Multi-factor authentication (MFA) helps keep staff accounts secure and reduces the risk of unauthorised access. You can add a required verification method for each role so that everyone logs in safely and consistently.
Required verification methods are available for both single-site and organisation-level roles. Organisation-level roles can also assign required verification methods to roles in their individual sites.
Assigning Required Verification Methods for a Role
To assign a required verification method to your roles:
Click on the Home icon in your sidebar
Go to Staff, then Manage roles and permissions and click the Roles tab
Find the role you want to add or update the required verification method for
Click anywhere on the row to add or edit a role's Required verification methods
Choose or update the verification method for this role in the Required verification methods section
Save your changes
This allows you to make sure everyone is using the appropriate verification method without needing to create a new role.
Checking Which Verification Method Staff Use
You can see which required verification method is assigned to each staff member by:
Going to the Home icon in your sidebar
Clicking Staff, then going to Manage roles and permissions
From here, you can check the 2FA column to see if staff members have this enabled
By clicking the Roles tab, you can check the Required login methods column to see which method each staff member uses, and you can also edit their required login method from this column by clicking anywhere on the row.
💡 Organisation-level settings also show this information, and you can assign required verification methods to organisation members and to staff in individual sites
What Happens Once a Verification Method Is Enabled
If you have enabled SSO or MFA for a role, staff will follow a quick setup process next time they log in.
For Existing Staff
They click Continue with SSO if SSO is enabled
If MFA is required, they will be prompted to scan a QR code on their smartphone
They enter the 6-digit code shown in their authenticator app
They click Activate multi-factor authentication to confirm
Recovery codes will appear and should be printed, copied or downloaded for safekeeping. These can be used if the staff member cannot log in with MFA in the future
💡 If SSO is enabled but staff have previously been able to log in with passwords, it will take 30 days before their accounts are no longer displayed on the login page carousels
For New Staff Creating an Account
If you add a new role with a required verification method, new staff will complete the setup when creating their account.
After clicking their invitation link, they create and confirm a password
They create a 4-digit pin
They will then see a QR code and must scan it with their smartphone
They enter the code that appears in their authenticator app and click Activate multi-factor authentication
Recovery codes will appear and should be printed, copied or downloaded so they can be used if the staff member cannot log in with MFA later