Licensed to be used in conjunction with basebox, only.
// admin
Two-factor authentication
Brief description
With the Two-Factor Authentication switch you require all users of your organisation to set up and use a second factor when signing in. In addition to their password, they then enter a code they receive by SMS or through an authenticator app.
What do I use two-factor authentication for
A password alone can be guessed, intercepted or reused. With a second factor, the password is no longer enough to sign in as a person of your organisation. This protects your organisation's chats, apps and knowledge bases and is required by many security policies.
Where do I find the setting
Under Administration → Organisation in the Two-Factor Authentication section.
- On: the switch requires all users of this organisation to set up and use a second factor when signing in.
- Off: users are not required to set up two-factor authentication.
Step by step
- Announce the change, for example with a daily announcement: from when the second factor is mandatory and that a mobile phone (SMS) or an authenticator app is needed.
- Open Administration → Organisation.
- Turn on the switch in the Two-Factor Authentication section.
- Click Save at the top of the page.
- Sign out and back in as a test and set up your own second factor.
What users experience
- At their next sign-in, users who do not yet have a second factor are asked to set one up. They choose one of two methods: code by SMS or code from an authenticator app.
- At every further sign-in they enter the code after the password.
- Nothing changes for the API: requests via the OpenAI-compatible API use API keys, not a sign-in.
Notes
Note
- The setting applies to all users of this organisation, including administrators.
- Since basebox 1.9, two-factor authentication can also be required for individual groups only, on top of or instead of the organisation-wide setting.
- If your users sign in via SSO with your own identity provider, that provider's multi-factor policy applies there.
- Switching it on or off is recorded as a settings change in the Audit Log.
Frequently asked questions
Can I decide which method users use? No. Users choose between SMS and authenticator app themselves.
What do I do if someone has lost their phone? Contact support.
Does the requirement apply to me as administrator? Yes, it applies to all users of the organisation.
What happens if I turn the switch off again? Users are then no longer required to use a second factor.
Next step: Groups · Sign-in (LDAP / SSO)
Need help? Contact support