phone, please turn it off” is how accounts get taken over. Before you reset, confirm it’s really them by a second channel, such as calling a number you already have for them. Never use contact details given in the request itself.

1. Open Organization → Users.
2. Next to the person, choose Reset two-step verification.
3. Fill in How you confirmed it was them and a Support ticket reference, and type their name to confirm.
4. Choose Reset two-step verification.

They are signed out of every device, their authenticator app, passkeys and backup codes stop working, their personal API keys are revoked, and they set two-step verification up again at their next sign-in. We email them and your other admins. Your organization’s integrations keep running.

You can’t reset it for someone who also belongs to an organization you don’t manage, or, in an organization that works with protected health information, for anyone at all. Our support team does those resets.

Something wrong or unclear on this page? Tell us and we’ll fix it.