Multi-factor authentication (MFA) helps keep staff accounts secure and reduces the risk of unauthorized access. You can add a required verification method for each role so that everyone logs in safely and consistently.
Required verification methods are available for both single site and organization-level roles. Organization-level roles can also assign required verification methods to roles in their individual sites.
Assigning Required Verification Methods for a Role
To assign a required verification method when creating a new staff role:
Head to your Settings
Go to Staff, then select Manage roles and permissions
Add a new role by giving it a title
Select the required verification methods for this role
You can choose to assign Single Sign-On (SSO) if this has been enabled on your account, and Password + Multi-factor authentication (MFA)
You can choose one or both verification methods
Check the permissions you want to give this role to customize their access
Assigning or Editing Verification Methods for Existing Staff
You can also assign or change the required verification method for individual staff members after a role has been created.
Click on the Home icon in your sidebar
Go to Staff, then Manage roles and permissions and click the Roles tab
Find the staff member whose required verification method you want to add or update
Click on the pencil icon to edit their information
Choose or update the verification method for this staff member in the Required verification methods section
Save your changes
This allows you to make sure everyone is using the appropriate verification method without needing to create a new role.
Checking Which Verification Method Staff Use
You can see which required verification method is assigned to each staff member by:
Going to the Home icon in your sidebar
Clicking Staff, then going to Manage roles and permissions and clicking the Roles tab
Checking the Required login methods column to see which method each staff member uses
You can also edit their required login method from this column by clicking anywhere on the row.
Organization-level centers also show this information, and you can assign required verification methods to organization members and to staff in individual sites.
What Happens Once a Verification Method Is Enabled
If you have enabled SSO or MFA for a role, staff will follow a quick setup process next time they log in.
For Existing Staff
They click Continue with SSO if SSO is enabled
If MFA is required, they will be prompted to scan a QR code on their smartphone
They enter the 6-digit code shown in their authenticator app
They click Activate multi-factor authentication to confirm
Recovery codes will appear and should be printed, copied or downloaded for safekeeping. These can be used if the staff member cannot log in with MFA in the future
For New Staff Creating an Account
If you add a new role with a required verification method, new staff will complete the setup when creating their account.
After clicking their invitation link, they create and confirm a password
They create a 4-digit pin
They will then see a QR code and must scan it with their smartphone
They enter the code that appears in their authenticator app and click Activate multi-factor authentication
Recovery codes will appear and should be printed, copied or downloaded so they can be used if the staff member cannot log in with MFA later