Forcing 2FA
Requiring a second factor is the goal. Getting there without locking out your users depends on one setting that is easy to overlook.
Where to find it
Architect Panel → Configuration:
- Site Settings — Force Users to have 2FA Configured, and Allow 2FA Setup if Non-compliant
Architect Panel → Security:
- Two-Factor Authentication — who has enrolled
- Blocked User Accounts — where lock-outs surface
The two settings
- Force Users to have 2FA Configured — requires a second factor. Ships off.
- Allow 2FA Setup if Non-compliant — lets a user who has no token set one up. Ships on.
Why the second one is critical
Consider what happens when you force 2FA on a population where some people have not enrolled.
With Allow 2FA Setup if Non-compliant on, they sign in, are required to enrol, do so, and continue. Enrolment happens by itself as people arrive.
With it off, they are required to have a token, they do not have one, and they cannot create one. They are locked out, and the only way back in is for an administrator to intervene for each of them individually.
So: leave it on when you turn forcing on. It ships on, which is correct — the danger is somebody turning it off for the reasonable-sounding reason that self-service enrolment feels less controlled.
When turning it off is defensible
Where enrolment must be supervised — a high-security environment where somebody's identity is verified in person before a token is issued. That is a real requirement, and if you have it, expect the administrative load and plan the sequence: enrol everybody first, then force, then disable self-service.
Doing it in the other order locks out your entire user base at once.
Check enrolment before forcing
Look at how many people actually have a token. Forcing at 95% enrolment is a handful of supported conversations; forcing at 40% is an incident.
Force in stages
Administrators, then power users, then everybody. Each stage tells you what the next will bring, and problems surface at a scale you can handle.
Tell people first
A week's notice, a sentence on what to expect, and a link to instructions. Most of the support volume from a 2FA rollout comes from surprise rather than difficulty.
Watch the first morning
Monday between eight and ten is when you will learn whether it worked. Have somebody available who can help, and know in advance how to reverse the setting if something is badly wrong.
Worked example
An organisation reaches 96% enrolment voluntarily, announces the requirement a week ahead, and turns on forcing on a Tuesday with self-service enrolment left on. The remaining 4% enrol on their next sign-in without contacting anybody. Support handles three calls, all from people who had changed phones.
Recommendations
- Leave self-service enrolment on when you force 2FA.
- Check enrolment figures first — aim above 90%.
- Force in stages, administrators first.
- Announce it, and staff the first morning.