Skip to content
Docs

    Multi-factor authentication

    4 min read · Updated View as Markdown

    Multi-factor authentication (MFA) adds a second step to every sign-in: a six-digit code from an authenticator app (TOTP). Turn it on for your own account, keep your recovery codes, and require it for everyone in your organization.

    MFA protects the console and every workspace, because signing in to a workspace goes through the console. It also applies to single sign-on sign-ins.

    Turn on MFA for your account

    1. Open the two-factor settings

      In the console, open Profile from the menu at the bottom of the sidebar and select Set up on the two-factor authentication row. Security › Your 2FA › Set up 2FA opens the same page.

    2. Start the setup

      Enter your Current password, if your account has one, and select Set up authenticator.

    3. Link your authenticator app

      Scan the QR code with an authenticator app, such as 1Password, Authy, Google Authenticator or any other TOTP app. Enter the six-digit code it shows in Authenticator code and select Verify.

    4. Save your recovery codes

      Tracix shows 10 recovery codes. Each one works once, for when you can't use your authenticator, and this is the only time they're shown. Store them somewhere safe, then select I saved my codes — continue.

    From then on, every sign-in asks for a code.

    Sign in with MFA

    After your password or identity provider, Tracix shows Verify your identity. Enter the current code from your authenticator in Authenticator code and select Verify.

    If you don't have your authenticator, select Use recovery code and enter one of your recovery codes. Each code works once.

    Manage your MFA

    Open the same page again, from Profile or Security, and enter your current password if your account has one:

    • Generate new recovery codes replaces your codes with a new set of 10. The old codes stop working.
    • Disable two-factor authentication turns MFA off for your account. You can't turn it off while your organization requires MFA.

    Both need a recent sign-in: if you signed in more than five minutes ago, Tracix asks you to sign in again first.

    Require MFA for everyone

    Owners, Admins and MSP admins can require MFA for the whole organization.

    1. Check who has MFA

      In the console, open Security. The MFA coverage and Members at risk tiles show how many members use MFA, and the MFA enforcement list marks each member Protected or No 2FA. The MFA enabled tile on Team shows the same count.

    2. Turn on enforcement

      Turn on Required in the MFA enforcement card. If some members don't have MFA yet, confirm Require MFA.

    Members who already use MFA notice no change. Members without it are signed out, and at their next sign-in Tracix takes them through the setup: they confirm their password if they have one, scan the QR code, verify a code and save their recovery codes before they reach the console or a workspace. Nobody is locked out.

    Session policy

    The Sessions section on Security sets how long sign-ins last for everyone in the organization:

    SettingOptionsWhat it does
    Session timeout1, 4, 8, 12 or 24 hours, 3 days or 7 daysSigns people out this long after they sign in, however active they are. A shorter limit applies to existing sessions immediately.
    Concurrent sessionsOn or offWhen off, each person keeps only their newest session; signing in on another device ends the older one.

    To end every session of your own account, including the one you're using, open Settings in the console and select Revoke sessions under Sign out everywhere. Changing your password on Profile also signs out your other sessions.

    Next steps

    Single sign-onSign in through your identity providerUsers and rolesWho can change security settingsInvite your teamBring people in and grant access
    Report a problem with this page