Skip to content
Skip to content
Docs

Require two-factor authentication for your workspace

Require an authenticator app for your team and choose how long existing members have to set it up.

Owners and admins can require two-factor authentication, also called MFA, for the whole team, including themselves. Each person uses their own authenticator app.

This rule applies to team access. Your clients keep using your branded portal's sign-in rules.

Before you start

Set up MFA on your own account and save your backup codes first. Saving a workspace rule needs your current password and an authenticator code or an unused backup code.

Tell your team when the rule will start. Immediately (no grace period) blocks members without MFA from continuing until they set it up. Choose a longer setup period if your team needs time to prepare.

Require MFA for the team

  1. Open Company Settings → Security.
  2. Turn on Require two-factor authentication.
  3. Choose an Enrollment grace period: Immediately (no grace period), 1 day, 2 days, or 7 days. The default is 2 days.
  4. Select Save Changes.
  5. Review who will need to set up or verify MFA.
  6. Enter your current password and authenticator code. To use a backup code, select Use a backup code.
  7. Select Verify and save.

The switch takes effect after the change saves. Discard clears an unsaved change.

What team members see

Existing members without MFA have until the setup deadline to enroll. After that, Sydnee shows Set up two-factor authentication before they can continue. New and returning members set it up before accessing the company.

Members who already use MFA may see Verify your sign-in. They enter their password, select Continue, then use their authenticator or an unused backup code. They select Verify and continue to return to work.

MFA protects a person's Sydnee login across their companies. They only need to set up the authenticator once. While any active workspace requires MFA, they cannot turn it off for their login.

Change or remove the rule

The setup deadline stays fixed while the rule is on. The grace-period field is locked during that time.

To remove the rule, turn off Require two-factor authentication and save. Confirm with your password and an authenticator or backup code. Each member's own MFA stays on.

To choose a new grace period, first save the rule as off. Then choose the new period and save it as on. Tell your team before changing the rule.

Fix a change that did not save

  • Set up two-factor authentication: finish your own MFA setup, then return to Security.
  • Another admin changed these settings: close the dialog and select Discard to load the latest settings. Review them before trying again.
  • A code was not accepted: use the latest authenticator code or another unused backup code.
  • Too many attempts: wait 15 minutes, then try again. If Sydnee says your session has ended, sign out and sign in again.

For lost-device recovery, follow the MFA recovery guide. Keep passwords, setup keys, and codes private.

Next step

Team roles & access

Invite people to your team, choose workspace roles, and give them access to the right client accounts.

Request deletion of your workspace

Ask Sydnee to review deletion of a workspace and its data, or cancel a pending request.

On this page

Before you startRequire MFA for the teamWhat team members seeChange or remove the ruleFix a change that did not saveNext step