Require two-factor for a workspace
Make every member hold an authenticator app or a passkey before they can open a workspace.
Who can do this: the Owners of the account that holds the workspace. The requirement is available on every plan.
With the requirement on, "Every member needs an authenticator app or a passkey on their login before they can open this workspace." It requires that each member holds a second factor, not that every sign-in asks for one: someone returning through a linked Google or GitHub sign-in is still signed straight in.
Before you start
Add a second factor to your own login first: turn on two-factor authentication or add a passkey. The page refuses to turn the requirement on while you hold none, because it would lock you out of the workspace.
Open Security
Open Settings, choose the Workspace tab, then Security.
Check who it affects
Who this affects lists the members who do not hold a second factor yet. "Turning the requirement on now would close this workspace to them until they add an authenticator app or a passkey."
Turn it on
Turn on Require two-factor for everyone. The confirmation says how many members must still add one.
Confirm
Select Require two-factor. The message reads "Two-factor is now required for everyone in this workspace."
What happens next
- Members who already hold a second factor notice nothing.
- Each member without one gets an email explaining what to do. Until they add one, opening the workspace takes them to their own security settings to set one up. Their login is not locked.
- Only the members who were short a factor when you turned the requirement on are emailed. Anyone who joins later, or removes their last passkey or turns off their authenticator, appears under Who this affects but is not told.
- The change is recorded in the audit log.
The People page shows the requirement under Policy, and its two-factor column shows who holds a second factor.
Who is exempt
A member is exempt when an identity provider that enforces sign-in claims their email domain, even when that provider is configured in another workspace. The exception is an Owner of the account whose workspace configured the provider: an Owner keeps a password way in, so they are not exempt. See Set up single sign-on.
Turn the requirement off
Turn off Require two-factor for everyone, then select Stop requiring two-factor. "Members can open" the workspace "without an authenticator app or a passkey. Members who already added one keep it, and nothing else about signing in changes."
If it doesn't work
- "Turn on an authenticator app or add a passkey for your own login first.": add a second factor to your own login, then try again.
- You are locked out of People: the People page sits behind the requirement too. If it is keeping you out, turn the requirement off on Security first.
- You do not see Security in the menu: you are not an Owner of the account that holds the workspace.