# Multi-factor authentication

Turn on TOTP multi-factor authentication with an authenticator app, keep recovery codes safe, require MFA for everyone and set the session policy.

Multi-factor authentication (MFA) adds a second step to every sign-in: a six-digit code from an authenticator app (TOTP). Turn it on for your own account, keep your recovery codes, and require it for everyone in your organization.

MFA protects the console and every workspace, because signing in to a workspace goes through the console. It also applies to [single sign-on](https://tracix.io/docs/admin/sso) sign-ins.

## Turn on MFA for your account

**1. Open the two-factor settings**

In the console, open **Profile** from the menu at the bottom of the sidebar and select **Set up** on the two-factor authentication row. **Security › Your 2FA › Set up 2FA** opens the same page.

**2. Start the setup**

Enter your **Current password**, if your account has one, and select **Set up authenticator**.

**3. Link your authenticator app**

Scan the QR code with an authenticator app, such as 1Password, Authy, Google Authenticator or any other TOTP app. Enter the six-digit code it shows in **Authenticator code** and select **Verify**.

**4. Save your recovery codes**

Tracix shows 10 recovery codes. Each one works once, for when you can't use your authenticator, and this is the only time they're shown. Store them somewhere safe, then select **I saved my codes — continue**.

From then on, every sign-in asks for a code.

## Sign in with MFA

After your password or identity provider, Tracix shows **Verify your identity**. Enter the current code from your authenticator in **Authenticator code** and select **Verify**.

If you don't have your authenticator, select **Use recovery code** and enter one of your recovery codes. Each code works once.

## Manage your MFA

Open the same page again, from **Profile** or **Security**, and enter your current password if your account has one:

* **Generate new recovery codes** replaces your codes with a new set of 10. The old codes stop working.
* **Disable two-factor authentication** turns MFA off for your account. You can't turn it off while your organization requires MFA.

Both need a recent sign-in: if you signed in more than five minutes ago, Tracix asks you to sign in again first.

## Require MFA for everyone

Owners, Admins and MSP admins can require MFA for the whole organization.

**1. Check who has MFA**

In the console, open **Security**. The **MFA coverage** and **Members at risk** tiles show how many members use MFA, and the **MFA enforcement** list marks each member **Protected** or **No 2FA**. The **MFA enabled** tile on **Team** shows the same count.

**2. Turn on enforcement**

Turn on **Required** in the **MFA enforcement** card. If some members don't have MFA yet, confirm **Require MFA**.

Members who already use MFA notice no change. Members without it are signed out, and at their next sign-in Tracix takes them through the setup: they confirm their password if they have one, scan the QR code, verify a code and save their recovery codes before they reach the console or a workspace. Nobody is locked out.

## Session policy

The **Sessions** section on **Security** sets how long sign-ins last for everyone in the organization:

| Setting                 | Options                                   | What it does                                                                                                                      |
| ----------------------- | ----------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- |
| **Session timeout**     | 1, 4, 8, 12 or 24 hours, 3 days or 7 days | Signs people out this long after they sign in, however active they are. A shorter limit applies to existing sessions immediately. |
| **Concurrent sessions** | On or off                                 | When off, each person keeps only their newest session; signing in on another device ends the older one.                           |

To end every session of your own account, including the one you're using, open **Settings** in the console and select **Revoke sessions** under **Sign out everywhere**. Changing your password on **Profile** also signs out your other sessions.

## Next steps

- [Single sign-on](https://tracix.io/docs/admin/sso): Sign in through your identity provider

- [Users and roles](https://tracix.io/docs/admin/users-and-roles): Who can change security settings

- [Invite your team](https://tracix.io/docs/get-started/invite-your-team): Bring people in and grant access