Setting up two-factor authentication enforcement (2FA enforcement)

Two-factor authentication (2FA) enforcement lets account owners require all users on their Flockler account to set up 2FA. Once enabled, any member without 2FA will be prompted to set it up the next time they log in, and any new user invited to the account won't be able to finish creating their account without setting up 2FA first.

📱 Before you start

Only account owners can turn on MFA enforcement. Before you can enable it for your team, you'll need to enable 2FA on your own account first. See Setting up two-factor authentication (2FA) for those steps.

🔐 How to enable MFA enforcement

1. Click your username in the top-right corner.
2. Select Settings.
3. Go to the Users tab.
4. In the Security section, toggle Require two-factor authentication for all members to On.

If you haven't enabled 2FA on your own account yet, you'll see a reminder here with a link to your account security settings — you'll need to do that first before the toggle can be turned on:

Once enforcement is on, all users will see their current MFA status (MFA Enabled or MFA Not Enabled) listed next to their name in the Users list. Only account owners can see this for all users:

🔑 What happens next

• Existing users who are already logged in: nothing changes right away. Enforcement won't interrupt an active session. The requirement kicks in the next time that user logs in.

• Existing users without 2FA, at their next login: they'll be asked to set up 2FA before they can continue to their dashboard. They'll see a QR code and setup key, just like the regular 2FA setup flow, and won't be able to access Flockler until verification succeeds:

  

• New users you invite: if someone is invited to an account with MFA enforcement on, they won't be able to complete their account creation and log in without setting up 2FA first.

🔓 Turning off MFA enforcement

Account owners can turn enforcement off at any time:

1. Go to Settings > Users.
2. In the Security section, toggle Require two-factor authentication for all members to Off.

Turning enforcement off doesn't disable 2FA for individual users who've already set it up — it just removes the requirement for members who haven't.