how-to · company Open this in the console

Require an authenticator for a person.

Settings › users. Require 2FA is per person, not a switch for the whole company. They enrol on the next sign-in. This page does not show a QR.

While it is required, that person cannot turn the authenticator off themselves. Reset MFA, on the same row, is <a href="/help/reset-mfa">Reset a lost authenticator</a>. It signs their sessions out.
01

Open Settings › users

The MFA column is off until they have enrolled. Require 2FA is on the row. It applies to that person only. Invite a teammate is how the row got here. Your account, timezone and sessions is where each person sets up their own authenticator after you require it.

Users table with MFA off and a require 2FA button
Alex, company admin, MFA off. Require 2FA is on the row and has not been pressed.
02

Press once to arm it

The label turns into confirm: require 2FA. Press it again to save. Until you do, nothing has changed: the next sign-in is still a password. After you confirm, a password sign-in opens only the enrol screen until they scan a code from their own authenticator app. Google or Microsoft sign-in still asks for that code. This shot stops before the second press.

Users table with the require 2FA button armed, waiting for a second press
Require 2FA is armed. A second press is what saves it. This one was not taken.

The button is two-step. The first press arms it. The second press requires 2FA. This shot stops on the first press. Their own authenticator is set up under Settings, on their machine, and that QR is not published.