Enabling 2FA

Two-factor authentication asks for something beyond the password. It is the single most effective control available against stolen credentials.

Where to find it

Architect Panel → Configuration:

• Site Settings — Enable 2-factor Authentication, and the settings below it

Architect Panel → Security:

• Two-Factor Authentication — registered authenticator tokens
• Passkeys — the stronger alternative

What it protects against

A password that has been guessed, phished, reused from a breached site, or read off a note. In every one of those cases the attacker has the password and still cannot sign in.

Given that password reuse is near-universal, this is the control that turns somebody else's breach into a non-event for you.

What it does not protect against

A convincing fake sign-in page can ask for the code as readily as the password, and a user who types one will type the other. Two-factor authentication raises the cost of phishing considerably; it does not eliminate it.

Passkeys do, because the credential is bound to the real site and is simply not offered to a replica. Where you can use passkeys — particularly for administrators — they are the better control. Two-factor remains the right answer for everybody else and for anywhere passkeys are impractical.

Enabling it

Enable 2-factor Authentication makes it available. On its own it does not compel anybody — users can enrol, and those who do get the protection.

This is the right first step. Turn it on, ask people to enrol, and see who does before considering whether to require it.

Start with administrators

They are the accounts worth attacking, they are few enough to support individually, and they are the group most able to tell you if something is awkward.

Explain why, briefly

Enrolment rates depend almost entirely on whether people understand the point. "Your password may already be in a breach somewhere; this means that does not matter" gets more enrolments than a policy announcement.

Have a recovery path before you need one

People lose phones. Decide who can reset a second factor, how they verify the person asking, and what gets recorded — before anybody is locked out, not during.

Make that verification at least as rigorous as the factor it bypasses. An attacker who cannot phish a code will telephone your service desk instead, and a weak reset process quietly undoes the whole control.

Worked example

An organisation enables 2FA and asks administrators to enrol within a fortnight. All twelve do. It is then opened to all staff with a short explanation, reaching about 70% in a month. Only then does the organisation consider requiring it — with a clear picture of who is left and why.

Recommendations

• Enable it before forcing it.
• Administrators first.
• Prefer passkeys where practical, especially for administrators.
• Design and test recovery first.