Two-factor authentication (2FA) asks people who log in with a password for a 6-digit code from an authenticator app on their phone. A stolen password alone then can't open an account that approves invoices or sees your talent's payment details.

Who can do this: Admins ask for it, and Worksuite turns it on for your workspace.

Availability: Available on request: contact Worksuite Support or your Business Solutions Architect.

TABLE OF CONTENTS

How 2FA works in Worksuite

2FA is one setting for your whole workspace. It applies to your team and your talent, and it can't be turned on for one person or one profile only. You choose one of two modes:

ModeWhat happens
OptionalEach person decides whether to add 2FA in their own settings.
MandatoryEveryone who logs in with a password must set up 2FA before they reach their dashboard.
Important: 2FA is available only in workspaces that don't use secure login links. Turning on 2FA means your workspace stops using login links, in both modes. Everyone logs in with their email address and a password, and buttons in Worksuite emails don't log people in automatically. Plan this change with your team and your talent before you ask for it.

2FA applies when someone logs in with an email address and password. Logins through your company's single sign-on (SSO) or Google sign-in don't ask for a 2FA code, so they rely on that provider's security checks.

Before you start

  • Decide whether 2FA should be Optional or Mandatory.
  • Tell your team and your talent before it goes on. Each person needs a password and an authenticator app, such as Google Authenticator or Microsoft Authenticator.
  • Share How to Set Up and Use Two-Factor Authentication (2FA) with your talent, so they know what to expect.

Turn on 2FA

  1. Contact Worksuite Support or your Business Solutions Architect and ask to turn on 2FA.
  2. Say whether you want Optional or Mandatory 2FA.
  3. Agree on a date, so you can tell your team and talent before the change.

Once 2FA is on, everyone logs in with a password. Anyone who has only used login links sees Setup password (or Reset password) on your login page and creates a password from the email they receive. With Mandatory 2FA, each person sees the setup screen right after they log in. To switch between Optional and Mandatory, or to turn 2FA off, contact Worksuite the same way. This setting isn't in your account settings.

What your team and talent see

To set up 2FA, each person:

  1. Logs in with their email address and password.
  2. With Mandatory 2FA, sees Set up Two-Factor Authentication right away. With Optional 2FA, clicks the settings icon next to their profile picture at the bottom left, opens Personal settings (team members) or Account (talent), and clicks Add a Two-Factor Authentication method.
  3. Scans the QR code with their authenticator app, or enters the code shown under it.
  4. Enters the 6-digit code from the app.
  5. Prints or downloads the backup codes and ticks I've secured my backup codes. With Mandatory 2FA, clicks Continue to your account. With Optional 2FA, clicks Close and return to account.

After that, every password login asks for the current code from the app, or one of their backup codes.

Good to know

  • Backup codes are a way back in. If someone loses their phone, they can log in with one of their backup codes. Each code works once. They can create a fresh set with Generate backup codes in their settings.
  • Resets go through Worksuite Support. Admins can't reset another person's 2FA. After Support resets it, the person sets it up again the next time they log in with their password.
  • A password change doesn't reset 2FA. People keep using the same entry in their authenticator app.
  • Codes depend on the phone's clock. Most rejected codes are fixed by setting the phone's date and time to automatic.

Troubleshooting

A talent says they don't see 2FA in their settings

2FA isn't turned on for your workspace. Ask Worksuite to turn it on if you want your talent to use it.

Your talent's login links stop working after 2FA is turned on

This is expected, because 2FA workspaces don't use login links. Ask your talent to click Setup password (or Reset password) on your login page and follow the email to create a password.

Someone is asked for a code they can't get, or lost their phone

Ask them to enter one of their backup codes. If they don't have one, they click Contact support on the code screen, or contact Worksuite Support for a 2FA reset.

Why don't I see a 2FA setting for the workspace?

Worksuite manages this setting for your workspace. Contact Worksuite Support or your Business Solutions Architect to turn it on, change the mode, or turn it off.

Support/Resources

Still have questions about two-factor authentication? Click Support in the bottom-left corner of Worksuite to contact our Support team, or email support@worksuite.com. Including a link to the page you're on and a screenshot helps us answer faster.