> ## Documentation Index
> Fetch the complete documentation index at: https://docs.get2dial.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Turn on multi-factor authentication

> Enroll in multi-factor authentication and, as an administrator, require it for your whole workspace.

Add a second verification step to your sign-in, and optionally require it for everyone in your
workspace.

## Before you start

* You need an authenticator app that supports TOTP (for example Google Authenticator or Authy).
  If your workspace has Duo configured, you can use Duo Push instead — no app needed for that
  path.
* Requiring MFA workspace-wide needs an **admin** role.

## Enroll your own account

<Steps>
  <Step title="Open your settings">
    Select your name, then **Settings**, then **Password & security**.
  </Step>

  <Step title="Start enrollment">
    Select **Set up two-factor authentication**.
  </Step>

  <Step title="Scan the code">
    Scan the QR code with your authenticator app, or enter the secret manually.
  </Step>

  <Step title="Confirm with a code">
    Enter the 6-digit code your app shows, then select **Confirm**.
  </Step>

  <Step title="Save your recovery codes">
    Get2Dial shows ten one-time recovery codes. Store them somewhere safe — this is the only
    time they're shown.
  </Step>
</Steps>

<Warning>
  Recovery codes are shown exactly once, at enrollment. If you lose both your authenticator app
  and your recovery codes, only an administrator can get you back in — see below.
</Warning>

## Require MFA for your workspace

<Steps>
  <Step title="Go to Settings">
    Select your name, then **Settings**, then **Organization**.
  </Step>

  <Step title="Turn on the requirement">
    Turn on **Require two-factor authentication**.
  </Step>
</Steps>

Anyone who signs in without MFA enrolled is walked through enrollment before they can continue.

## Verify

<Check>
  Sign out and sign back in. You're prompted for a code (or a Duo push) after your password.
</Check>

## Common problems

* **Lost your device or recovery codes.** Ask an administrator to reset your MFA enrollment
  from **Users** — you'll enroll again on your next sign-in.
* **Duo is down.** If Duo is unavailable and you also have an authenticator app enrolled,
  Get2Dial falls back to the TOTP code prompt automatically.
* **You want to turn MFA off for yourself.** Go to **Password & security** and turn it off —
  you'll need to confirm your password. Not available if your workspace requires MFA.

## Next steps

<CardGroup cols={2}>
  <Card title="Require single sign-on" href="/account/single-sign-on" />

  <Card title="Set a session policy" href="/account/session-policy" />
</CardGroup>