Require two-factor authentication for every teammate

Workspace admins can make two-factor authentication mandatory rather than hoping everyone opts in. Enforcement comes with a grace period, so nobody gets locked out mid-project the day you flip the switch.

1. 1 Go to Admin → Security and enable “Require two-factor authentication”.
2. 2 Set a grace period — 7 days is the default and works for most teams. Members see a banner and are prompted to enroll at their next sign-in.
3. 3 Teammates enroll with an authenticator app (recommended) or SMS, and each gets ten one-time backup codes to store somewhere safe.
4. 4 Track the “Not yet enrolled” list on the same page. Anyone still unenrolled when the grace period ends is signed out and must complete 2FA setup to get back in.

Guests are excluded by default since they often belong to client organizations — there’s a separate “Also require for guests” toggle if your security policy needs it.