2-Factor Authentication

Two-factor authentication (2FA) adds a second verification step beyond the password. Even if a password is phished, the attacker cannot complete the second factor — which is why 2FA blocks the majority of account-takeover attempts.

Supported Second Factors

• Authenticator app (TOTP): Google Authenticator, Microsoft Authenticator, Authy, 1Password, Bitwarden — anything that supports RFC 6238.
• SMS code: 6-digit code texted to the user's mobile.
• Email code: Code emailed (least secure, useful only as fallback).
• Passkey / WebAuthn: Cryptographic factor using device biometrics or hardware keys (FIDO2).
• Recovery codes: One-time backup codes generated at enrolment.

Enabling Globally

1. Open Site Settings → Security → Two-Factor Authentication.
2. Tick which second-factor methods are allowed.
3. Decide whether 2FA is optional, encouraged with a banner, or enforced for all users.
4. Set the prompt frequency — every sign-in, every 30 days, or whenever the device fingerprint changes.

Worked Examples

• SaaS roll-out: Phase 1 — enable optional; Phase 2 — enforce for admins; Phase 3 — enforce for everyone.
• Healthcare: Mandatory 2FA for clinicians, prompt every sign-in (no remember-device).
• Marketplace: Optional 2FA for buyers, mandatory for sellers handling payouts.
• Internal app: Mandatory passkey for admin group, optional TOTP for everyone else.

If 2FA is optional, only the security-conscious enable it. To get the protection at population scale, you have to enforce. ActiveManage lets you enforce gradually with sensible grace periods so you don't lock out half the user base on rollout day.

Enforcement Levels

• Off: Users can enable 2FA but aren't reminded.
• Encouraged: Banner prompts users to enable; they can dismiss.
• Required after grace: Banner with countdown; after the grace period the user must enrol before reaching any protected page.
• Required immediately: No grace; next sign-in must enrol.

Setting It Up

1. Open Site Settings → Security → Two-Factor Authentication.
2. Pick the enforcement level — “Required after grace” is the recommended rollout pattern.
3. Set the grace period (typically 7–14 days).
4. Decide whether to apply enforcement globally or by security group (so admins are forced first, customers later).
5. Save. The platform schedules enforcement and starts showing banners.

Worked Rollout

• Week 1: Enforce for the Admin group only. They've already mostly enrolled — issues surface immediately and are easy to fix.
• Week 2: Add Staff group. Help-desk volume rises briefly as users hit the banner.
• Week 4: Add External-customer group with 14-day grace. Email campaign two weeks before to warn users.
• Week 6: Audit — anyone still without 2FA gets a tighter grace or is manually blocked until enrolled.

Note: Always have a break-glass admin account exempt from enforcement. Document it and store its credentials in your team's password manager.

SMS 2FA texts a one-time code to the user's mobile. It's universally supported (no app install required), but it's the weakest 2FA method due to SIM-swap attacks. Use it as a fallback rather than a default.

Settings to Configure

• Code length: 6 digits is standard.
• Code lifetime: 5–10 minutes recommended. Shorter is safer, longer is more user-friendly.
• Maximum attempts per code: 3 wrong tries before the code is invalidated.
• Resend cooldown: Prevent attackers triggering hundreds of SMS to drive up the user's bill.
• Block VoIP numbers: Reject codes sent to known VoIP ranges (Twilio, Google Voice) — these are easier to spoof.

Worked Configurations

• Consumer app: 6 digits, 10-min lifetime, 3 attempts, 60s resend cooldown, VoIP allowed.
• Financial app: 6 digits, 5-min lifetime, 3 attempts, 120s cooldown, VoIP blocked.
• Internal staff: SMS available as backup only — TOTP is the primary; SMS unavailable on first 2FA prompt to avoid drift to the weaker option.

SIM-Swap Mitigations

SMS 2FA can be defeated by an attacker who convinces the user's carrier to port their number. Mitigations:

• Make SMS the second-preference method, not the only one.
• Require re-enrolment if the carrier reports a recent SIM change (some gateways expose this).
• Alert the user by email when the registered SMS number changes.

Tip: SMS 2FA is great for a customer signup flow because it's familiar. Steer users toward TOTP or passkeys once they're set up.

TOTP (Time-based One-Time Password, RFC 6238) is the second-factor codes generated by an authenticator app like Google Authenticator, Microsoft Authenticator, Authy or any password manager. It's the recommended 2FA method for most users — strong, free, and works offline.

How TOTP Works

The server generates a shared secret at enrolment and displays it as a QR code. The user's authenticator app reads the QR, stores the secret, and from that moment generates a new 6-digit code every 30 seconds based on the secret + current time. The server can compute the same code and verify.

Enrolment Steps

1. The user goes to My Account → Security → Two-factor authentication.
2. Click Set up authenticator app.
3. Scan the displayed QR with their authenticator. Alternatively type the manual key into the app.
4. Enter the current 6-digit code shown by the app to confirm the secret was received correctly.
5. The platform issues 10 recovery codes — the user should save these somewhere safe.
6. TOTP is now active.

What Users Need to Know

• The code is valid for the 30-second window in which it was shown. The server accepts a small skew (typically ±1 step) to handle clock drift.
• If the user's phone is lost, recovery codes get them back in once each. After using all of them they should re-enrol.
• Several authenticator apps (Authy, 1Password) sync the secret across devices, which is more user-friendly but slightly less secure than per-device secrets.

Worked Examples

• New staff onboarding: Day 1 includes TOTP enrolment with the corporate Microsoft Authenticator. Recovery codes are stored in the team password manager.
• Customer self-enrol: A “Set up 2FA” banner appears after the user's first successful sign-in. Step-by-step screenshots in the help guide.
• Lost phone: User uses a recovery code; the system disables TOTP, prompts them to re-enrol with a new device.