# Two-Factor Authentication

Published 2026-10-31

> Add an authenticator code to password and directory sign-ins, with optional or required protection for your team.

![two-factor-authentication.png](https://officenext.erxes.io/gateway/read-file?key=office-erxes-io%2FGyqBse9T4AEHcqhUcpwHYtwo-factor-authentication.png)

Two-factor authentication adds a six-digit code from an authenticator app after password or Active Directory sign-in. Your team gets an extra check before anyone reaches the workspace.

Admins can choose Off, Optional, or Required in Settings → Security → Two-factor authentication. Required protection can apply to everyone or selected permission groups, with setup prompted at the next sign-in.

Members connect their authenticator app from their account settings and receive 10 one-time recovery codes. If someone loses access to their authenticator, an admin can reset their two-factor setup.

Single sign-on, magic links, and SaaS handoff sign-ins are not affected by this setting.

Available in erxes v3.4.7, released October 29, 2026.