---
title: Require and manage two-factor authentication for users
description: >-
  Require two-factor authentication for a role, a single user or several users,
  see who has set it up in the 2FA column, and reset a user's authenticator app.
sidebar:
  order: 15
---

**Administrators can require two-factor authentication (2FA) for a whole role, for single users or for a selection of users, see who has set it up, and reset a user's authenticator app.** Users who are required to use 2FA must set up an authenticator app before they can use the dashboard.

:::tip
Fuxam's two-factor authentication uses authenticator apps with 6-digit codes (TOTP) only — no SMS and no backup codes. How users set it up themselves is described in [Secure your account with two-factor authentication and passkeys](/docs/fuxam-web/settings/account-security).
:::

## Why it matters

Staff and administrators can see and change a lot of personal data. Requiring a second factor for these accounts protects them even if a password leaks. Because you can require it per role or per user, you can start with the accounts that matter most and extend it later.

## Before you start

| Requirement | Detail |
|---|---|
| Require 2FA for a role | Permission to edit roles under **Settings → Roles & Permissions** |
| Require or stop requiring 2FA for users | Permission **Require Two-Factor Authentication** (for all users or for specific users) |
| Reset a user's 2FA | Permission **Disable Two-Factor Authentication** (for all users or for specific users) |
| SSO Alias | 2FA cannot be required for a role while SSO Alias is enabled for your institution. See [Single sign-on (SSO)](/docs/fuxam-web/settings/single-sign-on) |

## Require 2FA for a role

1. Go to **Settings → Roles & Permissions** and open the role.

2. Open the **Security** tab.

3. Turn on **Require two-factor authentication**. The description explains that users with this role must set up an authenticator app before they can access the dashboard, and that each user completes setup on their next visit.

4. Select **Save** in the unsaved-changes bar. You see "Two-factor authentication is now required for users with this role. They will be prompted to set up an authenticator app on their next visit."

To stop requiring it, turn the switch off and save again ("Two-factor authentication is no longer required for users with this role.").

## Require 2FA for one user

1. Go to **Campus Management → Users** and open the user.

2. In the profile header, open the **…** menu and select **Require two-factor authentication**. While 2FA is not yet required for the user, you can also select the shield icon in the header ("Click to require two-factor authentication").

3. Confirm **Require two-factor authentication for [name]?** with **Require 2FA**. You see "This user must set up two-factor authentication before using the dashboard."

To undo it, open the same **…** menu, select **Stop requiring two-factor authentication** and confirm with **Stop requiring 2FA**. The user is then no longer required to use 2FA — unless their role still requires it.

## Require 2FA for several users at once

1. Go to **Campus Management → Users** and tick the users in the table.

2. Open the bulk **…** menu and, in the **Security** section, select **Require two-factor authentication**.

3. Confirm **Require two-factor authentication for [count] users?** with **Require 2FA**.

## Reset a user's 2FA

Use this when a user lost the phone with their authenticator app.

1. Open the user from **Campus Management → Users**.

2. In the profile header, open the **…** menu and select **Disable two-factor authentication**. This entry only appears when the user has 2FA turned on.

3. Confirm **Disable two-factor authentication for [name]?** with **Disable 2FA**. This removes the user's authenticator-app setup. If 2FA is still required for them, they are asked to set it up again on their next visit.

For several users, tick them in the **Users** table, open the bulk **…** menu and select **Disable two-factor authentication** in the **Security** section. Only selected users who have 2FA turned on are affected.

## See who has 2FA

The **Users** table has a **2FA** column and a **2FA** filter with three values:

| Value | Meaning |
|---|---|
| **Enabled** | The user has set up an authenticator app |
| **Required** | 2FA is required for the user (directly or through their role), but they have not set it up yet |
| **Disabled** | The user has no 2FA and it is not required |

The shield icon in the user's profile header shows the same status.

## Common pitfalls

| Pitfall | What happens | What to do |
|---|---|---|
| Role switch cannot be saved | "Two-factor authentication cannot be required for a role while SSO Alias is enabled." | SSO Alias and 2FA cannot be combined; require 2FA only where SSO Alias is not used |
| You stopped requiring 2FA for a user but they still see the setup | Their role still requires it | Check the role's **Security** tab |
| Bulk disable does nothing | "None of the selected users have two-factor authentication enabled." | Filter the table by **2FA** = **Enabled** before selecting |
| Users expect an SMS code | Only authenticator apps are supported | Point users to [Secure your account](/docs/fuxam-web/settings/account-security) |

## FAQ

**Does requiring 2FA lock users out immediately?**

No. The requirement applies at once, but each user sets up their authenticator app themselves on their next visit. Until then they see the setup screen instead of the dashboard.

**Can I turn on 2FA for a user without their phone?**

No. You can only require it. The user scans the QR code and enters a code themselves.

**Can users turn 2FA off again when it is required?**

No. The switch in their own security settings stays on and locked while 2FA is required for them.

## Related pages

**[Secure your account with two-factor authentication and passkeys](/docs/fuxam-web/settings/account-security)**

What users see and do on Settings → Personal → Security.

**[Roles and permissions](/docs/fuxam-web/base/user-management/roles-and-permissions)**

Set up roles and the permissions that control who can manage 2FA.

**[Bulk actions](/docs/fuxam-web/base/user-management/bulk-actions)**

Select several users and act on all of them at once.

**[Single sign-on (SSO)](/docs/fuxam-web/settings/single-sign-on)**

Why SSO Alias and 2FA cannot be combined.