On this page0
Guide
Check and adjust MFA
Protect your own account with a second factor, then decide who else must use one: everyone, or only chosen groups.
Before you start
- MFA (multi-factor authentication) means signing in with two things: your password, and a second factor such as a code from an app on your phone or a passkey (a sign-in stored on your device and unlocked with your fingerprint, face or PIN).
- You can sign in to your instance. If you have not done that yet, start with the First sign-in guide.
- To change who must use MFA, you need an account that can manage security settings. The primary administrator can.
- A device with a fingerprint reader, Face ID or a security key if you want to add a passkey.
Secure your own account
Step 1: Open your sign-in settings
Go to My Profile and scroll to “Sign-in & security”. It lists your passkeys, your recovery codes and your trusted devices.
If you are an administrator, you already set up a second factor at your first sign-in. People who have not are asked to set one up (a passkey or an authenticator app) the next time they sign in after MFA applies to them.Step 2: Add a passkey
Next to “Passkeys”, click “ADD PASSKEY” and follow your browser’s prompt. Adding a second passkey on another device (for example a laptop and a phone) means losing one does not lock you out.
Step 3: Check your recovery codes
Under “Recovery codes”, check how many codes you have left. If it says “None”, click “GENERATE CODES”. If you have lost your saved copy, click “REGENERATE”. Your old codes stop working straight away.
Click “DOWNLOAD AS TEXT FILE” and keep the ten new codes somewhere safe. They are shown only once. Then click “I’VE SAVED THEM”.
Decide who must use MFA
Step 4: Open the MFA settings
Go to Security & ComplianceSecurity SettingsMFA. The “MFA” panel is the first thing you see on that page.
Step 5: Require MFA for everyone
Under “ORG-WIDE DEFAULT”, turn on “Mandatory MFA for local accounts”. Then click “SAVE SETTINGS” at the bottom of the page.
This is the default for every group left on “Inherit default”. If you want MFA only for chosen groups, turn it off, save, and use step 6 instead.
Step 6: Require or exempt a group
Go to AdministrationGroups. Find the group and click its “Edit Group” button (the pencil). Open “MFA Policy” and choose one:
- “Inherit default”: follows the org-wide switch from step 5.
- “Require”: every member must set up and use MFA, whatever the org-wide switch says.
- “Exempt”: members skip MFA. Set “Exempt until (blank = permanent)” and a “Reason (audit trail)”. An exemption does not cover everyone. Administrators, and anyone holding the permission to manage security, to manage users or to mark approved invoices as paid, always need a second factor at sign-in. No group exemption lifts that, and neither does ticking Trust this device for 30 days.
Click “Update Group” to save.
What you should see
Back on Security & ComplianceSecurity SettingsMFA, “PER-GROUP ENFORCEMENT” shows how many groups are set to “REQUIRE” and how many exemptions are active, with each exemption’s end date and reason.
On the Groups page, groups that require MFA show an “MFA ENFORCED” mark. The next time an affected person signs in without a second factor, they are taken through setting one up and saving their own recovery codes.
Anyone who has added a passkey can click “SIGN IN WITH A PASSKEY” on the sign-in page instead of typing a password. The passkey counts as both steps, so they are not asked for a code afterwards.
“Trust this device for 30 days” on the code screen lets a person skip the second step on that browser. It does not work for the people named in the note at the top of this guide: they are asked every time.
If something goes wrong
- “Failed to update security settings.” after clicking Save Settings
- The change was not saved. Refresh the page, check the switch, and save again. If it keeps failing, contact Zonitix support.
- The MFA Policy buttons are greyed out, with “Only a security administrator can change the MFA policy.”
- Your account can edit groups but not security settings. Ask an administrator to change the group’s MFA policy.
- Someone is in an exempt group but is still asked for MFA
- This is expected for some people. Administrators, and anyone holding the permission to manage security, to manage users or to mark approved invoices as paid, always need a second factor at sign-in. No group exemption lifts that, and neither does ticking Trust this device for 30 days. It also happens once the “Exempt until” date has passed.
- A person lost their phone or passkey
- They sign in with their password, click “Lost your device? Use a Recovery Code” and enter one of their 8-character codes. Each code works once. Once they are in, they can add a new passkey from My Profile.
- A person lost their device and has no recovery codes left
- An administrator resets their MFA. On AdministrationUsers, click the shield button on the person’s row (“Account security: reset MFA or revoke trusted devices”) and choose “Reset MFA”. You need a role that lets you manage security settings, and Zonitix asks you to confirm your own identity first. It removes their authenticator app, every passkey, their recovery codes and every trusted device; they set up a second factor again at their next sign-in. “Revoke trusted devices”, in the same menu, keeps their factors and only makes every browser ask for the second factor again. See Help someone who is locked out.
- People who sign in through Okta, Microsoft or Google are not asked for a Zonitix code
- This is expected for ordinary users: when someone signs in through your identity provider, Zonitix relies on the MFA your provider applies, so set it up there. The exception is the people named in the note at the top of this guide, who always need a second factor. They are still asked for a Zonitix second factor after single sign-on unless your provider proves it performed MFA.
Still stuck? See When something goes wrong, or Contact Zonitix support.