# Two-factor enforcement (/en/docs/platform/security/mfa)



**Settings** > **General** > **Require two-factor authentication** makes two-factor authentication mandatory for everyone in the workspace.

Workspace Admins and the Owner can change this setting.

## Prerequisites [#prerequisites]

You cannot turn the requirement on without having two-factor authentication on your own account. The attempt is refused with a prompt to set it up first. For more information, refer to [Two-factor authentication](/en/docs/platform/account/mfa).

The switch also takes effect for everyone at once, including people who are asleep, on leave, or mid-deploy. Two things are worth doing first:

* **Tell people, with a date:** Enrolment takes a minute, but only if they know it is coming.
* **Check your integrations:** Anything running as a person who has not enrolled starts failing. API keys act as their creator, so a key created by an unenrolled member stops working. For more information, refer to [API keys](/en/docs/platform/integrations/api-keys).

## Turn on the requirement [#turn-on-the-requirement]

In **Settings** > **General**, turn on **Require two-factor authentication**. It applies immediately.

## What members without two-factor see [#what-members-without-two-factor-see]

They cannot use this workspace until they enrol an authenticator app. They are not signed out, and their other workspaces are unaffected.

The block is total. API calls scoped to this workspace are refused the same way, so an unenrolled member's integrations stop working too.

## Turn off the requirement [#turn-off-the-requirement]

Flipping the switch back restores access for unenrolled members immediately. Nobody's existing two-factor authentication is removed.

Turning the requirement on and off is recorded in the audit log as `workspace.mfa_enforcement_changed`.

## Next steps [#next-steps]

* [Two-factor authentication](/en/docs/platform/account/mfa)
* [Audit logs](/en/docs/platform/security/audit-log)